CVE-2025-1000
published 2025-05-05CVE-2025-1000: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a…
PriorityP431medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.32%
23.4th percentile
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1
could allow an authenticated user to cause a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | authzed_spicedb | >= 0 < 1.45.2 | 1.45.2 |
| chrome_chrome | — | — | |
| ibm | db2 | 11.5 – 11.5.9 | — |
| ibm | db2 | 12.1.0 – 12.1.1 | — |
| msrc | windows_security_app | — | — |
| qs_project | qs | >= 0 < 6.14.1 | 6.14.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.3MEDIUM
vendor_msrc5.5MEDIUM
vendor_cisco3.1
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
ghsa·2025-12-30
CVE-2025-15284 [MEDIUM] CWE-20 qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
### Summary
The `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1&a[]=2`), only for indexed notation (`a[0]=1`). This is a consistency bug; `arrayLimit` should apply uniformly across all array notations.
**Note:** The default `parameterLimit` of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than `parameterLimit` regardless of `arrayLimit`, because each `a[]=value` consumes one parameter slot. The severity has been reduced accordingly.
### Details
The `arrayLimit` option only checked limits for indexed notation (`a[0]=1&a[1]=2`) but did not enforce it for bracket notation (`a[]=1&a[]=2`).
**V
GHSA
SpiceDB WriteRelationships fails silently if payload is too big
ghsa·2025-11-13
CVE-2025-64529 [LOW] CWE-770 SpiceDB WriteRelationships fails silently if payload is too big
SpiceDB WriteRelationships fails silently if payload is too big
### Impact
Users who:
1. Use the exclusion operator somewhere in their authorization schema.
1. Have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500.
1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.
Users will:
1. Receive a successful response from their `WriteRelationships` call, when in reality that call failed.
2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.
### Patches
Upgrade to v.145.2.
### Workarounds
Set `--write-relationships-max-updates-per-call` to `1000`.
GHSA
GHSA-66j9-wx8r-qgqq: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11
ghsa_unreviewed·2025-05-05
CVE-2025-1000 [MEDIUM] CWE-770 GHSA-66j9-wx8r-qgqq: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1
could allow an authenticated user to cause a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting.
Red Hat
qs: qs: Denial of Service via improper input validation in array parsing
vendor_redhat·2025-12-29·CVSS 6.3
CVE-2025-15284 [MEDIUM] CWE-770 qs: qs: Denial of Service via improper input validation in array parsing
qs: qs: Denial of Service via improper input validation in array parsing
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
Details
The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2
Red Hat
kernel: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
vendor_redhat·2025-12-06·CVSS 4.4
CVE-2025-40281 [MEDIUM] CWE-1335 kernel: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
kernel: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In the Linux kernel, the following vulnerability has been resolved:
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha
and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41
shift exponent 64 is too large for 32-bit type 'unsigned int'
CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute E
Chrome
Stable Channel Update for Desktop: CVE-2025-12905
vendor_chrome·2025-09-02·CVSS 5.4
CVE-2025-12905 [LOW] Stable Channel Update for Desktop: CVE-2025-12905
Stable Channel Update for Desktop
CVE-2025-12905: Inappropriate implementation in Downloads. Reported by Tom Haas on 2025-07-12 [$1000][ 428455319 ] Low CVE-2025-12906: Inappropriate implementation in Permissions
Reported by Hafiizh on 2025-06-29 [$1500][ 427367145 ] Low CVE-2025-12907: Insufficient validation of untrusted input in Devtools
Severity: low
Chrome
Stable Channel Update for Desktop: CVE-2025-12908
vendor_chrome·2025-09-02·CVSS 5.4
CVE-2025-12908 [LOW] Stable Channel Update for Desktop: CVE-2025-12908
Stable Channel Update for Desktop
CVE-2025-12908: Insufficient validation of untrusted input in Downloads. Reported by Abhishek Kumar on 2025-05-31 [$1000][ 361116749 ] Low CVE-2025-12909: Insufficient policy enforcement in Devtools
Reported by Noam Gaash on 2024-08-20 [TBD][ 434977743 ] Low CVE-2025-12910: Inappropriate implementation in Passkeys
Severity: low
Microsoft
Windows Security App Spoofing Vulnerability
vendor_msrc·2025-06-10·CVSS 5.5
CVE-2025-47956 [MEDIUM] CWE-73 Windows Security App Spoofing Vulnerability
Windows Security App Spoofing Vulnerability
Description: External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.
FAQ: Is more information available about Windows Security App?
Yes, please see Stay Protected With the Windows Security App for more information.
How do I know if I'm protected from this vulnerability
From the Start menu, type Windows Security and hit Enter. The Windows Security App will be displayed. Click on the Settings control and then click the About link. The current version will be displayed. See that your version is greater than or equal to 1000.27840.0.0.
Windows Security App: Windows Security App
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:
Chrome
Stable Channel Update for Desktop: CVE-2025-4052
vendor_chrome·2025-04-29·CVSS 6.3
CVE-2025-4052 [LOW] Stable Channel Update for Desktop: CVE-2025-4052
Stable Channel Update for Desktop
CVE-2025-4052: Inappropriate implementation in DevTools. Reported by vanillawebdev on 2025-03-10 The previous version of these notes did not include the following security fixes which were included in the release: [$4000][ 402791076 ] Medium CVE-2025-13097: Inappropriate implementation in DevTools
Reported by Alesandro Ortiz on 2025-03-13 [$1000][ 379818904 ] Low CVE-2024-13983: Inappropriate implementation in Lens
Severity: low
Chrome
Stable Channel Update for Desktop: CVE-2025-3067
vendor_chrome·2025-04-01·CVSS 8.6
CVE-2025-3067 [MEDIUM] Stable Channel Update for Desktop: CVE-2025-3067
Stable Channel Update for Desktop
CVE-2025-3067: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer (TU Wien) on 2024-10-31 [$2000][ 401823929 ] Medium CVE-2025-3068: Inappropriate implementation in Intents
Reported by Simon Rawet on 2025-03-09 [$1000][ 40060076 ] Medium CVE-2025-3069: Inappropriate implementation in Extensions
Severity: medium
Cisco
Cisco IOS Software on Cisco Catalyst 1000 and 2960L Switches Access Control List Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20137 Cisco IOS Software on Cisco Catalyst 1000 and 2960L Switches Access Control List Bypass Vulnerability
CVE-2025-20137: Cisco IOS Software on Cisco Catalyst 1000 and 2960L Switches Access Control List Bypass Vulnerability
A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the use of both an IPv4 ACL and a dynamic ACL of IP Source Guard on the same interface, which is an unsupported configuration. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device. Note: Cisco documentation has been updated to reflect that this is an unsupported configuration
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-68189 kernel: drm/msm: Fix GEM free for imported dma-bufs
bugzilla·2025-12-16
CVE-2025-68189 CVE-2025-68189 kernel: drm/msm: Fix GEM free for imported dma-bufs
CVE-2025-68189 kernel: drm/msm: Fix GEM free for imported dma-bufs
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix GEM free for imported dma-bufs
Imported dma-bufs also have obj->resv != &obj->_resv. So we should
check both this condition in addition to flags for handling the
_NO_SHARE case.
Fixes this splat that was reported with IRIS video playback:
------------[ cut here ]------------
WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm]
CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT
pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : msm_gem_free_object+0x1f8/0x264 [msm]
lr : msm_gem_free_object+0x138/0x264 [msm]
sp : ffff800092a1bb30
x29: ffff80009
Bugzilla
CVE-2025-38184 kernel: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
bugzilla·2025-07-04·CVSS 5.5
CVE-2025-38184 [MEDIUM] CVE-2025-38184 kernel: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
CVE-2025-38184 kernel: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
The reproduction steps:
1. create a tun interface
2. enable l2 bearer
3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun
tipc: Started in network mode
tipc: Node identity 8af312d38a21, cluster identity 4711
tipc: Enabled bearer , priority 1
Oops: general protection fault
KASAN: null-ptr-deref in range
CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT
Hardware name: QEMU Ubuntu 24.04 PC
RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0
the ub was in fact a struct dev.
when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or
othe
Bugzilla
CVE-2025-37875 kernel: igc: fix PTM cycle trigger logic
bugzilla·2025-05-09·CVSS 5.5
CVE-2025-37875 [MEDIUM] CVE-2025-37875 kernel: igc: fix PTM cycle trigger logic
CVE-2025-37875 kernel: igc: fix PTM cycle trigger logic
In the Linux kernel, the following vulnerability has been resolved:
igc: fix PTM cycle trigger logic
Writing to clear the PTM status 'valid' bit while the PTM cycle is
triggered results in unreliable PTM operation. To fix this, clear the
PTM 'trigger' and status after each PTM transaction.
The issue can be reproduced with the following:
$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m
Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to
quickly reproduce the issue.
PHC2SYS exits with:
"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
fails
This patch also fixes a hang in igc_probe() when loading the igc
driver in the kdump kernel on systems supporting PTM.
The igc driver running in the base k
2025-05-05
Published