CVE-2025-8838
published 2025-08-11CVE-2025-8838: A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.54%
41.5th percentile
A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page."
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 2.6.12 < 5.4.302 | 5.4.302 |
| linux | linux_kernel | >= 5.11.0 < 5.15.197 | 5.15.197 |
| linux | linux_kernel | >= 5.16.0 < 6.1.159 | 6.1.159 |
| linux | linux_kernel | >= 5.5.0 < 5.10.247 | 5.10.247 |
| linux | linux_kernel | >= 6.13.0 < 6.17.8 | 6.17.8 |
| linux | linux_kernel | >= 6.2.0 < 6.6.117 | 6.6.117 |
| linux | linux_kernel | >= 6.7.0 < 6.12.58 | 6.12.58 |
| winterchens | my-site | — | — |
| winterchens | my-site | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
net: ipv6: fix field-spanning memcpy warning in AH output
osv·2025-12-16
CVE-2025-40363 net: ipv6: fix field-spanning memcpy warning in AH output
net: ipv6: fix field-spanning memcpy warning in AH output
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: fix field-spanning memcpy warning in AH output
Fix field-spanning memcpy warnings in ah6_output() and
ah6_output_done() where extension headers are copied to/from IPv6
address fields, triggering fortify-string warnings about writes beyond
the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are
intentionally placed after the IPv6 header in memory. Fix by properly
copying addresses and extension headers separately, an
GHSA
GHSA-5rgc-2f8v-p8gj: A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8
ghsa_unreviewed·2025-08-11
CVE-2025-8838 [MEDIUM] CWE-287 GHSA-5rgc-2f8v-p8gj: A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8
A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page."
Red Hat
kernel: net: ipv6: fix field-spanning memcpy warning in AH output
vendor_redhat·2025-12-16·CVSS 5.5
CVE-2025-40363 [MEDIUM] CWE-131 kernel: net: ipv6: fix field-spanning memcpy warning in AH output
kernel: net: ipv6: fix field-spanning memcpy warning in AH output
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: fix field-spanning memcpy warning in AH output
Fix field-spanning memcpy warnings in ah6_output() and
ah6_output_done() where extension headers are copied to/from IPv6
address fields, triggering fortify-string warnings about writes beyond
the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are
intentionally placed after the IPv6 header in memory. Fix by properly
copying addresses and extension headers separately
No detection rules found.
No public exploits indexed.
https://github.com/WinterChenS/my-site/issues/97https://github.com/WinterChenS/my-site/issues/97#issuecomment-2986947791https://github.com/WinterChenS/my-site/issues/97#issuecomment-2987091571https://vuldb.com/?ctiid.319372https://vuldb.com/?id.319372https://vuldb.com/?submit.622421https://github.com/WinterChenS/my-site/issues/97https://github.com/WinterChenS/my-site/issues/97#issuecomment-2986947791https://github.com/WinterChenS/my-site/issues/97#issuecomment-2987091571https://vuldb.com/?submit.622421
2025-08-11
Published