Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.

OpenStack Ironic 是 OpenStack 中用于裸机服务器部署和管理的关键组件。所谓 deploy interface，是 Ironic 在部署过程中负责加载镜像、引导节点并执行必要预配置的插件。autodetect deploy interface 是其中一种特殊的接口，它能够根据节点的硬件属性自动选择最合适的部署接口，从而简化配置。然而，在版本 38.0.1 之前，当管理员将一个节点注册到 Ironic，或者将已有节点的部署接口从其他接口切换为 autodetect 时，节点可能不会立即触发清理（cleaning）阶段。在 Ironic 的流程中，清理是节点在部署前后用于确保物理环境安全和干净的必要步骤，包括电源状态重置、网络配置清理、固件设置初始化等。如果清理没有及时运行，节点可能残留上一次使用的配置，或者处于不确定的状态，这可能导致后续部署失败，甚至在多租户环境中带来安全风险。攻击者如果能够利用某种途径（例如通过 OpenStack 的 API）触发这种情况，并且具备一定程度的环境访问权，则可能探测到节点内部的敏感配置或状态，构成机密性泄露。该漏洞的 CVSS 向量为 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N，综合评分为 6.3，属于中等严重性。修复该漏洞需要升级到 Ironic 38.0.1 及以上版本，该版本修复了 autodetect 接口在注册或切换时可能跳过清理的问题。目前没有任何公开信息显示该漏洞已被在野利用，但建议 OpenStack 运维人员优先安排升级，并评估降低 Ironic API 的网络暴露面，以减小潜在攻击窗口。

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat AS

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat AS

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the '  Security Update for ASUS Syste

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the '  Security Update for ASUS Syste

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free() without first zeroing the buffer contents, releasing heap-allocated buffers containing sensitive data — including one-time pad bytes read from disk — without clearing, leaving the sensitive content in freed heap memory until it happens to