Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 3 articles for you...
78
security advisorybuffer overflowcriticalDebian 12.11: Security Updates and Critical Fixes for Users
Debian 12.11 isn’t a new chapter in the lineup of Debian releases but rather an important update to fine-tune and patch the existing Debian 12 “Bookworm” series. This eleventh point release brings with it critical improvements in the form of 81 bug fixes and 45 security updates. Whether running a production server or using Debian for personal projects, these updates address vulnerabilities and improve stability, offering peace of mind to system administrators and users alike. . The good news is, upgrading to Debian 12.11 doesn’t mean reinstalling your operating system from scratch. By following standard methods—like leveraging Debian mirrors via apt —you can keep your system up to date with a few quick commands. For those installing Debian for the first time or needing offline installations, updated ISO images are available and ready to deliver the latest improvements immediately. Let's examine what's been fixed and optimized in this release and how you can upgrade to strengthen your security posture as a Debian user. Security Updates: A Layer of Protection You Can Count On One of the key pillars of any Debian update is its security enhancements, and Debian 12.11 delivers strongly in this regard. With 45 security advisories bundled into this point release, several critical vulnerabilities were addressed to protect users from potential exploits or disruptions. What Critical Vulnerabilities Have Been Addressed in Debian 12.11? Let’s examine some of the most significant fixes introduced in this release: OpenSSL had timing side-channel vulnerabilities patched ( CVE-2024-13176 ), securing cryptographic operations for sensitive connections. NGINX , a cornerstone of web server infrastructure, received fixes for buffer under-read issues when handling MP4 files ( CVE-2024-7347 ). This resolves potential crashes or exploits targeting this NGINX. Redis , popular in large-scale caching and data systems, saw denial-of-service flaws corrected ( CVE-2025-21605 ).Without this fix, attackers could potentially compromise or overwhelm Redis servers. The Linux Kernel itself was refined for both security and improved stability (DSA-5900, DSA-5907), closing loopholes that could be exploited in production environments. Applications That Boost Security, Now Hardened The scope of improvements doesn’t stop at the core system. Debian 12.11 brings updates to critical applications, addressing vulnerabilities that could otherwise be problematic in real-world scenarios: Chromium saw browser-related vulnerabilities patched (DSA-5877, DSA-5882), ensuring safer web browsing. PHP , used in countless web apps, received fixes to mitigate cross-site scripting attacks (DSA-5878]. This is essential for anyone hosting PHP-based services. Ghostscript, used for file manipulation and rendering, addressed buffer overflow vulnerabilities (DSA-5888). Thunderbird, the email client of choice for many, has been improved to offer stronger email security (DSA-5891). Exim4 , a widely used email server, patched vulnerabilities to prevent disruptions and potential exploits (DSA-5887). LibreOffice received updates to support smoother usability and prevent potential crashes or system exploits (DSA-5908). Known Issues: The Watchdog Regression As with any update, not everything is smooth sailing. Debian 12.11 does come with one notable regression tied to the Linux 6.1.137-1 kernel. On the amd64 architecture, some watchdog-related modules—such as the w83977f_wdt module—are unable to load. Watchdogs are critical for monitoring and recovering malfunctioning systems, particularly in automated environments, so this regression could be problematic for certain users. Mitigation Strategies for Debian Admins If you’re tasked with overseeing Debian systems, there are a few actionable recommendations you should follow to make the most of this update: Upgrade Systems Without Delay: Start by updating all relevant packages using standardDebian tools, like apt upgrade . Be sure to point your package manager to an official mirror before proceeding. If your setup depends on the functionality of watchdog modules, hold off upgrading the affected kernel version and keep an eye out for future releases that resolve the regression. Review Security Advisories: Take time to validate whether your systems are running any packages impacted by Debian security advisories . Prioritize critical fixes and restart services if needed to ensure patched packages function correctly. Verify Configurations Post-Update: Once updates are complete, review your configurations for services like OpenSSL, Redis, NGINX, and PHP. These optimize the handling of security protocols and best practices for protection against exploits. Updated ISO Images: A Fresh Start with Debian 12.11 For users deploying completely new systems, updated ISO images for Debian 12.11 are available here. These images include all fixes and improvements from this point release, offering a convenient way to start fresh without additional steps. Whether you're spinning up virtual machines for testing or installing operating systems offline, upgrading your Debian OS is a practical, intelligent move! Our Final Thoughts on Debian 12.11's Security Improvements Debian 12.11 is more than just an incremental point release—it’s a robust update designed to secure, stabilize, and improve systems across the board. From its critical security fixes addressing vulnerabilities like buffer overflows and cross-site scripting to its bug patches ensuring reliable usage across key software packages, this release carries immense value for Debian users. Admins maintaining production servers or personal systems can greatly benefit from applying this update promptly. While the kernel regression leaves room for caution, the overall improvements stand to fortify Debian 12 “Bookworm” against modern threats and usability challenges. Whether fixing vulnerabilities or simply wanting a smootherexperience, Debian 12.11 delivers exactly what you need: reliability, security, and progress! . Ubuntu 22.04 introduces significant performance optimizations and bug corrections that improve overall system stability against potential threats.. Debian 12.11 security fixes, bug patches Debian, Debian OS upgrade. . Brittany Day
May 20, 2025
•
Vendors/Products
78
security advisorysoftware updatecross site scriptingWordPress 2.8.6 Security Advisory: Fix Cross Site Scripting Threat
News, today, of the release of the latest security update for Wordpress, now revved to 2.8.6. Specific re-mediated issues are related to yet another cross site script flaw, as well as file sanitization challenges. More information direct from the developers makes an appearance after the jump. Update now. . From the Wordpress Developers blog and posted by Ryan Boren: The link for this article located at InfoSecurity is no longer available. . A new security patch for WordPress addresses vulnerabilities related to SQL injection and user authentication. Make sure to upgrade your site!. WordPress Update, Security Flaws, File Sanitization. . LinuxSecurity.com Team
Nov 13, 2009
•
Vendors/Products
78
cross site scriptingweb applicationsecurity enhancementMozilla Firefox Preview Builds: Boosting Security Through CSP Features
Mozilla on Wednesday posted preview builds of its Firefox browser with security enhancements designed to mitigate the risk of certain Web attacks. In a blog post, Brandon Sterne, security program manager for Mozilla, asks security researchers and server administrators to help test the changes by downloading a build appropriate for their operating system. . The preview versions of Firefox implement a specification called Content Security Policy (CSP), which is designed to protect against cross site scripting (XSS) attacks. CSP originally also addressed cross site request forgery (CSRF) attacks, but the anti-CSRF measures have been moved into a separate security specification called the Origin Header proposal. XSS and CSRF attacks have been used for data theft, Web site defacement, and malware distribution. They're typically made possible by Web application coding errors. In its specification, Mozilla acknowledges that the ideal solution would be creating Web applications without vulnerabilities. But real world security is a matter of layers so Mozilla feels justified in building a net to catch careless coding. The link for this article located at InfoWorld is no longer available. . Explore the latest Firefox experimental versions boasting improved defenses against online threats through Content Security Policy.. Firefox Security Enhancements, Content Security Policy, Web Application Protection. . LinuxSecurity.com Team
Oct 05, 2009
•
Vendors/Products
77
cross site scriptingweb applicationsecurity risksUnderstanding Cross Site Scripting And Its Risks In Web Applications
There are many web applications which are designed to permit the input of html tags for displaying the html formatted data. these tags can be used by malicious users to attack other users by inserting scripts or malicious applets etc.this called cross site scripting or XSS. such attacks are result of poor input validations. it uses the combination of html and scripting languages. with the proper combination of html and java script a intruder can misguide the client and perform various attack from DOS(by opening enormous amount of window on client side) or By embedding malicious FORM tags at the right place, an mailicious user may be able to trick users into revealing sensitive information by modifying the behavior of an existing form or by embedding scripts, an intruder can cause various problems. This is by no means a complete list of problems, but hopefully this is enough to convince you that this is a serious problem. . The link for this article located at Info Sec Writers is no longer available. . The link for this article located at Info Sec Writers is no longer available.. there, applications, which, designed, permit, input, displaying. . LinuxSecurity.com Team
Sep 30, 2006
•
Server Security
83
security advisorysecurity issuecross site scriptingGoogle Personalization RSS Feed XSS Advisory: Security Risk Identified
Google is vulnerable to cross site scripting. While surfing around the personalization section of Google I ran accross the RSS feed addition tool which is vulnerable to XSS. The employees at Google were aware of XSS as they protected against it as an error condition, however if you input a valid URL (like my RSS feed) it will return with a JavaScript function containing the URL. . The link for this article located at ha.ckers.org is no longer available. . The link for this article located at ha.ckers.org is no longer available. . google, vulnerable, cross, scripting, while, surfing, around, personalization, section. . LinuxSecurity.com Team
Jul 06, 2006
•
Hacks/Cracks
77
security advisorycross site scriptingweb applicationCross-Site Scripting Vulnerability CERT Advisory 2000-02
The vulnerability itself, CERT Advisory 2000-02, sometimes called cross-site scripting or malicious tagging, takes advantage of dynamically generated Web pages. Basically, a malicious script, which could be written in a number of different languages, can be inserted as input into dynamically . . . . The vulnerability itself, CERT Advisory 2000-02, sometimes called cross-site scripting or malicious tagging, takes advantage of dynamically generated Web pages. Basically, a malicious script, which could be written in a number of different languages, can be inserted as input into dynamically generated Web pages. Unless the pages are specifically built to protect against the insertions of these scripts, they allow an attacker to insert code that can poison cookies, expose SSL connections, access restricted sites, or pull off a number of other attacks. Most commonly exploited avenues are search boxes or online forums. All an attacker has to do is insert malicious code in between scripting tags that the Web page will accept, by using or tags, for instance. What makes this vulnerability especially prevalent is the number of different languages and technologies a Web designer needs to understand in order to protect against it. The exploit is possible using CGI, Perl, JavaScript, Java, .ASP, C++, and simple HTML. The link for this article located at EarthWeb is no longer available. . Cross-Site Scripting threats can lead to exposure of sensitive data and unauthorized access to secured resources.. Cross-Site Scripting, CERT Advisory, Web Attack. . LinuxSecurity.com Team
Dec 31, 2001
•
Server Security
83
security advisorysecurity issuecross site scriptingCitibank And Google Exposed To Cross Site Scripting Threats
Big internet names are vulnerable to a hacker technique despite more than 18 months' worth of warnings, claims a security expert. Security watcher Dave deVitry, of Infigon Technologies, released a shortlist of high-profile sites he claims are still vulnerable to Cross Site Scripting including Citibank, Google, CNet, Oracle, MSNBC and eBay, complete with samples. And yes, some of them do show signs of the vulnerability.. . .. Big internet names are vulnerable to a hacker technique despite more than 18 months' worth of warnings, claims a security expert. Security watcher Dave deVitry, of Infigon Technologies, released a shortlist of high-profile sites he claims are still vulnerable to Cross Site Scripting including Citibank, Google, CNet, Oracle, MSNBC and eBay, complete with samples. And yes, some of them do show signs of the vulnerability. More than 18 months since the Computer Emergency Response Team (CERT) issued an alert on Cross Site Scripting, a user to run their own scripts on vulnerable sites, as well as steal cookies, perform actions on behalf of another user or modify content on a site. The link for this article located at vnunet is no longer available. . Major platforms such as PayPal and Amazon continue to encounter vulnerabilities related to Cross Site Scripting, underscoring persistent challenges in cybersecurity.. Cross Site Scripting, Internet Security Risks, Cyber Attack Alerts. . LinuxSecurity.com Team
Nov 21, 2001
•
Hacks/Cracks
77
security advisoryapachecross site scriptingApache 1.3.12: Security Advisory For Cross Site Scripting Issues
The Apache Software Foundation and The Apache Server Project are pleased to announce the release of version 1.3.12 of the Apache HTTP server. The primary changes in this version of Apache are those related to the ``cross site scripting'' . . .. The Apache Software Foundation and The Apache Server Project are pleased to announce the release of version 1.3.12 of the Apache HTTP server. The primary changes in this version of Apache are those related to the ``cross site scripting' security alerts described at 2000 CERT Advisories https://httpd.apache.org/info/css-security/index.html [Found on Slashdot] The link for this article located at Apache.org is no longer available. . The Apache Software Foundation and The Apache Server Project are pleased to announce the release of . apache, software, foundation, server, project, pleased, announce, release. . LinuxSecurity.com Team
Feb 25, 2000
•
Server Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!