CVE-2025-4922 Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job

Nomad Community and Nomad Enterprise “Nomad” prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14...

CVE-2025-4922 Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job

Nomad Community and Nomad Enterprise “Nomad” prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14...

PT-2025-25213

Name of the Vulnerable Software and Affected Versions Hashicorp Nomad versions prior to 1.10.2 Hashicorp Nomad versions prior to 1.9.10 Hashicorp Nomad versions prior to 1.8.14 Description The issue is related to prefix-based ACL policy lookup in Nomad Community and Nomad Enterprise, which can le...

(Pwn2Own) Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected Sony XAV-AX8500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of ACL-U links. The issue results from the lack of L2CAP channel...

CVE-2025-2826

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to...

CVE-2025-2826

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to...

CVE-2025-2826 n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to...

CVE-2025-2826

CVE-2025-2826 affects Arista EOS platforms where IPv4/ MAC / IPv6 ingress ACLs may not be enforced on one or more interfaces, leading to ingress packets being incorrectly allowed or denied. The Arista advisory notes the issue exists in EOS train 4.33.x, with fixed releases including 4.33.2.1F, 4....

PT-2025-23043 · Arista · Arista Eos

Name of the Vulnerable Software and Affected Versions: Arista EOS affected versions not specified Description: On affected platforms running Arista EOS, ACL policies may not be enforced. This issue affects IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more...

Security Advisory 0120

Security Advisory 0120 . CSAF PDF Date: May 27, 2025 Revision | Date | Changes ---|---|--- 1.0 | May 27, 2025 | Initial release The CVE-ID tracking this issue: CVE-2025-2826 CVSSv3.1 Base Score: 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Common Weakness Enumeration: CWE-284: Improper Access...

The vulnerability of the web_acl_ipv4BasedAceAdd() function in PLANET Technology’s microprogrammed switching software allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the webaclipv4BasedAceAdd function in PLANET Technology’s microprogrammed switching software is related to buffer overflows in the stack when processing the ipv4Aclkey parameter. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integri...

CVE-2024-46451

TOTOLINK AC1200 T8 v4.1.5cu.861B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter...

CVE-2024-24333

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function...

CVE-2024-20315

A vulnerability in the access control list ACL processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to improper assignment of lookup keys to internal interface contexts...

CVE-2024-13107

A vulnerability was found in D-Link DIR-816 A2 1.10CNB05R1B011D88210. It has been classified as critical. This affects an unknown part of the file /goform/form2LocalAclEditcfg.cgi of the component ACL Handler. The manipulation leads to improper access controls. It is possible to initiate the atta...

CVE-2023-26490

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to...

CVE-2023-32064

OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.11 and...

CVE-2023-48751

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5...

CVE-2023-41918

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-32062

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1...