Amazon Linux 2 : qt5-qt3d, --advisory ALAS2-2025-3074 (ALAS-2025-3074)

The version of qt5-qt3d installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3074 advisory. A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile o...

PT-2025-46340

Name of the Vulnerable Software and Affected Versions Verve Asset Manager affected versions not specified Description A security issue exists in Verve Asset Manager that allows unauthorized read-only users to perform actions beyond their intended permissions. Specifically, these users can read,...

Rockwell Automation Verve Asset Manager 安全漏洞

Rockwell Automation Verve Asset Manager is a vendor-neutral OT endpoint management platform from Rockwell Automation USA. A security vulnerability exists in Rockwell Automation Verve Asset Manager that can be exploited by an attacker to read, update, and delete users via the API...

CVE-2025-64486

Calibre (multiformat e‑book manager) is vulnerable in versions up to 8.13.0 due to improper validation of filenames when handling binary resources in FB2 files. This allows an attacker to write arbitrary files to the filesystem when viewing or converting a malicious FictionBook file, potentially ...

GE Vernova Smallworld 安全漏洞

GE Vernova Smallworld is an asset and network management software from GE Vernova, USA. A security vulnerability exists in GE Vernova Smallworld version 5.3.5 and prior versions, which stems from improper pathname restrictions that could lead to file manipulation...

Your Guide to Risk-Based Vulnerability Management

Communicating security needs to leadership can be a challenge when you’re just presenting a long list of technical flaws. The conversation shifts when you can talk about risk in clear business terms. Instead of saying "we have 500 critical vulnerabilities," you can say "we have 15 vulnerabilities...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-310-01 Advantech DeviceOn iEdge ICSA-25-310-02 Ubia Ubox ICSA-25-310-03 ABB FLXeon Controllers...

What Is Attack Surface Mapping And Why It’s Critical To your Security Program

You might think an attack surface mapper is just another name for a vulnerability scanner, but they serve two very different purposes. A scanner tests the assets you already know about for specific weaknesses. An attack surface mapper answers a more fundamental question: What assets do I even hav...

CGA-GF3R-G478-F9C8

Bulletin has no description...

What Are Attack Surface Intelligence Exposures?

Do you know every single digital asset your organization owns? For most security leaders, the honest answer is no. Between shadow IT, forgotten development servers, and complex cloud environments, your true attack surface is full of blind spots. These unknown and unmanaged assets are where...

Missing Authorization

com.liferay, com.liferay.asset.display.page.service is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks when users attempt to view display page templates, which allows an attacker to access these templates through crafted URLs...

The vulnerability of the SKYSEA Client View software for managing IT assets stems from deficiencies in the authentication process, allowing attackers to execute arbitrary code.

The vulnerability of the SKYSEA Client View software for managing IT assets is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

MAL-2025-49118 Malicious code in epic-asset-uploader-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 168bca602c07dee020253d5302f18b0f0f5fb783801ac20450da5073f282042b The package epic-asset-uploader-ui was found to contain malicious code...

Malicious code in epic-asset-uploader-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 168bca602c07dee020253d5302f18b0f0f5fb783801ac20450da5073f282042b The package epic-asset-uploader-ui was found to contain malicious code...

EUVD-2025-37175

Malicious code in epic-asset-uploader-ui npm...

Malicious code in named-asset-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41aa2c9de0b9bf1fc5a9cbee9d0442255a36d349e4645660908d01b2ac8db820 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36866

Malicious code in named-asset-import npm...

MAL-2025-49024 Malicious code in named-asset-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41aa2c9de0b9bf1fc5a9cbee9d0442255a36d349e4645660908d01b2ac8db820 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-41090

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...

CVE-2025-41090 Improper Access Control in CCN-CERT microCLAUDIA

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...