CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24983link is external Microsoft Windows Win32k Use-After-Free Vulnerability CVE-2025-24984link is external Microsoft Windows NTFS Information Disclosure...

CVE-2025-0062

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

CVE-2025-0062 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

PT-2025-10772

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 4.4.0 through 4.4.6 Description: An incorrect authorization issue may allow a low-privileged administrator to execute elevated CLI commands via the GUI console menu. This could potentially lead to privilege escalation...

RustDesk Console Default Credentials

RustDesk is a mote access and control software that enables management of computers and other devices. RustDesk server Pro embeds a web console allowing users to browse devices and perform configuration modification on the application. A remote and unauthenticated attacker can use the default...

RustDesk Console Detected

RustDesk is a mote access and control software that enables management of computers and other devices. RustDesk server Pro embeds a web console allowing users to browse devices and perform configuration modification on the application. By leveraging this, a remote and unauthenticated attacker cou...

PT-2025-10848

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patch released in March 2025. Description A security feature bypass vulnerability exists in Microsoft Management Console MMC. This vulnerability, also known as MSC EvilTwin CVE-2025-26633, allows an...

CVE-2025-26633

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. Recent assessments: cbeek-r7 at March 26, 2025 11:31am UTC reported: CVE-2025-26633, nicknamed “MSC EvilTwin”, is a security feature bypass vulnerability in Microsoft...

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Microsoft Windows Management Console MMC contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally...

Incorrect authorization in GUI console

...

Microsoft Management Console 安全漏洞

Microsoft Management Console is a general-purpose management console framework from Microsoft Corporation USA that hosts and manages a variety of system management tools called console plug-ins or management units. A security vulnerability exists in Microsoft Management Console. An attacker...

CVE-2024-45328: Incorrect Authorization

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

CVE-2025-26633: Improper Neutralization

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-0062: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

VulnCheck KEV: CVE-2025-26633

Microsoft Windows Management Console MMC contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally...

Linux Distros Unpatched Vulnerability : CVE-2023-3161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Framebuffer Console fbcon in the Linux Kernel. When providing font-width and font-height greater than 32 to fbconsetfont, since there ar...

Red Hat OpenShift Container Platform SSRF

The vulnerability of the /api/dev-console/proxy/internet file on the Red Hat OpenShift Container Platform corporate platform is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2022-49441

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tty: fix deadlock caused by calling printk under ttyport-lock ptywrite invokes kmalloc which may invoke a normal printk to print failure message. This can caus...

Linux Distros Unpatched Vulnerability : CVE-2024-26999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - kernel: serial/pmaczilog: Remove flawed mitigation for rx irq flood Ubuntu Linux - serial/pmaczilog: Remove flawed mitigation for rx...

CVE-2025-27501 Server Side Request Forgery in Ziti Console

OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side...