Ash has authorization bypass when bypass policy condition evaluates to true

Summary Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other policies apply. Impact Resources with bypass policies can be accessed without proper authorization when: - Bypass condition evaluates to true - Bypass...

CVE-2025-62398

A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts...

CVE-2025-48008

When a TCP profile with Multipath TCP MPTCP enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS ar...

Beyond a Single Perspective: Towards a Realistic Evaluation of Website Fingerprinting Attacks

Website Fingerprinting WF attacks exploit patterns in encrypted traffic to infer the websites visited by users, posing a serious threat to anonymous communication systems. Although recent WF techniques achieve over 90% accuracy in controlled experimental settings, most studies remain confined to...

TencentOS Server 3: pam (TSSA-2025:0777)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0777 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CLSA-2025-1760546935 kernel: Fix of 43 CVEs

locking/wwmutex/test: Fix potential workqueue corruption CVE-2023-52836 - netfilter: ipset: Fix suspicious rcudereferenceprotected CVE-2024-40993 - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type CVE-2024-39503 - netfilter: ipset: Missing gc cancellations fixed...

EUVD-2025-34650

When a TCP profile with Multipath TCP MPTCP enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS ar...

EUVD-2025-34651

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge HSB may experience a lockup of the HSB. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58153 BIG-IP HSB vulnerability

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge HSB may experience a lockup of the HSB. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-58153 BIG-IP HSB vulnerability

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge HSB may experience a lockup of the HSB. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP that stems from certain traffic conditions that could result in a high-speed bridge lockup...

CVE-2025-42939

SAP S/4HANA: The Manage Processing Rules – For Bank Statements component is affected by CVE-2025-42939. An authenticated attacker with basic privileges can tamper request parameters to delete conditions from any shared rule, due to a missing authorization check, compromising integrity without imp...

CVE-2025-42939 Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements)

SAP S/4HANA Manage Processing Rules - For Bank Statements allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should...

PT-2025-41844

Name of the Vulnerable Software and Affected Versions SAP S/4HANA affected versions not specified Description An authenticated attacker with basic privileges can delete conditions from any shared rule of any user by manipulating the request parameter. This is due to a missing authorization check,...

Microsoft Data Sharing Service 竞争条件问题漏洞

Microsoft Data Sharing Service is a built-in data sharing service component of the Windows operating system from Microsoft Corporation USA. A competitive condition vulnerability exists in Microsoft Data Sharing Service, which can be exploited by an attacker to perform spoofing attacks...

PT-2025-41941

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.4.0 through 7.4.3 and prior to 7.2.7 FortiProxy versions 7.4.0 through 7.4.3 and prior to 7.2.9 FortiPAM versions prior to 1.2.0 FortiSwitchManager versions 7.2.0 through 7.2.3 and 7.0.0 through 7.0.3 Description An improper...

Microsoft Hyper-V 竞争条件问题漏洞

Microsoft Hyper-V is an application from Microsoft Corporation USA. A system hypervisor virtualization technology that enables desktop virtualization. Microsoft Hyper-V suffers from a Competing Conditions Issue vulnerability that originates from an attacker's ability to elevate privileges by...

EulerOS 2.0 SP11 : pam (EulerOS-SA-2025-2239)

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in linux-pam. The pamnamespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks an...

EulerOS 2.0 SP11 : pam (EulerOS-SA-2025-2207)

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in linux-pam. The pamnamespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks an...

GHSA-56R7-H6MW-RCFV Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex...