CVE-2025-27147 GLPI Inventory plugin has Improper Access Control Vulnerability

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...

CVE-2025-27147 GLPI Inventory plugin has Improper Access Control Vulnerability

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory SNMP, software deployment, VMWare ESX host remote inventory, and data collection files, Windows registry, WMI. Versions prior to 1.5.0 have an improper access control vulnerability...

CVE-2025-27147

The CVE-2025-27147 issue affects the GLPI Inventory Plugin used with GLPI, where versions prior to 1.5.0 contain an improper access control vulnerability. Reported details across connected sources consistently point to an access-control weakness in GLPI Inventory Plugin tasks (network discovery, ...

CVE-2025-2754

A flaw was found in the Open Asset Import Library Assimp. The Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component is affected. This attack can be launched remotely, and manipulation of the argument can lead to a heap-bas...

CVE-2025-2720

A vulnerability was found in GNOME libgsf, affecting the gsfbase64encodesimple function. The attack needs to be approached locally, and manipulation of the size argument can lead to use of an uninitialized variable. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2025-29778

Kyverno (policy engine for cloud-native platforms) contains a vulnerability prior to version 1.14.0-alpha.1 where artifact verification in keyless mode ignores subjectRegExp and IssuerRegExp, allowing deployment of Kubernetes resources signed with an unexpected certificate and potentially full cl...

CVE-2025-29778 Kyverno ignores subjectRegExp and IssuerRegExp

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were...

VSCode Marketplace Removes Two Extensions Deploying Early-Stage Ransomware

Cybersecurity researchers have uncovered two malicious extensions in the Visual Studio Code VSCode Marketplace that are designed to deploy ransomware that's under development to its users. The extensions, named "ahban.shiba" and "ahban.cychelloworld," have since been taken down by the marketplace...

JFrog Artifactory Anonymous Deployment Detected

JFrog Artifactory can be misconfigured and allows an unauthenticated attacker to deploy files to certain repositories. By simply querying the repodata endpoint, the attacker can identify whuch repositories permit anonymous deployment. No source data...

CVE-2025-0313

A flaw was found in Ollama. This vulnerability allows a malicious user to cause a denial of service DoS attack via improper validation of array index bounds in the GGUF model handling code, which can be exploited remotely over a network. Mitigation Mitigation for this issue is either not availabl...

CVE-2025-2574

A flaw was found in Xpdf. This vulnerability may allow out-of-bounds array write caused by incorrect integer overflow checking in the PostScript function interpreter code. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...

CVE-2025-2581

A flaw was found in XMedCon. This vulnerability allows an attacker to trigger an integer underflow via manipulating the malloc function, potentially leading to memory corruption or denial of service. The attack can be launched remotely. Mitigation Mitigation for this issue is either not available...

PT-2025-16942 · Google · Google Cloud Platform

Name of the Vulnerable Software and Affected Versions: Google Cloud Platform affected versions not specified Description: The issue allows an attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform GCP using the OS Login feature to login via SSH, gaining...

编号撤回

Ollama is a large language model that can be started and run locally by Ollama Open Source. This CVE number has been withdrawn...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due interaction between unexpected parameter values set for ClusterDeployment.hive.openshift.io/v1 and ClusterSync.hiveinternal.openshift.io/v1alpha1 objects in the Reconcile method i...

Hackers Exploit Severe PHP Flaw to Deploy Quasar RAT and XMRig Miners

Threat actors are exploiting a severe security flaw in PHP to deliver cryptocurrency miners and remote access trojans RATs like Quasar RAT. The vulnerability, assigned the CVE identifier CVE-2024-4577, refers to an argument injection vulnerability in PHP affecting Windows-based systems running in...

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...

New Critical AMI BMC Vulnerability Enables Remote Server Takeover and Bricking

A critical security vulnerability has been disclosed in AMI's MegaRAC Baseboard Management Controller BMC software that could allow an attacker to bypass authentication and carry out post-exploitation actions. The vulnerability, tracked as CVE-2024-54085 , carries a CVSS v4 score of 10.0,...

yimioa 安全漏洞

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in yimioa versions prior to v2024.07.04, which stems from an information leak in the application.yml component...

CosmWasm 安全漏洞

CosmWasm is a CosmWasm open source framework for building smart contracts in Wasm for the Cosmos SDK. A security vulnerability exists in CosmWasm versions prior to v2.2.0, which stems from a lack of runtime capability validation, and allows an attacker to deploy contracts and perform unauthorized...