CVE-2025-20276

CVE-2025-20276 affects Cisco Unified CCX web-based management interface. The root cause is insecure deserialization of Java objects, enabling an authenticated attacker with valid administrative credentials to remotely execute arbitrary code on the device’s OS, with potential to escalate to root. ...

CVE-2025-20276 Cisco Unified Contact Center Express Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insecure...

CVE-2025-20275 Cisco Unified Contact Center Express Editor Remote Code Execution Vulnerability

A vulnerability in the file opening process of Cisco Unified Contact Center Express Unified CCX Editor could allow an unauthenticated attacker to execute arbitrary code on an affected device. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attack...

CVE-2025-20275 Cisco Unified Contact Center Express Editor Remote Code Execution Vulnerability

A vulnerability in the file opening process of Cisco Unified Contact Center Express Unified CCX Editor could allow an unauthenticated attacker to execute arbitrary code on an affected device. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attack...

Malicious code in express-api-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efac302be698778eb5fe49cde2fadcf3d675910622eaf3387754f96e332f87f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in express-api-sync

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4683 Malicious code in express-api-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efac302be698778eb5fe49cde2fadcf3d675910622eaf3387754f96e332f87f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-23823 · Cisco · Cisco Unified Ccx Editor

Name of the Vulnerable Software and Affected Versions: Cisco Unified Contact Center Express Unified CCX Editor affected versions not specified Description: The issue is related to insecure deserialization of Java objects by the affected software. An attacker could exploit this by persuading an...

Cisco Unified Contact Center Express Editor 代码问题漏洞

Cisco Unified Contact Center Express Editor is an all-in-one call center solution for small and medium-sized businesses from Cisco. A code issue vulnerability exists in Cisco Unified Contact Center Express Editor that stems from insecure deserialization of Java objects, which could lead to the...

The vulnerability in the `drivers/nvme/host/rdma.c` driver of the Linux operating system’s NVMe kernel allows a hacker to cause a service failure.

The vulnerability in the drivers/nvme/host/rdma.c file of the Linux operating system’s NVMe kernel driver is related to insufficient handling of exception states. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2025-20275: Deserialization of Untrusted Data

A vulnerability in the file opening process of Cisco Unified Contact Center Express Unified CCX Editor could allow an unauthenticated attacker to execute arbitrary code on an affected device. This vulnerability is due to insecure deserialization of Java objects by the affected software. An...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2025-48997 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2025-48997 Source advisory:...

Multer 安全漏洞

Multer is an expressjs open source middleware for Node.js. A security vulnerability exists in Multer versions 1.4.4-lts.1 through prior to 2.0.1, which stems from an upload file request with an empty string field name that could result in a denial of service...

kernel: veth: Fix use after free in XDP_REDIRECT

A use-after-free vulnerability has been identified within the vethconvertskbtoxdpbuff function of the Linux kernel's veth driver. The flaw stems from improper memory management during packet headroom expansion for XDP eXpress Data Path. Specifically, when the pskbexpandhead function allocates new...

Malicious code in express-authgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b288b33e1c8cf62fa86cc3a42c139bde6cc4674aec2cc0327ca503b64daf2a4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in express-authgen

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4595 Malicious code in express-authgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b288b33e1c8cf62fa86cc3a42c139bde6cc4674aec2cc0327ca503b64daf2a4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.

...

USN-7524-1: Linux kernel (Raspberry Pi) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Supe...

kernel: veth: Fix use after free in XDP_REDIRECT

A use-after-free vulnerability has been identified within the vethconvertskbtoxdpbuff function of the Linux kernel's veth driver. The flaw stems from improper memory management during packet headroom expansion for XDP eXpress Data Path. Specifically, when the pskbexpandhead function allocates new...