Schneider Electric EcoStruxure IT Data Center Expert XML External Entities Injection

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-611: Improper Restriction of XML External Entity Reference CVE ID: CVE-2025-6438 2. Vulnerability Description The...

Schneider Electric EcoStruxure IT Data Center Expert Privilege Escalation

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-266: Incorrect Privilege Assignment CVE ID: CVE-2025-50124 2. Vulnerability Description The Data Center Expert...

Schneider Electric EcoStruxure IT Data Center Expert Unauthenticated Server-Side Request Forgery

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-918: Server-Side Request Forgery SSRF CVE ID: CVE-2025-50125 2. Vulnerability Description The Data Center Expert...

Schneider Electric EcoStruxure IT Data Center Expert Unauthenticated Remote Code Execution

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-23: Relative Path Traversal, CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS...

Schneider Electric EcoStruxure IT Data Center Expert Remote Command Execution

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-1286: Improper Validation of Syntactic Correctness of Input, CWE-94: Improper Control of Generation of Code 'Code...

Schneider Electric EcoStruxure IT Data Center Expert Root Password Discovery

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-6311: Insufficient Entropy CVE ID: CVE-2025-50122 2. Vulnerability Description The Data Center Expert "DCE"...

PT-2025-28948 · Ruckus +1 · Smartzone +2

Name of the Vulnerable Software and Affected Versions: Ruckus SmartZone versions prior to 6.1.2p3 Refresh Build Description: The software allows authentication bypass via a valid API key and crafted HTTP headers. This issue affects enterprise wireless networks. Recommendations: Update to version...

⚡ Weekly Recap: Chrome 0-Day, Ivanti Exploits, MacOS Stealers, Crypto Heists and More

Everything feels secure—until one small thing slips through. Even strong systems can break if a simple check is missed or a trusted tool is misused. Most threats don't start with alarms—they sneak in through the little things we overlook. A tiny bug, a reused password, a quiet connection—that's a...

CVE-2025-24508

Extraction of Account Connectivity Credentials ACCs from the IT Management Agent secure storage...

CVE-2025-24508 Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite

Extraction of Account Connectivity Credentials ACCs from the IT Management Agent secure storage...

CVE-2025-24508 Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite

Extraction of Account Connectivity Credentials ACCs from the IT Management Agent secure storage...

CVE-2025-24508

CVE-2025-24508 affects Broadcom Symantec IT Management Suite via the IT Management Agent secure storage, enabling extraction of Account Connectivity Credentials (ACCs). Root cause described as improper protection/failure to securely restrict access to ACCs in storage, enabling local theft when at...

PT-2025-28127 · Broadcom · Symantec It Management Suite

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns the extraction of Account Connectivity Credentials ACCs from the IT Management Agent secure storage. Recommendations: At the moment, there is no information about a newer...

CVE-2025-5333 Unauthenticated Remote Code Execution in IT Management Suite

Remote attackers can execute arbitrary code in the context of the vulnerable service process...

CVE-2025-5333

CVE-2025-5333 affects Broadcom Symantec Altiris IT/endpoint management (IRM) via the legacy .NET Remoting endpoint at tcp://:4011/IRM/HostedService. Unauthenticated RCE is possible because BinaryServerFormatterSinkProvider with TypeFilterLevel=Full deserializes input from the TCP channel. Affecte...

CVE-2025-5333 Unauthenticated Remote Code Execution in IT Management Suite

Remote attackers can execute arbitrary code in the context of the vulnerable service process...

Broadcom Symantec IT Management Suite 安全漏洞

Broadcom Symantec IT Management Suite is a software for managing the configuration of remediation applications and operating systems from Broadcom Corporation USA. A security vulnerability exists in Broadcom Symantec IT Management Suite that originates from a remote attacker being able to execute...

de.digitalcollections.cudami:dc-cudami-admin-webapp (>=7.0.0-rc1, <=8.0.3), io.github.dbmdz.cudami:cudami (>=9.0.0, <=11.0.0-rc.1) +17 more potentially affected by CVE-2026-2327 via org.webjars.npm:markdown-it (>=4.4.0, <=14.3.0)

org.webjars.npm:markdown-it MAVEN version =4.4.0, =7.0.0-rc1, =9.0.0, =1.8.8, =0.4.2, =3.8.0, =0.4.0, =1.5.1, =1.13.2 and more Source cves: CVE-2026-2327 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15282866...

11ty-nunjucks-md (1.0.0), 20ful (>=0.3.2, <=0.3.5) +2730 more potentially affected by CVE-2026-2327 via markdown-it (>=13.0.0, <=14.1.0)

markdown-it NPM version =13.0.0, =0.3.2, =0.0.2, =2.0.0-beta.1, =0.3.1, =0.42.46, =2.0.4, =0.0.1, =0.33.4, =0.3.0, =10.22.0, =3.7.0-beta.1, =3.9.3 and more Source cves: CVE-2026-2327 Source advisory: SNYK:JS-MARKDOWNIT-10666750...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the use of the regex /+$/ in the linkify function. An attacker can supply a long sequence of characters followed by a...