3659 matches found
CVE-2025-9408: Privilege Context Switching Error
System call entry on Cortex M and possibly R and A, but I think not has a race which allows very practical privilege escalation for malicious userspace processes...
PT-2025-46349
Name of the Vulnerable Software and Affected Versions versions prior to 2025-9408 Description A race condition exists during system call entry on Cortex M processors, potentially allowing privilege escalation for malicious user space processes. It is possible this issue may also affect Cortex R a...
CVE-2025-63384: Incorrect Privilege Assignment
A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET Supervisor-mode Exception Return instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode M-mode to Supervisor-mode S-mode as specified by...
CVE-2025-55108
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...
CVE-2025-55108 BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...
CVE-2025-55108
The CVE-2025-55108 entry concerns BMC Control-M/Agent and describes unauthenticated remote code execution, plus arbitrary file read/write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (default configuration). Affected component: Control-M/Agent; root cause cen...
CVE-2025-55108 BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...
PT-2025-45096
Name of the Vulnerable Software and Affected Versions BMC Control-M/Agent affected versions not specified Description The Control-M/Agent is susceptible to unauthenticated remote code execution, arbitrary file read and write, and other unauthorized actions when mutual SSL/TLS authentication is no...
BMC Control-M/Agent 安全漏洞
BMC Control-M/Agent is a workload automation system from BMC USA. A security vulnerability exists in BMC Control-M/Agent that stems from not enabling mutual SSL/TLS authentication, which could lead to unauthenticated remote code execution, arbitrary file reads and writes, and similar unauthorized...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988968)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988968 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG The display pixel clock has a...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989572)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989572 advisory. In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh masterdev/mops in rtnlnewlink While looking at one unrelated syzb...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989349)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989349 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG The display pixel clock has a...
CVE-2025-55108: Missing Authentication for Critical Function
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled i.e. in the default configuration. NOTE: The vendor believes that this vulnerability only occurs when...
H3C Magic M安全漏洞
H3C Magic M is a series of wireless routers from China's Xinhua San H3C. A security vulnerability exists in H3C Magic M. The vulnerability stems from the use of hard-coded weak passwords or unset passwords in the firmware, which could allow an attacker to gain maximum root privileges via Telnet...
Security Bulletin: Security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
Summary Security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced. An update to IBM CICS TX Advanced has been released to address these. Vulnerability Details CVEID:CVE-2025-36124 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through...
AndSoft e-TMS OS Command Injection Vulnerability (CNVD-2025-23563)
AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability that originates from a misuse of parameter m in file /clt/LOGINFRMoriginal.ASP, which can be exploited by an attacker to execute operating system...
AndSoft e-TMS OS Command Injection Vulnerability (CNVD-2025-23540)
AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability that originates from a misuse of parameter m in file /clt/LOGINFRMDJO.ASP, which can be exploited by an attacker to execute operating system commands...
AndSoft e-TMS OS Command Injection Vulnerability (CNVD-2025-23542)
AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability that originates from a misuse of the parameter m in the file /clt/LOGINFRMBET.ASP, which can be exploited by an attacker to execute operating system...
AndSoft e-TMS Cross-Site Scripting Vulnerability (CNVD-2025-23536)
AndSoft e-TMS is a logistics management software from AndSoft Spain. A cross-site scripting vulnerability exists in AndSoft e-TMS, which originates from the lack of effective filtering and escaping of user-supplied data by parameter m in file /lib/asp/alert.asp, and can be exploited by an attacke...
