15742 matches found
Qualys ETM Identity — The First True Quantification of the Identity Perimeter
Security has always been about controlling who can do what and where. In 2025, that control is mediated entirely by identity. When an attacker “logs in,” not "breaks in", they inherit legitimate permissions, blend into normal telemetry, and pivot across AD, Entra/Okta, SaaS, and cloud, driving...
EUVD-2025-34585
In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the PFPACKET...
CVE-2025-39985
In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the PFPACKE...
UBUNTU-CVE-2025-39988
In the Linux kernel, the following vulnerability has been resolved: can: etases58x: populate ndochangemtu to prevent buffer overflow Sending an PFPACKET allows to bypass the CAN framework logic and to directly reach the xmit function of a CAN driver. The only check which is performed by the...
Security Bulletin: IBM Operations Analytics - Log Analysis is affected by denial of service, cross-site scripting, and security bypass vulnerabilities
Summary Apache Commons FileUpload, Servlet feature, adminCenter feature, and JMS messaging are used by IBM Operations Analytics - Log Analysis as part of handling file uploads, web applications CVE-2025-48976, CVE-2025-36047, administrative centre CVE-2025-36000, asynchronous communication using...
CVE-2025-39988
The CVE-2025-39988 issue affects the etas_es58x CAN driver in the Linux kernel. Root cause: net_device_ops->ndo_change_mtu() is not populated, allowing a PF_PACKET-sourced MTU to be set arbitrarily large (e.g., can0 mtu 9999). This can enable a malicious CAN XL frame to bypass CAN framework ch...
USN-7823-1 ffmpeg vulnerabilities
It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS. CVE-2024-35365 It was discovered that FFmpeg did not correctly handle...
CVE-2025-60535
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
CVE-2025-60535
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
CVE-2025-37146 Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...
CVE-2025-37146
The CVE-2025-37146 entry describes a vulnerability in the web-based management interface of network access point configuration services (e.g., HPE ArubaOS) that can allow an authenticated remote attacker to perform remote command execution on the underlying OS. The public sources indicate exploit...
CVE-2025-37146 Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...
Microsoft raises the bar: A smarter way to measure AI for cybersecurity
ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...
How Top SOCs Stay Up-to-Date on Current Threat Landscape
Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings...
CVE-2025-40765
A vulnerability has been identified in TeleControl Server Basic V3.1 All versions = V3.1.2.2 V3.1.2.3. The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform...
EUVD-2025-34161
A vulnerability has been identified in TeleControl Server Basic V3.1 All versions = V3.1.2.2 V3.1.2.3. The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform...
CVE-2025-60535
Wallos v4.1.1 contains a CSRF in the component /endpoints/currency/currency that could allow an attacker to perform arbitrary operations via a crafted GET request. The CVE-2025-60535 entry consistently describes this CSRF as the underlying issue; Red Hat and ENISA/EUVD mirrors also reference the ...
CVE-2025-60535
A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...
Important: open-vm-tools
Issue Overview: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability ...