Mozilla Firefox < 145.0

The version of Firefox installed on the remote Windows host is prior to 145.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-87 advisory. - Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption...

CVE-2025-64507

CVE-2025-64507 affects Incus/LXD: in versions prior to 6.0.6 and 6.19.0 an unprivileged user who can access a container and a host with a custom storage volume that has security.shifted=true may create a setuid binary inside the container and execute it on the host to gain root. The issue require...

CVE-2025-48065 Combodo iTop vulnerable to reflected XSS via objection edition form error

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content...

CVE-2025-48065

CVE-2025-48065 affects Combodo iTop (web-based ITSM). Affected versions: before 2.7.13 and before 3.2.2 are vulnerable to cross-site scripting when an error field contains malicious content; versions 2.7.13 and 3.2.2 are protected from this. Root cause concerns reflected XSS via error-field rende...

CVE-2025-12728

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12727

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-12440

An inappropriate implementation in the Autofill component of Google Chrome (prior to version 142.0.7444.59 ) and Microsoft Edge allows a remote attacker to obtain potentially sensitive information from process memory. The vulnerability is triggered when a user is convinced to perform specific UI ...

CVE-2025-12437

Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12436

A policy bypass in the Extensions component of Google Chrome , Microsoft Edge , and other Chromium-based browsers (such as Opera and Vivaldi ) allows an attacker to obtain potentially sensitive information from process memory. This vulnerability occurs when a user is convinced to install a malici...

EUVD-2025-48940

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on i...

CVE-2025-46430

Dell Display and Peripheral Manager (affected: versions prior to 2.1.2.12) contains an Execution with Unnecessary Privileges vulnerability in the Installer. A low-privilege, local attacker could potentially exploit this to achieve Elevation of Privileges. Remediation exists in version 2.1.2.12 or...

EUVD-2025-44045

In JetBrains dotTrace before 2025.2.5 local privilege escalation possible via race condition...

CVE-2025-64442

HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4...

kernel: information leak via transient execution vulnerability in some AMD processors

A flaw was found in AMD processors. This transient execution vulnerability may allow an unprivileged local attacker to cause information disclosure of privileged data. By exploiting how the processor speculatively processes instructions ahead of time, an attacker can infer sensitive data from...

编号撤回

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.3.104432, which...

pdfminer.six 代码问题漏洞

pdfminer.six is pdfminer open source a tool for extracting information from PDF documents . A code issue vulnerability exists in versions prior to pdfminer.six 20251107, which stems from the CMapDB.loaddata function using pickle.loads to deserialize a malicious pickle file, which could lead to th...

PT-2025-46196

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2 Description Combodo iTop is a web-based IT service management tool. A user with sufficient privileges to create webhooks typically administrators can drop the database...

Combodo iTop 跨站脚本漏洞

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for the daily operation of IT environments. The program provides incident management, configuration management, and problem management. A cross-site scripting vulnerability exists in Combodo...

PT-2025-46193

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.2 Description Combodo iTop is a web-based IT service management tool. A cross-site scripting issue can occur when displaying content in a browse brick within the user portal. This allows for the execution of...

编号撤回

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.3.104432, which...