Ubuntu: Security Advisory (USN-7459-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-0618

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. This exception will prevent any further tamper protection events from being processed, even afte...

CVE-2025-0618

CVE-2025-0618 affects Trellix Endpoint Security (HX) Server versions 10.0.2 and earlier. A specially crafted tamper protection event can trigger an unhandled exception in the HX service, causing a persistent denial of service that prevents processing of any further tamper protection events, even ...

The vulnerability of the Kubernetes cluster deployment and management software on Azure Local Cluster infrastructure lies in the insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Kubernetes cluster deployment and management software on Azure Local Cluster infrastructure is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-29929 Tuleap is missing CSRF protection on tracker hierarchy administration

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This...

CVE-2022-49760 mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix PTE marker handling in hugetlbchangeprotection Patch series "mm/hugetlb: uffd-wp fixes for hugetlbchangeprotection". Playing with virtio-mem and background snapshots using uffd-wp on hugetlb in QEMU, I managed to...

Advisory ROSA-SA-2025-2762

Software: python-jinja2 2.7.2 OS: rosa-server79 packageevrstring: python-jinja2-2.7.2-4.0.1.res7 CVE-ID: CVE-2024-56326 BDU-ID: 2025-00113 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the str.format method of the jinja html templating tool is related to the failure to neutralize special element...

CVE-2024-56140

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

The vulnerability of Spam protection, AntiSpam, and FireWall modules in the CleanTalk plugin for WordPress website content management systems arises from improper handling of exceptional states, allowing attackers to execute arbitrary code.

The vulnerability of Spam protection, AntiSpam, and FireWall modules in the CleanTalk plugin for WordPress website content management systems is related to improper handling of exceptional states. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2020-11919

CVE-2020-11919 affects Siime Eye 14.1.00000001.3.330.0.0.3.14 and is due to missing CSRF protection. The CVSSv3.1 vector indicates ADJACENT access, no privileges, user interaction required, and high impact on confidentiality, integrity, and availability (base score 8.0). Connected sources corrobo...

FESTO Didactic CP, MPS 200, and MPS 400 Firmware

GENERAL RECOMMENDATIONS As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. - Use...

Dell PowerProtect Data Domain Server-Side Request Forgery Vulnerability

Dell PowerProtect Data Domain is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell USA. A server-side request forgery vulnerability exists in Dell PowerProtect Data Domain, which could be exploited by an attacker to cause information disclosure in an...

Proofpoint Enterprise Protection 代码问题漏洞

Proofpoint Enterprise Protection is an application from Proofpoint, Inc. It provides functionality to protect e-mail. A code issue vulnerability exists in Proofpoint Enterprise Protection that stems from the presence of a server-side request forgery vulnerability...

The vulnerability of the HP Print and Scan Doctor for Windows diagnostic tool lies in the insufficient protection of operational data, which allows attackers to exploit their privileges.

The vulnerability of the HP Print and Scan Doctor for Windows diagnostic tool is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Microsoft Visual Studio software development tool, related to insufficient protection of sensitive data, allows attackers to disclose protected information.

The vulnerability of the Microsoft Visual Studio software relates to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent and Acronis CyberProtect 15 software lies in the lack of protection for operational data, allowing attackers to access confidential information.

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent and Acronis CyberProtect 15 data protection software lies in the lack of protection for operational data. Exploiting this vulnerability can allow unauthorized actors to gain access to confidential...

The vulnerability of the protection mechanism of the network traffic analysis, network detection, and response software Cortex XDR Agent for Windows operating systems allows attackers to disable the Cortex XDR Agent.

The vulnerability of the protection mechanism for network traffic analysis, network detection, and response in the Cortex XDR Agent for Windows operating systems is related to improper handling of exceptional states. Exploiting this vulnerability can allow attackers to disable the Cortex XDR Agen...

CVE-2023-37192

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing...

CVE-2022-4326 Trellix xAgent permission bypass vulnerability

Improper preservation of permissions vulnerability in Trellix Endpoint Agent xAgent prior to V35.31.22 on Windows allows a local user with administrator privileges to bypass the product protection to uninstall the agent via incorrectly applied permissions in the removal protection functionality...

ASB-A-233972091

'remappfnrange' here may map out of size kernel memory for example, may map the kernel area, and because the 'vma-vmpageprot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploited...