CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

CVE-2024-58288 Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file...

CVE-2024-58288 Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file...

CVE-2024-58288

Genexus Protection Server 9.7.2.10 has an unquoted service path in the protsrvservice Windows service configuration. Exploitation allows arbitrary code execution with LocalSystem privileges by placing malicious executables in specific file system locations. Remediation: quote the service path in ...

CVE-2025-67460

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access...

Malwarebytes for Mac now has smarter, deeper scans

Say hello to the upgraded Malwarebytes for Mac —now with more robust protection, more control, and the same trusted defense you count on every day. We’ve given our Mac scan engine a serious intelligence boost, so it thinks faster and digs deeper. The new enhanced scan searches across more of your...

CVE-2025-64898

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991128)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991128 advisory. In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if...

Genexus Protection Server 代码问题漏洞

Genexus Protection Server is a component of Genexus Uruguay that manages and enforces product software licenses. A code issue vulnerability exists in Genexus Protection Server version 9.7.2.10, which stems from the presence of unquoted service paths in the protsrvservice Windows service...

Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs

Deep Neural Networks DNNs, as valuable intellectual property, face unauthorized use. Existing protections, such as digital watermarking, are largely passive; they provide only post-hoc ownership verification and cannot actively prevent the illicit use of a stolen model. This work proposes a...

CVE-2025-67646 TableProgressTracking's missing CSRF protection allows unauthorized state changes

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

EUVD-2025-202429

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

EUVD-2025-202605

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access...

CVE-2025-67460

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access...

CVE-2025-67460

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access...

CVE-2025-67460

CVE-2025-67460 affects Zoom Rooms for Windows prior to 6.6.0. The issue is a Protection Mechanism Failure of Software Downgrade , allowing an unauthenticated user with local access to escalate privileges. The vulnerability is scoped to the Windows version; CVSS v3.1 base score is 7.8 (HIGH) with ...

CVE-2025-67460 Zoom Rooms for Windows - Software Downgrade Protection Mechanism Failure

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access...

CVE-2025-67460 Zoom Rooms for Windows - Software Downgrade Protection Mechanism Failure

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access...

CLSA-2025-1765381441 nghttp2: Fix of CVE-2024-28182

CVE-2024-28182: fix continuation frame floods via frame count limiting...

Zoom Rooms for Windows 安全漏洞

Zoom Rooms for Windows is a conference room software from Zoom USA. A security vulnerability exists in Zoom Rooms for Windows prior to version 6.6.0, which stems from a failure in the software's downgrade protection mechanism and could lead to elevation of privilege via local access by an...