PT-2025-28286 · Sap · Sap S/4Hana +1

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA and SAP SCM versions S4CORE 102-108 Description: SAP S/4HANA and SAP SCM Characteristic Propagation contains a remote code execution issue. An attacker with user-level or high privileges can create a new report containing maliciou...

PT-2025-28276 · Sap · Sap Netweaver System Configuration

Name of the Vulnerable Software and Affected Versions: SAP Netweaver System Configuration affected versions not specified Description: The issue results from a lack of necessary authorization checks for an authenticated user, leading to escalation of privileges. This could completely compromise t...

CVE-2025-34071 GFI Kerio Control Unsigned System Image Upload Root Code Execution

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts with...

CVE-2025-32977

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

CVE-2025-32977

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

RHSA-2025:9420 Red Hat Security Advisory: libarchive security update

Bulletin has no description...

CVE-2025-32977

Quest KACE Systems Management Appliance (SMA) is affected across multiple tracked CVEs for versions 13.0.x–14.1.x: CVE-2025-32975 (authentication bypass in SSO), CVE-2025-32976 (2FA bypass), CVE-2025-32977 (unauthenticated backup file upload due to weak signature validation), and CVE-2025-32978 (...

CVE-2025-32977

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

CVE-2025-32977

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 allows unauthenticated users to upload backup files to the system. While signature validation is implemented,...

Security Bulletin: IBM Event Processing is vulnerable to an Authorization Bypass (CVE-2025-29927)

Summary IBM Event Processing is vulnerable to an Authorization Bypass due to the use of a Next.js component. Since Next.js can be used in the UI layer or API routing, unauthorized users may gain access to protected resources or functionalities, potentially compromising the system's integrity...

PT-2025-24591 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP affected versions not specified Description: The issue is related to a missing authorization check in the RFC inbound processing, allowing an authenticated user to escalate their privileges. This coul...

MAL-2025-4752 Malicious code in mssql-internal (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2304e726ecb296faa8d3bc0c0eca49fecae3b3aa9436713580d7a61a9d5b65c7 Any computer that has this package installed or running should be considered...

CVE-2025-27702

CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly modify settings. The attack complexi...

[SECURITY] [DLA 4193-1] linux-6.1 security update

Debian LTS Advisory DLA-4193-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings May 30, 2025 https://wiki.debian.org/LTS Package : linux-6.1 Version : 6.1.137-1deb11u1 CVE ID : CVE-2023-52857 CVE-2023-52927 CVE-2023-53034 CVE-2024-24855 CVE-2024-26656 CVE-2024-26739...

PT-2025-23166 · Aptiov · Aptiov

Name of the Vulnerable Software and Affected Versions: APTIOV affected versions not specified Description: The issue is related to an Improper Input Validation in the BIOS, which can be exploited locally by an attacker. This could potentially impact the integrity of the system. Recommendations: A...

CVE-2025-27703

CVE-2025-27703 affects Absolute Secure Access prior to version 13.54, with a privilege-escalation in the management console. Attackers with administrative access to a subset of privileged features can elevate permissions to access additional console features. Reported impacts: confidentiality low...

Fedora: Security Advisory (FEDORA-2024-c4bf73eb40)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-37351

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the second administrator later edits the same manageme...

CVE-2024-37350

There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrator’s use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the...

CVE-2024-37348

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrator’s use of the management UI when the second administrator later edits the same...