ROS-20250731-05

A vulnerability in the Moby open source container framework is related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Amazon Linux 2 : rust (ALAS-2025-2933)

The version of rust installed on the remote host is prior to 1.86.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2933 advisory. The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup...

CVE-2025-25011

CVE-2025-25011 affects Elastic Beats (notably Filebeat) installed via Windows, where the Windows install script can trigger an Uncontrolled Search Path Element leading to Local Privilege Escalation through insecure directory permissions. Affected versions include Beats prior to 9.1.0 (with mainte...

CVE-2025-25011 Beats Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer

An uncontrolled search path element vulnerability can lead to local privilege Escalation LPE via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files,...

CVE-2025-0712 APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer

An uncontrolled search path element vulnerability can lead to local privilege Escalation LPE via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files,...

RockyLinux 8 : gnome-remote-desktop (RLSA-2025:10742)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:10742 advisory. gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs CVE-2025-5024 Tenable has extracted the preceding description block directly fr...

The vulnerability of the agent installer for data collection and delivery in Elasticsearch or Logstash Elastic Beats allows a perpetrator to enhance their privileges.

The vulnerability of the agent installer for data collection and delivery in Elasticsearch or Logstash Elastic Beats is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the agent installer for data collection and delivery in Elasticsearch or Logstash Elastic Beats allows a perpetrator to enhance their privileges.

The vulnerability of the agent installer for data collection and delivery in Elasticsearch or Logstash Elastic Beats is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

Security Bulletin: IBM Sterling Connect:Direct Web Services uses commons-lang3 and is vulnerable to CVE-2025-48924

Summary IBM Sterling Connect:Direct Web Services is vulnerable to uncontrolled recursion vulnerability in Apache Commons Lang. This has been addressed in new build available from IBM Repository. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache...

RLSA-2025:10742 Moderate: gnome-remote-desktop security update

GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs CVE-2025-5024 For more details about the security issues, including the impact, a CVSS score,...

PT-2025-31360 · Elastic +1 · Beats

Name of the Vulnerable Software and Affected Versions: versions prior to 2025 affected versions not specified Description: An uncontrolled search path element vulnerability can lead to local privilege escalation LPE via insecure directory permissions. Improper handling of directory permissions...

The vulnerability of the MongoDB database management system server allows a hacker to cause a service failure.

The vulnerability of the MongoDB database management system server is related to an uncontrolled recursion. Exploiting this vulnerability allows a malicious actor to cause service interruptions remotely...

The vulnerability of the Redis database management system, related to uncontrolled memory allocation, allows attackers to trigger service failures.

The vulnerability of the Redis database management system is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Security Bulletin: Uncontrolled Resource Consumption vulnerability in Apache Commons IO, which affects IBM watsonx.data

Summary Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended ...

CVE-2025-7427

Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a Denial of Service and Uncontrolled Resource Consumption due to Multer and brace-expansion( CVE-2025-48997,CVE-2025-5889 )

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to a Denial of Service and Uncontrolled Resource Consumption due to Multer and brace-expansion. Vulnerability Details CVEID:CVE-2025-48997 DESCRIPTION: Multer is a node....

The vulnerability of the Apache Tomcat application server, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Apache Tomcat application server is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the ClassUtils.getClass() function in the Apache Commons Lang library for the Java programming language allows a attacker to trigger a denial-of-service attack.

The vulnerability of the ClassUtils.getClass method in the Apache Commons Lang library for the Java programming language is related to an uncontrolled recursion. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of Trend Micro Apex One and Apex One as a Service anti-virus software lies in its uncontrolled search path. This allows attackers to escalate their privileges and execute arbitrary code within the SYSTEM context.

The vulnerability of the Data Loss Prevention module in Trend Micro’s anti-virus software programs Apex One and Apex One as a Service is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary co...

CVE-2025-53538 Suricata's mishandling of data on HTTP2 stream 0 can lead to resource starvation

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In versions 7.0.10 and below and 8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of...