Ubuntu: Security Advisory (USN-7785-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7785-1: Open VM Tools vulnerability

It was discovered that Open VM Tools incorrectly handled permissions with version checking. An attacker could possibly use this issue to escalate privileges inside a virtual machine. This update disables the SDMP get-versions.sh script, so version information may no longer be made available...

USN-7785-1 open-vm-tools vulnerability

It was discovered that Open VM Tools incorrectly handled permissions with version checking. An attacker could possibly use this issue to escalate privileges inside a virtual machine. This update disables the SDMP get-versions.sh script, so version information may no longer be made available...

AZL-93039 CVE-2025-41244 affecting package open-vm-tools for versions less than 12.3.5-3

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate...

CVE-2025-41244

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate...

CVE-2025-41244

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate...

CVE-2025-41246: Incorrect Authorization

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs...

Important Photon OS Security Update - PHSA-2025-4.0-0878

Updates of 'open-vm-tools' packages of Photon OS have been released...

CVE-2025-9893

The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vmsettodefault function. This makes it possible for unauthenticated attackers to reset all menu...

CVE-2025-9893 VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update

The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vmsettodefault function. This makes it possible for unauthenticated attackers to reset all menu...

WordPress VM Menu Reorder plugin plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Nabil Irawan in WordPress Plugin VM Menu Reorder versions = 1.0.0...

WordPress plugin VM Menu Reorder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-9893: Cross-Site Request Forgery (CSRF)

The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vmsettodefault function. This makes it possible for unauthenticated attackers to reset all menu...

CVE-2025-22247 affecting package open-vm-tools for versions less than 12.3.5-2

CVE-2025-22247 affecting package open-vm-tools for versions less than 12.3.5-2. A patched version of the package is available...

CVE-2025-22247 affecting package open-vm-tools for versions less than 11.3.0-4

CVE-2025-22247 affecting package open-vm-tools for versions less than 11.3.0-4. A patched version of the package is available...

[SECURITY] Fedora 42 Update: trustee-guest-components-0.13.0-3.fc42

Running in a confidential VM, gather confidential-computing evidence, send it to Trustee and get secrets. A part of the confidential-containers project...

CVE-2025-27032

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency...

CVE-2025-27032

The CVE-2025-27032 vulnerability describes a memory corruption issue in Qualcomm closed-source components when loading a PIL-authenticated VM image without cache coherency. The flaw affects the handling of PIL VM images at load time, with the root cause identified as cache coherency problems that...

ROS-20250924-04

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to the following. insufficient validation of input data. Exploitation of the vulnerability could allow an attacker to gain access to read, modify, add, or delete data or cause a denial of...

CVE-2025-27032: Improper Access Control Applied to Mirrored or Aliased Memory Regions

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency...