VMware Tools for Windows security vulnerabilities

VMware Tools for Windows is a set of Windows-based, VMWare virtual machine enhancement tools from VMware, which are drivers provided by VMware to enhance the performance of virtual graphics cards and hard disks, as well as to synchronize the clocks of the virtual machine with those of the host. A...

CVE-2025-34232: Missing Authentication for Critical Function

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a blind server-side request forgery SSRF vulnerability reachable via the /var/www/app/consolerelease/lexmark/dellCheck.php script that can be...

Vasion Print Virtual Appliance Host security vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 22.0.1049, which stems from an unauthenticated management route exposure that could lead to certificate replacement, deletio...

Vasion Print Virtual Appliance Host Access Control Error Vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. An access control error vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 22.0.1049, which stems from a misconfigured SSH client and could allow an attacker to capture forwarded private...

CVE-2025-34230: Missing Authentication for Critical Function

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a blind server-side request forgery SSRF vulnerability reachable via the /var/www/app/consolerelease/hp/logoffsinglesignon.php script that can...

Vasion Print Virtual Appliance Host security vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102, which originates from an unvalidated /var/www/app/consolerelease/lexmark/update.php script that does not properly...

Vasion Print Virtual Appliance Host security vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 22.0.1026 that originates from an unauthenticated REST API endpoint exposing configuration files and plaintext passwords,...

Vasion Print Virtual Appliance Host security vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 22.0.862, which stems from the inclusion of private keys and hard-coded passwords in the Docker image, which could allow an...

CVE-2025-34218: Missing Authentication for Critical Function

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose internal Docker containers through the gw Docker instance. The gateway publishes a /meta endpoint which lists every micro‑service container...

CVE-2025-34233: Server-Side Request Forgery (SSRF)

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 VA/SaaS deployments contain a protection mechanism failure vulnerability within the filegetcontents function. When an administrator configures a printer’s hostname or...

CVE-2025-34221: Missing Authentication for Critical Function

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 VA/SaaS deployments expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no...

CVE-2025-34212: Download of Code Without Integrity Check

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 VA/SaaS deployments possess CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature...

Vasion Print Virtual Appliance Host security vulnerability

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 22.0.843 that stems from the build process using an unverified third-party image, which could lead to supply chain attacks,...

PT-2025-42266

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to memory management and swap operations. Specifically, a race condition between fork and swapoff can lead to a kernel NULL pointer dereference...

CVE-2025-9958

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations...

CVE-2025-20333

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper...

CVE-2025-20362

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

Impact Because UPDATE validation is not being applied, it is possible for an actor with access to an instance of the initializingworkspaces virtual workspace to run arbitrary patches on the status field of LogicalCluster objects while the workspace is initializing. This allows to add or remove an...

GHSA-Q6HV-WCJR-WP8H kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

Impact Because UPDATE validation is not being applied, it is possible for an actor with access to an instance of the initializingworkspaces virtual workspace to run arbitrary patches on the status field of LogicalCluster objects while the workspace is initializing. This allows to add or remove an...

WordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WP Virtual Assistant versions = 3.0...