7503 matches found
CVE-2025-7025 Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat actor could execute code or disclose...
Discord CDN Link Abused to Deliver RAT Disguised as OneDrive File
Hackers are installing multiple RMMs like Atera and Splashtop in a new malware attack. This article details the abuse of Discord CDN link andn fake OneDrive phishing campaign discovered by Sublime Security...
BIT-VAULT-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse
A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
CVE-2025-54982
An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse...
CVE-2025-54982 SAML 2.0 Public Key Validation Issue
An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse...
CVE-2025-54982 SAML 2.0 Public Key Validation Issue
An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse...
PT-2025-31930 · Rockwell Automation · Arena Simulation
Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena® Simulation affected versions not specified Description: A memory abuse issue exists in Rockwell Automation Arena® Simulation. A custom file can force the software to read and write past the end of memory space...
Zscaler Client Connector 安全漏洞
Zscaler Client Connector is a lightweight agent from Zscaler, Inc. A security vulnerability exists in the Zscaler Client Connector that stems from improper cryptographic signature validation in the SAML authentication mechanism, which could lead to authentication abuse...
PT-2025-31929 · Rockwell Automation · Arena Simulation
Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena® Simulation affected versions not specified Description: A memory abuse issue exists in Rockwell Automation Arena® Simulation. A custom file can force the software to read and write past the end of memory space. User...
PT-2025-31928 · Rockwell Automation · Arena Simulation
Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena® Simulation affected versions not specified Description: A memory abuse issue exists in Rockwell Automation Arena® Simulation. A custom file can force the software to read and write past the end of memory space...
PT-2025-31904 · Zscaler · Zscaler
Name of the Vulnerable Software and Affected Versions: Zscaler affected versions not specified Description: An improper verification of a cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed for authentication abuse. Recommendations: At the moment, there i...
Hackers Abuse Microsoft 365 Direct Send to Deliver Internal Phishing Emails
A new Proofpoint report reveals how attackers are using Microsoft 365's Direct Send and unsecured SMTP relays to…...
Security update for apache2
This update for apache2 fixes the following issues: CVE-2024-42516: Fixed HTTP response splitting. bsc1246477 CVE-2024-43204: Fixed a SSRF when modproxy is loaded that allows an attacker to send outbound proxy requests to a URL controlled by them. bsc1246305 CVE-2024-47252: Fixed insufficient...
Malicious code in pexels-internal (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse
A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse
A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
CVE-2025-5997
Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2...
AVG TuneUp for PC TuneupSvc Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of AVG TuneUp for PC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AVG TuneUp...
Norton Utilities Ultimate NortonUtilitiesSvc Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Norton Utilities Ultimate. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Norton...