Microsoft Active Directory Domain Services 资源管理错误漏洞

Microsoft Active Directory Domain Services is a key service from Microsoft Corporation USA used to manage and organize resources, users, computers, and other security objects in a network. A resource management error vulnerability exists in Microsoft Active Directory Domain Services. An attacker...

PT-2025-6656 · Intel · Intel Amt +1

Name of the Vulnerable Software and Affected Versions: IntelR AMT and IntelR Standard Manageability affected versions not specified Description: The issue is related to improper input validation in the firmware, which may allow an authenticated user to potentially enable denial of service via...

PT-2025-6327

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description The issue is related to an elevation of privilege vulnerability in Windows Storage. It allows an attacker to elevate their privileges to the level of SYSTEM and delete targeted file...

PT-2025-6171 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: In affected versions of Octopus Deploy where customers are using Active Directory for authentication, it was possible for an unauthenticated user to make an API request against two...

Octopus Server 安全漏洞

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. A security vulnerability exists in Octopus Server that stems from a customer using Active Directory for authentication, where an unauthenticated user could issue API requests to t...

PT-2025-6309 · Microsoft · Windows Active Directory Domain Services +1

Name of the Vulnerable Software and Affected Versions: Windows Active Directory Domain Services affected versions not specified Description: The issue is related to an uncontrolled resource consumption in the Windows Active Directory Domain Services API, which can lead to a denial of service. Thi...

PT-2025-6319 · Microsoft · Windows Ldap +1

Name of the Vulnerable Software and Affected Versions: Windows Lightweight Directory Access Protocol LDAP affected versions not specified Description: The issue is related to the implementation of the Lightweight Directory Access Protocol LDAP in Windows, caused by synchronization errors when usi...

SUSE-SU-2025:0401-1 Security update for crypto-policies, krb5

This update for crypto-policies and krb5 fixes the following issues: Security issue fixed: - CVE-2025-24528: Fixed out-of-bounds write caused by overflow when calculating ulog block size can lead to process crash bsc1236619. Feature addition: - Add crypto-policies support; jscPED-12018 The defaul...

CISA Warns of Active Exploits Targeting Trimble Cityworks Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has warned that a security flaw impacting Trimble Cityworks GIS-centric asset management software has come under active exploitation in the wild. The vulnerability in question is CVE-2025-0994 CVSS v4 score: 8.6, a deserialization of...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-0994link is external Trimble Cityworks Deserialization Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

CVE-2021-37705

OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a...

CVE-2025-0069

Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a...

CVE-2022-24401

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of...

CVE-2020-36167

An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. On start-up, it loads the OpenSSL library from the Installation folder. This library in turn attempts to load the /usr/local/ssl/openssl.cnf configuration file, whi...

CVE-2020-36160

An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories...

CVE-2024-21464

Memory corruption while processing IPA statistics, when there are no active clients registered...

CVE-2024-29907

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Active Websight SEO Backlink Monitor allows Reflected XSS.This issue affects SEO Backlink Monitor: from n/a through 1.5.0...

CVE-2024-23831

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...

CVE-2024-23465

The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment...

CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog, Urges Fixes by Feb 25

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-45195 CVSS score: 7.5/9.8 - A forced...