CVE-2025-11493: Download of Code Without Integrity Check

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by...

ConnectWise Automate Agent 安全漏洞

ConnectWise Automate Agent is a remote monitoring and management software from ConnectWise USA. A security vulnerability exists in ConnectWise Automate Agent that stems from an improper configuration that allows the use of the HTTP protocol, which could lead to a man-in-the-middle attacker...

CVE-2025-11492: Cleartext Transmission of Sensitive Information

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some...

ConnectWise Automate Agent 安全漏洞

ConnectWise Automate Agent is a remote monitoring and management software from ConnectWise USA. A security vulnerability exists in ConnectWise Automate Agent that stems from not fully verifying the authenticity of files downloaded from a server, which could lead to a man-in-the-middle attack...

CVE-2025-54658: Improper Limitation of a Pathname to a Restricted Directory

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and...

PT-2025-42524

Name of the Vulnerable Software and Affected Versions ConnectWise Automate Agent affected versions not specified Description The software does not fully validate the authenticity of downloaded files, including updates, dependencies, and integrations. This allows a man-in-the-middle attacker to...

The vulnerability of the data collection tool for Azure Monitor Agents, which are associated with virtual machines and physical servers, stems from deficiencies in the deserialization mechanism. This allows attackers to exploit their privileges.

The vulnerability of the data collection tool for Azure Monitor Agents, which are used on virtual machines and physical servers, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow attackers to increase their privileges...

CVE-2025-58724

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2025-47989

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2025-59285

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2025-59494

Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Vulnerabilities fixed in Veeam Backup & Replication

Veeam has fixed vulnerabilities in Veeam Backup & Replication. The vulnerabilities are in Veeam Backup & Replication's Mount service and Backup Server, both of which are vulnerable to remote code execution RCE by authenticated domain users. This can lead to unauthorized access and manipulation of...

RoBCtrl: Attacking GNN-Based Social Bot Detectors Via Reinforced Manipulation of Bots Control Interaction

Social networks have become a crucial source of real-time information for individuals. The influence of social bots within these platforms has garnered considerable attention from researchers, leading to the development of numerous detection technologies. However, the vulnerability and robustness...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1224)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1224 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2025-3037 (ALAS-2025-3037)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300059.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3037 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065...

EUVD-2025-34269

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

EUVD-2025-34357

Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

EUVD-2025-34318

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

EUVD-2025-34431

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to impersonate another user and potentially grant themselves elevated privileges, in order to gain access to sensitive data or execute arbitrary code with elevated privileges. The...