Microsoft Azure Connected Machine Agent 访问控制错误漏洞

Microsoft Azure Connected Machine Agent is the ability of Microsoft Corporation USA to manage Windows and Linux computers hosted outside of Azure on a corporate network or other cloud provider. An access control error vulnerability exists in Microsoft Azure Connected Machine Agent, which stems fr...

PT-2025-42398

Name of the Vulnerable Software and Affected Versions Veeam Agent for Microsoft Windows affected versions not specified Description The issue resides in insufficient input validation within Veeam Agent for Microsoft Windows. Successful exploitation could allow an attacker to elevate their...

CVE-2025-59285: Deserialization of Untrusted Data

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

PT-2025-42470

Name of the Vulnerable Software and Affected Versions Fortinet FortiDLP Agent versions 10.3.1, 10.4.0, 10.5.1, 11.0.1, 11.1.1 through 11.1.2, 11.2.0 through 11.2.3, 11.3.2 through 11.3.4, 11.4.2 through 11.4.6, and 11.5.1 Description An improper limitation of a pathname to a restricted directory...

KLA89270 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Monitor Agent can be exploited remotely to gain privileges. 2. An elevatio...

Security Updates for Azure Connected Machine Agent < 1.56 (October 2025)

The Microsoft Azure Connected Machine Agent installation on the remote host is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. Note that Nessus has not tested for this issue but has instead...

Microsoft Azure Monitor Agent < 1.36.3 Elevation of Privilege (CVE-2025-59285)

The version of Microsoft Azure Monitor Agent installed on the remote host is prior to 1.36.3. It is, therefore, affected by a elevation of privilege vulnerability. Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. Note that Nessu...

Microsoft Azure Monitor Agent < 1.38.1.0 Elevation of Privilege (CVE-2025-59494)

The version of Microsoft Azure Monitor Agent installed on the remote host is prior to 1.38.1.0. It is, therefore, affected by a elevation of privilege vulnerability. Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. Note that Nessus has no...

Veeam Agent for Microsoft Windows 6.3.2.1302 Private Fix Deployment Information

Article Applicability This article documents the Veeam Agent for Microsoft Windows private fix deployment procedure for customers who have recently installed Veeam Backup & Replication 12.3.2.4165 Patch. That patch to Veeam Backup & Replication includes a private fix for Veeam Agent for Microsoft...

PACEbench: A Framework for Evaluating Practical AI Cyber-Exploitation Capabilities

The increasing autonomy of Large Language Models LLMs necessitates a rigorous evaluation of their potential to aid in cyber offense. Existing benchmarks often lack real-world complexity and are thus unable to accurately assess LLMs' cybersecurity capabilities. To address this gap, we introduce...

TOTOLINK X18 setEasyMeshAgentCfg Function Command Injection Vulnerability

TOTOLINK X18 is a Mesh WiFi 6 router system from TOTOLINK Taiwan, which supports WiFi 6 technology and optimizes home network coverage through the mesh function. TOTOLINK X18 suffers from a command injection vulnerability that stems from the failure of the agentName parameter in the...

CVE-2025-62159 External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through 0.19.2. The provider previously...

CVE-2025-62159 External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through 0.19.2. The provider previously...

CVE-2025-62159

CVE-2025-62159 affects External Secrets Operator’s BeyondTrust provider (versions 0.10.1–0.19.2). The legacy code retrieved Kubernetes secrets directly without validating namespace context or secret store type, enabling cross‑namespace secret access and security boundary violations. In version 0....

CVE-2025-35060

Newforma Info Exchange NIX provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent...

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system allows a perpetrator to execute arbitrary code.

The vulnerability of the Zabbix Agent 2 component in the Zabbix IT-infrastructure monitoring system is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RHEL 8 / 9 : Satellite 6 Client Bug Fix Update (Moderate) (RHSA-2025:17693)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:17693 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system allows a hacker to expose the protected information.

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information that...

CVE-2025-35060

Newforma Info Exchange NIX provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent...

CVE-2025-35060 Newforma Info Exchange (NIX) stored XSS via SVG file upload

Newforma Info Exchange NIX provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent...