CVE-2025-8217

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

CVE-2025-8217

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

CVE-2025-8217 Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

CVE-2025-8217 Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

CVE-2025-8217

CVE-2025-8217 documents describe a vulnerability in the Amazon Q Developer VS Code extension. The v1.84.0 extension contains inert, injected code intended to call the Q Developer CLI, which executes when the extension is launched in VS Code, but the injected code has a syntax error that prevents ...

Alert Enterprise Guardian 安全漏洞

Alert Enterprise Guardian is a physical identity and access management system open-sourced by Alert Enterprise in the United States. A security vulnerability exists in Alert Enterprise Guardian version 4.1.14.2.2.1, which originates from elevation to administrator privileges via the IsAdminApprov...

PT-2025-30452 · Alertenterprise · Alertenterprise Guardian

Name of the Vulnerable Software and Affected Versions: AlertEnterprise Guardian version 4.1.14.2.2.1 Description: An issue allows bypassing manager approval via the isAddedByApprover parameter in a Request Building Access requestSubmit API call. Recommendations: Apply a fix to address the bypass ...

CVE-2025-31513

CVE-2025-31513 affects AlertEnterprise Guardian 4.1.14.2.2.1. The issue allows privilege escalation to administrator via the IsAdminApprover parameter in a Request Building Access submission (/requestSubmit API). Remediation is to upgrade to a non-vulnerable build version listed by the vendor (e....

CVE-2025-31512

An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the followin...

CVE-2025-24311

An out-of-bounds read vulnerability exists in the cvsendblockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker can issue an API call to trigger this...

CVE-2025-24922

A stack-based buffer overflow vulnerability exists in the securebioidentify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cvobject can lead to a arbitrary code execution. An attacker can issue an API call to...

CVE-2025-25215 Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerability

An arbitrary free vulnerability exists in the cvclose functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability...

CVE-2025-24922

A stack-based buffer overflow vulnerability exists in the securebioidentify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cvobject can lead to a arbitrary code execution. An attacker can issue an API call to...

CVE-2025-25050

An out-of-bounds write vulnerability exists in the cvupgradesensorfirmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to...

CVE-2025-25050 Dell ControlVault3/ControlVault3 Plus cv_upgrade_sensor_firmware out-of-bounds write vulnerability

An out-of-bounds write vulnerability exists in the cvupgradesensorfirmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to...

CVE-2025-25050

Dell ControlVault3/ControlVault3 Plus are affected by CVE-2025-25050: an out-of-bounds write in cv_upgrade_sensor_firmware. Talos confirms vulnerable versions (e.g., CV firmware prior to 5.15.10.14 / 6.2.26.36) and describes a locally exploitable path via a crafted ControlVault API call, with CVS...

CVE-2025-24922

CVE-2025-24922 is a stack-based buffer overflow in the Dell ControlVault3/ControlVault3 Plus securebio_identify path. TALOS and Red Hat/NVD references confirm vulnerability exists in ControlVault firmware prior to 5.15.10.14 (Dell CV3) or 6.2.26.36 (CV3 Plus). The flaw is triggered by a crafted c...

CVE-2025-24311 Dell ControlVault3/ControlVault3 Plus cv_send_blockdata out-of-bounds read vulnerability

An out-of-bounds read vulnerability exists in the cvsendblockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker can issue an API call to trigger this...

CVE-2025-24311 Dell ControlVault3/ControlVault3 Plus cv_send_blockdata out-of-bounds read vulnerability

An out-of-bounds read vulnerability exists in the cvsendblockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an information leak. An attacker can issue an API call to trigger this...

CVE-2025-24311

Affected software: Dell ControlVault3 and ControlVault3 Plus firmware and related Windows driver interactions (cvusbdrv.sys) with the CA/firmware stack. Vulnerability: An out-of-bounds read in cv_send_blockdata can be triggered by a crafted ControlVault API call, leading to information disclosure...