CVE-2025-58474 BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery SSRF protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support...

K000148512: BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability CVE-2025-58474

Security Advisory Description When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery SSRF protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. CVE-2025-58474 Impact Traffic is...

Huawei HarmonyOS Camera app privilege authentication bypass vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege authentication bypass vulnerability exists in the Huawei HarmonyOS Camera app, which can be exploited by an attacker to compromise service...

PT-2025-42341

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions affected versions not specified F5 NGINX versions affected versions not specified Description When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery SSRF protection, or when an NGINX serv...

CVE-2025-58474: Allocation of Resources Without Limits or Throttling

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery SSRF protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support...

Huawei HarmonyOS Gallery app authentication bypass vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An authentication bypass vulnerability exists in the Huawei HarmonyOS Gallery app, which can be exploited by an attacker to compromise service confidentialit...

A New Attack Lets Hackers Steal 2-Factor Authentication Codes From Android Phones

The malicious app required to make a “Pixnapping” attack work requires no permissions...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling via the interpretation of...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling via the interpretation of...

EUVD-2025-34196

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox 144...

CVE-2025-11717

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox 144...

CVE-2025-11717

When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144...

Pixel-stealing “Pixnapping” attack targets Android devices

Researchers at US universities have demonstrated how a malicious Android app can trick the system into leaking pixel data. That may sound harmless, but imagine if a malicious app on your Android device could glimpse tiny bits of information on your screen—even the parts you thought were secure,...

CVE-2025-40771

creationtimestamp| type| source ---|---|--- 2025-10-14 10:34:53+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m35jrlliiz2k 2025-10-15 06:29:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m37mizetzb2a 2025-10-16 10:00:00+00:00| seen|...

CVE-2025-11577

creationtimestamp| type| source ---|---|--- 2025-10-14 06:36:24+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m354h5vvh223...

The vulnerability of NVIDIA NvContainer driver components, a part of the NVIDIA App management center, arises from the use of hard-coded constants. This allows an attacker to trigger a service failure or execute arbitrary code.

The vulnerability of NVIDIA NvContainer driver components in the NVIDIA App utility is related to the use of strictly encoded constants. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

Security Vulnerabilities fixed in Firefox 144 — Mozilla

Use-after-free in MediaTrackGraphImpl::GetInstance A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. A compromised web process using malicious IPC messages could have caused the privileged browser process to...

Siemens HyperLynx and Industrial Edge App Publisher

SUMMARY Multiple Siemens products are affected by a type confusion vulnerability in Google Chrome prior to 138.0.7204.96. This could allow a remote attacker to perform arbitrary code execution via a crafted HTML page. Siemens has released a new version for Industrial Edge App Publisher and...

EUVD-2025-34084

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...

CVE-2025-58084

Mattermost Desktop App versions = 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL...