The vulnerability of the cloud platform for managing and protecting Microsoft Entra ID (formerly Azure Active Directory) relates to deficiencies in access control. This allows attackers to escalate their privileges.

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

PT-2025-42030

Name of the Vulnerable Software and Affected Versions Windows versions prior to October 2025 Description A time-of-check time-of-use TOCTOU race condition exists in the Windows Cloud Files Mini Filter Driver. This condition allows a locally authorized attacker to elevate privileges. The issue ste...

SAP Cloud Appliance Library Appliances 安全漏洞

SAP Cloud Appliance Library Appliances is a cloud mirroring and system deployment platform from SAP, Germany. A security vulnerability exists in SAP Cloud Appliance Library Appliances that stems from an insecure S/4HANA default profile setting, which could allow an attacker to access other...

PT-2025-41839

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description SAP Commerce Cloud contains a path traversal issue that could allow users to access web applications, such as the Administration Console, from locations where it is not explicitly...

PT-2025-41841

Name of the Vulnerable Software and Affected Versions SAP Cloud Appliance Library Appliances affected versions not specified Description An attacker with high privileges can exploit an insecure default profile setting within existing SAP CAL appliances to gain access to other appliances. The issu...

Vulnerabilities of data protection software through PowerProtect Data Domain backup, data protection software in the corporate environment using cloud technologies APEX Protection Storage, PowerProtect DD Virtual Edition data protection platform, Data Domain OS operating system—related to the occurrence of operations outside the buffer in memory, allowing attackers to trigger a service failure.

The vulnerabilities of the data protection software through backup using PowerProtect Data Domain, the data protection software in the corporate environment using cloud technologies like APEX Protection Storage, the PowerProtect DD Virtual Edition data protection platform, and the Data Domain OS...

CVE-2025-42906: Improper Limitation of a Pathname to a Restricted Directory

SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a lo...

CVE-2025-55336: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...

CVE-2025-42909: Sensitive Cookie Without 'HttpOnly' Flag

SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL appliances to gain access to other appliances. This has low impact on confidentiality of the application, integrity and availability is not...

SAP Commerce Cloud 路径遍历漏洞

SAP Commerce Cloud is a cloud-based e-commerce platform from Germany's SAP. It supports sales management, marketing management, order management and operations management. A path traversal vulnerability exists in SAP Commerce Cloud, which stems from the presence of a path traversal vulnerability...

PT-2025-42021

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An issue exists in Windows Cloud Files Mini Filter Driver that could allow an authorized attacker to disclose information locally. The issue involves the exposure of sensitive information to ...

Microsoft Azure 安全漏洞

Microsoft Azure is a set of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. Microsoft Azure has a security vulnerability that can be exploited by an attacker who can elevate privileges...

CVE-2025-55680: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check time-of-use toctou race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID (formerly Azure Active Directory) relates to the lack of authentication for a critical function, allowing attackers to escalate their privileges.

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Vulnerabilities of data protection software through PowerProtect Data Domain backup, data protection software for corporate environments using cloud technologies APEX Protection Storage, PowerProtect DD Virtual Edition data protection platform, PowerProtect Data Domain Management Center – software for centralized management of data storage systems, Data Domain OS – operating system related to the lack of measures to neutralize special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the data protection software through backup using PowerProtect Data Domain, the data protection software in the corporate environment using cloud technologies like APEX Protection Storage, the PowerProtect DD Virtual Edition data protection platform, and the PowerProtect Data...

APSB25-95 : Security update available for Adobe Creative Cloud Desktop

Adobe has released an update for the Creative Cloud Desktop for macOS. This update includes a fix for an important vulnerability that could lead to arbitrary file system write in the context of the current user...

CVE-2025-61688

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API...

CVE-2025-61688 Omni leaks information via the API

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API...

EUVD-2025-34069

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...

CVE-2025-37729

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise ECE can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated...