12941 matches found
CVE-2025-2901
Rejected reason: This vulnerability is redundant to CVE-2025-23366 and CVE-2024-10234...
CVE-2025-2901
CVE-2025-2901 is rejected/not used and does not represent an active vulnerability entry.
SUSE CVE-2023-52973
In the Linux kernel, the following vulnerability has been resolved: vcscreen: move load of struct vcdata pointer in vcsread to avoid UAF After a call to consoleunlock in vcsread the vcdata struct can be freed by vcdeallocate. Because of that, the struct vcdata pointer load must be done at the top...
A Deep Dive into Water Gamayun’s Arsenal and Infrastructure
Trend Research discusses the delivery methods, custom payloads, and techniques used by Water Gamayun, the suspected Russian threat actor abusing a zero-day vulnerability in the Microsoft Management Console framework CVE-2025-26633 to execute malicious code on infected machines...
DEBIAN-CVE-2023-52973
In the Linux kernel, the following vulnerability has been resolved: vcscreen: move load of struct vcdata pointer in vcsread to avoid UAF After a call to consoleunlock in vcsread the vcdata struct can be freed by vcdeallocate. Because of that, the struct vcdata pointer load must be done at the top...
CVE-2023-52973 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vcscreen: move load of struct vcdata pointer in vcsread to avoid UAF After a call to consoleunlock in vcsread the vcdata struct can be freed by vcdeallocate. Because of that, the struct vcdata pointer load must be done at the top...
The vulnerability of the imx_uart_console_write() function in the Linux kernel’s serial component allows a hacker to trigger a service failure.
The vulnerability of the imxuartconsolewrite function in the Linux kernel’s serial component is related to improper locking mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...
EncryptHub Exploits Windows Zero-Day to Deploy Rhadamanthys and StealC Malware
The threat actor known as EncryptHub exploited a recently-patched security vulnerability in Microsoft Windows as a zero-day to deliver a wide range of malware families, including backdoors and information stealers such as Rhadamanthys and StealC. "In this attack, the threat actor manipulates .msc...
GO-2025-3539 OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console
OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console...
CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin
Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data...
HPESBNW04834 rev.1 - HPE Unified OSS Console (UOC) and HPE Unified OSS Assurance Monitoring (UOCAM) Software, Multiple Vulnerabilities
Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information, Arbitrary file upload; Remote: Denial of Service DoS, Disclosure of Information, Arbitrary file upload, Unquoted Search Path SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console...
[SECURITY] Fedora 42 Update: dotnet8.0-8.0.114-1.fc42
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...
CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...
CVE-2025-27705
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator...
GHSA-V63M-X9R9-8GQP AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
Summary The AWS Cloud Development Kit AWS CDK 1 is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. The AWS CDK CLI 2 is a command line tool for interacting with CDK applications. Customers can use the CDK CLI ...
CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....
CVE-2025-2598
CVE-2025-2598 (AWS CDK CLI) : When using the AWS CDK CLI with a credential plugin that returns an expiration property, credentials may be printed to console output. The issue is mitigated by upgrading to version 2.178.2 or later and patching any forked/derivative code. Public references indicate ...
AWS Cloud Development Kit 安全漏洞
AWS Cloud Development Kit is an open source software development framework open sourced by Amazon Web Services for defining cloud infrastructure in code and configuring it via AWS CloudFormation. A security vulnerability exists in AWS Cloud Development Kit that stems from credential information...
GHSA-69X5-HJG4-M267 OpenShift Console Has a Path Traversal Vulnerability
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.goL112 Because of this unsafe filepath construction, an...