CVE-2025-1384 Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers

Least Privilege Violation CWE-272 Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the...

CAN-Trace Attack: Exploit CAN Messages to Uncover Driving Trajectories

Driving trajectory data remains vulnerable to privacy breaches despite existing mitigation measures. Traditional methods for detecting driving trajectories typically rely on map-matching the path using Global Positioning System GPS data, which is susceptible to GPS data outage. This paper...

CVE-2025-35983

Improper Certificate Validation CWE-295 in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the GetFile function in the filecontroller.go. An attacker can access arbitrary files on the server by manipulating the fileName argument. Details A Directory Traversal attack also known as path traversal aims to...

CVE-2025-7450

A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controller/api/v1/user.go of the component API. The manipulation of the argument filename leads to path traversal. It is possible to initiate the...

KVM: arm64: Tear down vGIC on failed vCPU creation

...

irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs

...

CVE-2025-53512

The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information...

CVE-2025-53513

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through th...

@kontaa/subgraph (>=1.0.1, <=1.2.3), @kontaa/utils (>=1.2.1, <=1.2.3) +4 more potentially affected by CVE-2025-53364 via parse-server (>=5.6.0, <=6.5.11)

parse-server NPM version =5.6.0, =1.0.1, =1.2.1, =2.4.46, =1.0.0, =1.0.1, =1.0.23 - servable-publishable 1.1.0 Source cves: CVE-2025-53364 Source advisory: OSV:GHSA-48Q3-PRGV-GM4W...

UBUNTU-CVE-2025-38336

In the Linux kernel, the following vulnerability has been resolved: ata: patavia: Force PIO for ATAPI devices on VT6415/VT6330 The controller has a hardware bug that can hard hang the system when doing ATAPI DMAs without any trace of what happened. Depending on the device attached, it can also...

CVE-2025-35983

Improper Certificate Validation CWE-295 in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are...

CVE-2025-35983

Improper Certificate Validation CWE-295 in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are...

CVE-2025-35983

Improper Certificate Validation CWE-295 in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are...

CVE-2025-35983

CVE-2025-35983 affects Gallagher Controller 7000. The issue arises from improper certificate validation in the Controller 7000 OneLink implementation during initial configuration, which could allow an unprivileged attacker to cause a limited denial of service or perform privileged overrides. The ...

CVE-2025-35983: Improper Certificate Validation

Improper Certificate Validation CWE-295 in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are...

Gallagher Controller 7000 Trust Management Vulnerability

The Gallagher Controller 7000 is a powerful network connectivity controller from Gallagher New Zealand. A security vulnerability exists in the Gallagher Controller 7000 version 9.30 up to and including vCR9.30.250624a, which stems from improper certificate validation and could result in a denial ...

PT-2025-29058

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a flaw in the pata via controller that can cause system hangs when performing ATAPI Direct Memory Access DMA operations on certain hardware configurations,...

PT-2025-28972 · Unknown · Controller 7000

Name of the Vulnerable Software and Affected Versions: Controller 7000 versions prior to vCR9.30.250624a distributed in 9.30.1871 MR1 Description: Improper certificate validation may allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to storing authentication tokens unencrypted in config.xml files on the controller. An attacker can obtain sensitive authentication tokens by gaining Item/Extended Read permission or accessing th...