CVE-2025-0033

CVE-2025-0033 affects AMD SEV-SNP and describes a race condition in the Reverse Map Table (RMP) initialization that could allow a privileged hypervisor to modify RMP contents, potentially compromising SEV-SNP guest memory integrity. Affected hardware/stack: AMD EPYC processors with SEV-SNP. The r...

CVE-2025-0033

Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity...

Windows Connected Devices Platform Service (Cdpsvc) Remote Code Execution Vulnerability

Use after free in Connected Devices Platform Service Cdpsvc allows an unauthorized attacker to execute code over a network...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Use after free in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Connected Devices Platform Service Cdpsvc allows an authorized attacker to elevate privileges locally...

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally...

New Pixnapping Android Flaw Lets Rogue Apps Steal 2FA Codes Without Permissions

Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication 2FA codes, Google Maps timelines, and other sensitive data without the users' knowledge pixel-by-pixel. The attack has been codenamed...

CVE-2025-40771

A vulnerability has been identified in SIMATIC CP 1542SP-1 6GK7542-6UX00-0XE0 All versions V2.4.24, SIMATIC CP 1542SP-1 IRC 6GK7542-6VX00-0XE0 All versions V2.4.24, SIMATIC CP 1543SP-1 6GK7543-6WX00-0XE0 All versions V2.4.24, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL 6AG2542-6VX00-4XE0 All versions...

MAL-2025-48405 Malicious code in company-access-pending (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddfec3b870b7eafccef0a535e03adb6bf0728eaa79ca63e248fa07593eb20361 Any computer that has this package installed or running should be considered...

PT-2025-42063

Name of the Vulnerable Software and Affected Versions Windows Connected Devices Platform Service affected versions not specified Description A race condition exists within the Windows Connected Devices Platform Service due to concurrent execution using a shared resource with improper...

PT-2025-41883

Name of the Vulnerable Software and Affected Versions SIMATIC CP 1542SP-1 versions prior to 2.4.24 SIMATIC CP 1542SP-1 IRC versions prior to 2.4.24 SIMATIC CP 1543SP-1 versions prior to 2.4.24 SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL versions prior to 2.4.24 SIPLUS ET 200SP CP 1543SP-1 ISEC versio...

PT-2025-42013

Name of the Vulnerable Software and Affected Versions Connected Devices Platform Service Cdpsvc affected versions not specified Description A use after free condition exists in the Connected Devices Platform Service Cdpsvc. This allows an unauthorized attacker to execute code over a network. A us...

Microsoft Windows 资源管理错误漏洞

Microsoft Windows is a suite of operating systems used by Microsoft Corporation USA for personal devices. A resource management error vulnerability exists in Microsoft Windows Connected Devices Platform Service Cdpsvc that originates from a vulnerability that can be exploited by an attacker to...

PT-2025-42083

Name of the Vulnerable Software and Affected Versions Connected Devices Platform Service Cdpsvc affected versions not specified Description A heap-based buffer overflow exists in the Connected Devices Platform Service Cdpsvc. This allows an authorized attacker to elevate privileges locally...

PT-2025-42057

Name of the Vulnerable Software and Affected Versions Connected Devices Platform Service Cdpsvc affected versions not specified Description A use after free condition exists in the Connected Devices Platform Service Cdpsvc. This allows an authorized attacker to gain elevated privileges on the loc...

Security Bulletin: NVIDIA Jetson and IGX Devices - October 2025

NVIDIA has released a software update for NVIDIA® Jetson Linux. To protect your system, download and install this software update from the APT server or Jetson Download Center page, Jetson Linux Link and IGX Link. Go to NVIDIA Product Security...

SUSE SLES12 Security Update : bluez (SUSE-SU-2025:03590-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:03590-1 advisory. - CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections bsc1217877. Tenable has extracted the preceding...

CVE-2025-11648

A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TFFQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are high...

AMD CVE-2025-0033: RMP Corruption During SNP Initialization

Microsoft is aware of AMD-SB-3020 | CVE-2025-0033 disclosed by AMD on October 13, 2025. CVE-2025-0033 is a vulnerability in AMD EPYC processors using Secure Encrypted Virtualization – Secure Nested Paging SEV-SNP. It involves a race condition during Reverse Map Table RMP initialization that could...

Security update for bluez

This update for bluez fixes the following issues: CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections bsc1217877. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...