The vulnerability of the automatic update mechanism for PAK ViPNet Coordinator HW 4, ViPNet Coordinator IG 4, and ViPNet xFirewall 5 lies in the excessive capabilities for decompressing updates. This allows a malicious entity with pre-compromised network management centers (NMCs) to create specially modified update packages, distribute them to managed PAKs, and thereby compromise the integrity of their operating environments.

Vulnerability of the automatic update mechanism for PAK ViPNet Coordinator HW 4, ViPNet Coordinator IG 4, and ViPNet xFirewall 5, due to excessive capabilities for decompressing updates. Exploiting this vulnerability allows a malicious actor, operating from a pre-compromised network management...

CVE-2025-32798 Conda-build Allows Arbitrary Code Execution via Malicious Recipe Selectors

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process...

golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

A flaw was found in the go package of the cmd library in golang. The go command could be tricked into accepting a branch, which resembles a version tag. This issue could allow a remote unauthenticated attacker to bypass security restrictions and introduce invalid or incorrect tags, reducing the...