DaaS - Create machine catalog using private storage endpoints on Azure

Create a secure environment in Azure by forcing all storage traffic through Private IPs. With this the Azure Storage Endpoint gets a Private IP assigned, and the Hosting Connection traffic cannot go through the public internet; all traffic needs to go through a Private IP...

DRUPAL-CONTRIB-2025-033

Panels enables administrators to add page variants within page manager, panelizer, etc to create custom pages. The module doesn't sufficiently protect sensitive routes, allowing an attacker to view and modify blocks within variants without requiring appropriate permission. This vulnerability is...

CVE-2025-21431

Information disclosure may be there when a guest VM is connected...

DEBIAN-CVE-2025-22013

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: Host SVE being discarded unexpectedly due to inconsistent...

Microsoft System Center Operations Manager 代码问题漏洞

Microsoft System Center Operations Manager is a large-scale monitoring and management software for corporate environments from Microsoft USA. Formerly known as MOM Microsoft Operations Manager, the software is primarily used to monitor IT systems and provide monitoring support for distributed...

SUSE-SU-2025:1162-1 Security update for xen

This update for xen fixes the following issues: - CVE-2025-1713: Fixed potential deadlock with VT-d and legacy PCI device pass-through bsc1238043 Other fixes: - Xen channels and domU console bsc1219354 - Fixed attempting to start guest vm's libxl fills disk with errors bsc1237692 - Xen call trace...

CVE-2025-21431 Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform

Information disclosure may be there when a guest VM is connected...

CVE-2025-21431

CVE-2025-21431 concerns a TOCTOU race condition in an Automotive OS Platform affecting Qualcomm chipsets. The vulnerability enables information disclosure when a guest VM is connected. Root cause and affected component are described in the CVE records and related entries (e.g., Red Hat and CVE li...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm, Inc. A security vulnerability exists in Qualcomm Chipsets that stems from a vulnerability that could lead to information disclosure when connecting to a client VM...

Unable to run WSL2 on the W11 VDI machine

When customers attempt to install the WSL 2 Ubuntu distribution on Windows 11 VDIs , they encounter the following message: Installing, this may take a few minutes. Error observedWslRegisterDistribution failed with error: 0xe000020b Error: 0xe000020b null...

PT-2025-15206 · Qualcomm · Snapdragon +29

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Information disclosure may occur when a guest VM is connected. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Ubuntu 14.04 LTS : libdbd-mysql-perl vulnerabilities (USN-7417-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7417-1 advisory. It was discovered that libdbd-mysql-perl did not correctly handle certain SQL queries. An attacker could possibly use this issue to cause a denial of...

Malicious code in dave-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5c5e4c9469fec2d35256dcb0afcf57d63e6cfcf6ef685cf0f916f05cedc34c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

JTEKT ELECTRONICS HMI ViewJet C-more 安全漏洞

JTEKT ELECTRONICS HMI ViewJet C-more is a series of human-machine interfaces from JTEKT ELECTRONICS, Japan. A security vulnerability exists in the JTEKT ELECTRONICS HMI ViewJet C-more that stems from a weak password encoding issue that could lead to credential disclosure...

JTEKT ELECTRONICS HMI ViewJet C-more 安全漏洞

JTEKT ELECTRONICS HMI ViewJet C-more is a series of human-machine interfaces from JTEKT ELECTRONICS, Japan. A security vulnerability exists in JTEKT ELECTRONICS HMI ViewJet C-more that stems from a proxy issue that could lead to an FTP bounce attack...

Malicious code in start-state-machine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 817dc6cbfa89267c683591874924c9aaf14005ca7e5da82c2d7ee55fccb52c76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization

A vulnerability in Gladinet CentreStack and Triofox application using hardcoded cryptographic keys for ViewState could allow an attacker to forge ViewState data. This can lead to unauthorized actions such as remote code execution. Both applications make use of a hardcoded machineKey in the IIS...

kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed

In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async PF workqueue when vCPU is being destroyed Always flush the per-vCPU async PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs is being destroyed. KVM must ensure tha...

CVE-2025-3097

CVE-2025-3097 affects the WordPress plugin wp Time Machine. It is vulnerable to Cross-Site Request Forgery due to missing nonce validation on wpTimeMachineCore.php in all versions up to 3.4.0. This allows unauthenticated attackers to update settings and inject malicious web scripts via forged req...

CVE-2025-3097 wp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and...