CVE-2025-49461 Zoom Workplace Clients - Cross-site Scripting

Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access...

CVE-2025-49461

CVE-2025-49461 concerns Zoom Workplace Clients affected by a cross-site scripting vulnerability that may allow an unauthenticated attacker to cause a denial of service over the network. The issue is described in the ZSB-25034 advisory and is associated with Zoom Workplace versions prior to 6.3.14...

CVE-2025-49460 Zoom Workplace Clients - Argument Injection

Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access...

CVE-2025-49460

The CVE-2025-49460 issue affects Zoom Workplace family components (notably Zoom Workplace/VDI Client) with versions older than fixed releases. The publicly documented impact is Uncontrolled resource consumption that allows an unauthenticated remote attacker to cause a denial of service over the n...

CVE-2025-49460 Zoom Workplace Clients - Argument Injection

Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access...

CVE-2025-49458 Zoom Workplace Clients - Buffer Overflow

Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access...

CVE-2025-49458

CVE-2025-49458 describes a buffer overflow in Zoom Workplace Clients that could allow an authenticated user to cause a denial of service over the network. Public documentation and scanner advisories (e.g., ZSB-25031) indicate the issue affects Zoom Workplace Clients generally and is mitigated by ...

CVE-2025-49458 Zoom Workplace Clients - Buffer Overflow

Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access...

CVE-2025-9269 Server-Side Request Forgery (SSRF) vulnerability found in embedded web server

A Server-Side Request Forgery SSRF vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerabili...

CVE-2025-9269

Lexmark devices with the embedded web server are affected by CVE-2025-9269 (SSRF). The vulnerability allows an attacker to coerce the device into issuing arbitrary HTTP requests to a third-party server, potentially enabling internal network access or data disclosure. CVSSv4 base score 6.9 (networ...

CVE-2025-55227

Improper neutralization of special elements used in a command 'command injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2025-54918

Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network...

CVE-2025-54113

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...

CVE-2025-47997

Concurrent execution using shared resource with improper synchronization 'race condition' in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2025-47997

Concurrent execution using shared resource with improper synchronization 'race condition' in SQL Server allows an authorized attacker to disclose information over a network...

Use Of Default Credentials

nginx-defender is vulnerable to Use of Default Credentials. The vulnerability is due to insecure configuration due to default administrative passwords being present in example configuration files, allowing attackers with network access to gain full administrative control if not changed...

CVE-2025-40757

A vulnerability has been identified in APOGEE PXC Series BACnet All versions, APOGEE PXC Series P2 Ethernet All versions, TALON TC Series BACnet All versions. Affected devices connected to the network allow unrestricted access to sensitive files, such as databases. This could allow an attacker to...

PT-2025-36888

Name of the Vulnerable Software and Affected Versions: SQL Server affected versions not specified Description: An improper neutralization of special elements used in a command 'command injection' exists in SQL Server. This allows an authorized attacker to elevate privileges over a network...

PT-2025-36981

Name of the Vulnerable Software and Affected Versions: Zoom Workplace Clients affected versions not specified Description: A buffer overflow issue exists in certain Zoom Workplace Clients. An authenticated user can potentially cause a denial of service by accessing the network. Recommendations: A...

Siemens Apogee PXC and Talon TC Devices

SUMMARY Apogee PXC and Talon TC contain a vulnerability that could allow an attacker to download the device encrypted database file. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. 2. GENERAL RECOMMENDATIONS As a...