CVE-2025-4616 Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser

An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls...

Palo Alto Prisma Browser 安全漏洞

Palo Alto Prisma Browser is a secure enterprise browser from Palo Alto USA. A security vulnerability exists in Palo Alto Prisma Browser that stems from insufficient policy enforcement and could allow locally authenticated, non-administrative users to bypass the screenshot control feature...

PT-2025-46991

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Prisma® Browser versions affected versions not specified Description A flaw exists in Palo Alto Networks Prisma® Browser on Windows where a locally authenticated, non-administrator user can circumvent the browser's screensho...

Palo Alto Prisma Browser 安全漏洞

Palo Alto Prisma Browser is a secure enterprise browser from Palo Alto USA. A security vulnerability exists in Palo Alto Prisma Browser that stems from insufficient input validation, which could allow locally authenticated, non-administrative users to bypass browser security controls...

open-vm-tools: Insecure file handling

A vulnerability was found in open-vm-tools. A malicious actor with non-administrative privileges on a guest virtual machine VM may tamper with the local files to trigger insecure file operations within that VM...

MantisBT Authorization Issue Vulnerability (CNVD-2025-28527)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. An authorization issue vulnerability exists in MantisBT 2.27.1 and earlier versions, which stems from insufficient...

WordPress kallyas plugin code execution vulnerability

WordPress kallyas plugin is a website builder designed for WordPress that offers theme and plugin functionality. A code execution vulnerability exists in WordPress kallyas plugin, which stems from unrestricted non-administrator access to the code editor widget, and can be exploited by an attacker...

CVE-2025-62520

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manageconfigcolumnspage.php can use the Copy From action to retrieve the columns configuration from a private project they have no...

MantisBT 授权问题漏洞

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. An authorization issue vulnerability exists in MantisBT 2.27.1 and earlier versions, which stems from insufficient...

PT-2025-44805

Name of the Vulnerable Software and Affected Versions MantisBT versions 2.27.1 and below Description Mantis Bug Tracker MantisBT is an open source issue tracker. Insufficient access-level checks allow a non-admin user with access to the manage config columns page.php page to retrieve the columns...

Astra Linux – Vulnerability in open-vm-tools

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper with local files to trigger insecure file operations within that VM...

CVE-2025-34273

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged use...

CVE-2025-34273

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged use...

CVE-2025-34273 Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged use...

CVE-2025-34273

CVE-2025-34273 concerns Nagios Log Server prior to 2024R2.0.3, where an incorrect authorization check in the global dashboard deletion workflow allows non-administrator users to delete dashboards, potentially affecting other users and the monitoring UI. Affected product: Nagios Log Server; vulner...

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this...

PT-2025-42234

Name of the Vulnerable Software and Affected Versions Dahua embedded products affected versions not specified Description An improper permission assignment for a critical resource allows a remote attacker with normal user credentials to access data restricted to administrator privileges via a...

September 9, 2025—KB5065432 (OS Build 20348.4171)

None None...

open-vm-tools: Local privilege escalation in open-vm-tools

A flaw was found in VMWare open-vm-tools. A malicious actor with non-administrative privileges on a guest Virtual Machine VM could exploit this vulnerability to gain root privileges on the VM. The issue lies in the service-discovery plugin logic, which can execute attacker-controlled binaries fro...

open-vm-tools: Local privilege escalation in open-vm-tools

A flaw was found in VMWare open-vm-tools. A malicious actor with non-administrative privileges on a guest Virtual Machine VM could exploit this vulnerability to gain root privileges on the VM. The issue lies in the service-discovery plugin logic, which can execute attacker-controlled binaries fro...