CVE-2025-13193 Libvirt: information disclosure via world-readable vm snapshots

A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability...

CVE-2025-13193

Affects libvirt-based virtualization. CVE-2025-13193 causes external inactive snapshots for shut-down VMs to be world-readable, enabling information disclosure by unprivileged users. Public sources (Unity Linux UTSA-2025-993329; openSUSE openSUSE-SU-2025-20100-1; SUSE SUSE-SU-2026:0279-1) describ...

CVE-2025-13193

A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability. Mitigation Mitigation for this issue is either...

CVE-2025-13284

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

EUVD-2025-197757

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-13284 ThinPLUS｜ThinPLUS - OS Command Injection

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

Maxum Rumpus FTP Server 操作系统命令注入漏洞

Maxum Rumpus FTP Server is an FTP server software from Maxum. An operating system command injection vulnerability exists in Maxum Rumpus FTP Server version 9.0.12, which stems from improper neutralization of a special element and can lead to OS command injection...

Mozilla Thunderbird Security Update (mfsa_2025-90) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

The vulnerability of the die_mce() function in the arch/powerpc/kernel/traps.c module, which is part of the PowerPC kernel support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the diemce function in the arch/powerpc/kernel/traps.c module of the PowerPC platform support for the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to trigger a service...

The vulnerability of the Pandora FMS monitoring and management system, related to the lack of measures taken at the control level to clean data, allows a perpetrator to execute arbitrary commands and implant arbitrary OS commands.

The vulnerability of the Pandora FMS system for monitoring and managing IT environments stems from the lack of measures taken at the management level to secure data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and inject arbitrary OS commands...

PT-2025-47179

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The software contains a flaw related to improper neutralization of special elements used in an OS command, potentially leading to OS command injection. This iss...

The vulnerability of the tapriodestroy() function in the net/sched/sch_taprio.c module of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the tapriodestroy function in the net/sched/schtaprio.c module of the Linux operating system is related to the occurrence of mutual locking. Exploiting this vulnerability could allow a attacker to cause a service failure...

The vulnerability of the audit_match_perm() function in the kernel/auditsc.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the auditmatchperm function in the kernel/auditsc.c module of the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the btrfs_put_block_group() function in the fs/btrfs/block-group.c module of the Linux file system support module allows a attacker to cause a service failure.

The vulnerability of the btrfsputblockgroup function in the fs/btrfs/block-group.c module of the btrfs file system support in the Linux operating system is related to the lack of memory release after the effective lifespan has ended. Exploiting this vulnerability can allow an attacker to cause a...

CVE-2025-8870

On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153...

Photon OS 5.0: Linux PHSA-2025-5.0-0679

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0679. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Samba PHSA-2025-5.0-0648

An update of the samba package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0648. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-36251

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347...

CVE-2025-13123

A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/getfirstdate.php. Executing manipulation of the argument uid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-64444

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS...