Exploits and vulnerabilities in Q2 2025

Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published impact the security of nearly every computer subsystem: UEFI, drivers, operating systems, browsers, as well as user and web applications. Based on our analysis, threat actors continue to leverag...

PT-2025-34892 · Cisco · Cisco Ucs Manager

Name of the Vulnerable Software and Affected Versions: Cisco UCS Manager Software affected versions not specified Description: A vulnerability in the Cisco UCS Manager Software Command Line Interface CLI may allow an authenticated, local attacker with administrative privileges to read, create, or...

PT-2025-34890 · Cisco · Cisco Nx-Os

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software affected versions not specified Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operating system of an...

Cisco IOS DoS

The vulnerability of the SISF security function in Cisco IOS and Cisco IOS XE operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cisco IOS Buffer Overflow DoS

Vulnerabilities of Cisco IOS and IOS XE operating systems, as well as of the Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliance ASA micro-programmed network devices, are related to writing beyond the buffer boundaries in memory. Exploitation of these vulnerabilities can allo...

Cisco IOS DoS

The vulnerability of the ipslaippmserver function in Cisco IOS, IOS XE, and Cisco IOS XR is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cisco IOS XE IKEv1 DoS

The vulnerability of the Internet Key Exchange version 1 IKEv1 protocol in Cisco IOS XE operating systems is related to improper handling of undefined values. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cisco IOS ACL Bypass

The vulnerability of the Cisco IOS operating system’s access control list mechanism is related to access control errors. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions remotely...

Cisco IOS XE CSRF

The vulnerability in the web interface for controlling Cisco IOS XE operating systems is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2021-37146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An infinite loop in Open Robotics roscomm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers to cause a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2019-0053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to...

Linux Distros Unpatched Vulnerability : CVE-2023-35962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2023-40660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operation...

Linux Distros Unpatched Vulnerability : CVE-2020-10380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMySQL through 0.10.19 allows SQL Injection. CVE-2020-10380 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 8090...

Linux Distros Unpatched Vulnerability : CVE-2020-10289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an acti...

Linux Distros Unpatched Vulnerability : CVE-2022-34009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fossil 2.18 on Windows allows attackers to cause a denial of service daemon crash via an XSS payload in a ticket. This occurs because the ticket data is stored ...

Linux Distros Unpatched Vulnerability : CVE-2024-39780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A YAML deserialization vulnerability was found in the Robot Operating System ROS 'dynparam', a command- line tool for getting, setting, and deleting parameters ...

Linux Distros Unpatched Vulnerability : CVE-2019-13445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the ROS communications-related packages aka roscomm or ros-melodic-ros-comm through 1.14.3. parseOptions in tools/rosbag/src/record.c...

CVE-2025-53811

The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted...

CVE-2025-8700

Invoice Ninja on macOS is affected by a local privilege-escalation issue due to the presence of the entitlement com.apple.security.get-task-allow. This allows unprivileged local attackers (e.g., via a malicious app) to attach a debugger, read/modify process memory, and inject code within the app’...