EUVD-2025-198436

In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpivideoswitchbrightness The switchbrightnesswork delayed work accesses device-brightness and device-backlight, freed by acpivideodevunregisterbacklight during device removal. If the work...

ToddyCat: your hidden email assistant. Part 1

Introduction Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure for example, by deploying Microsoft Exchange Server or through cloud mail services such as Microsoft 365 or Gmail. However, some organizations do not...

Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-52434, CVE-2025-48989, CVE-2025-52520, CVE-2025-53506, CVE-2025-55668, CVE-2025-49125, CVE-2025-48988, CVE-2025-46701, CVE-2025-31651, CVE-2025-31650) affect Power HMC.

Summary The Apache Tomcat Server is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-52434 DESCRIPTION: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomca...

Security Bulletin: Vulnerabilities in httpd library (CVE-2024-47252, CVE-2025-23048, CVE-2025-49630) affect Power HMC.

Summary The httpd library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2024-47252 DESCRIPTION: Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS...

A Comprehensive Study on Cyber Attack Vectors in EV Traction Power Electronics

Electric vehicles EVs have drastically changed the auto industry and developed a new era of technologies where power electronics play the leading role in traction management, energy conversion and vehicle control processes. Nevertheless, this is a digital transformation, and the cyber-attack...

kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too...

Security Bulletin: Vulnerability in libxml2 library (CVE-2025-32415) affects Power HMC.

Summary The libxml2 library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-32415 DESCRIPTION: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer...

Security Bulletin: Vulnerabilities in pam library (CVE-2025-6020, CVE-2025-8941) affect Power HMC.

Summary The pam library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-6020 DESCRIPTION: A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing...

net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY

...

Siemens APOGEE PXC and TALON TC Series Expected Behavior Violation (CVE-2025-40555)

Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted...

Bitsgap vs HaasOnline: Advanced Features vs Smart Simplicity

Power vs Practicality in Crypto Automation...

Spectrum Power 4 Debug Interface RCE

The vulnerability of the debug interface of the Spectrum Power 4 software lies in errors that occur when privileged application programming interfaces are used. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

Spectrum Power 4 Arbitrary Command Execution

The vulnerability of the Spectrum Power 4 software’s user interface lies in the inclusion of functions from an unreliable and uncontrolled area. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Spectrum Power 4 Privilege Escalation

The vulnerability of the Spectrum Power 4 software is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

Spectrum Power 4 Privilege Escalation Command Injection

The vulnerability of the Spectrum Power 4 software is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands...

Spectrum Power 4 Privilege Escalation

The vulnerability of the Spectrum Power 4 software is related to incorrect privilege assignment. Exploiting this vulnerability can allow an attacker to enhance their privileges...

PowerChute Serial Shutdown Path Traversal Privilege Escalation

The vulnerability of the PowerChute Serial Shutdown software for managing uninterruptible power supplies is related to incorrect restrictions on the path name to the restricted access directory. Exploiting this vulnerability could allow an attacker to increase their privileges...

Direct Rendering Infrastructure Heap Buffer Overflow DoS

The vulnerability of the msmedpctrlpower function in the drivers/gpu/drm/msm/edp/edpctrl.c file, a driver for supporting Direct Rendering Infrastructure DRI in Linux kernel, is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2025-40120

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM autosuspend for AX88772 in bind. usbnet enables runtime PM autosuspend by default, so disabling it via the usbdriver flag is ineffective. O...

SUSE CVE-2025-40130

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpulatencyqosadd/remove/updaterequest interfaces lack internal synchronization by design, requiring the caller to ensure thread safety. The current...