CVE-2025-24989

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

CVE-2025-24989 Microsoft Power Pages Elevation of Privilege Vulnerability

...

EUVD-2025-4642

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

CVE-2025-24989

CVE-2025-24989 is an elevation of privilege vulnerability in Microsoft Power Pages caused by improper access control. Public sources in the provided documents consistently describe it as allowing an unauthorized networked attacker to bypass the user registration control and escalate privileges. R...

CVE-2025-24989 Microsoft Power Pages Elevation of Privilege Vulnerability

...

Microsoft Power Pages Elevation of Privilege Vulnerability

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

KLA80251 PE vulnerability in Microsoft Dynamics

An elevation of privilege vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2025-24989 Exploitation Public exploits exist for this vulnerability. CVE list CVE-2025-24989 critical KB list Solution Install...

Microsoft Power Pages Access Control Vulnerability

Microsoft Power Pages is a secure, enterprise-grade, low-code SaaS platform for creating, hosting, and managing rich external business websites from Microsoft Corporation USA. An access control error vulnerability exists in Microsoft Power Pages that stems from the presence of an improper access...

VulnCheck KEV: CVE-2025-24989

Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control...

PT-2025-7551

Name of the Vulnerable Software and Affected Versions Microsoft Power Pages affected versions not specified Description The issue is related to improper access control in Microsoft Power Pages, allowing an unauthorized attacker to elevate privileges over a network, potentially bypassing user...

CVE-2025-24989

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

CVE-2025-24989: Improper Access Control

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update...

IBM Power Hardware Management Console Path Traversal Vulnerability

The IBM Power Hardware Management Console HMC is a suite of graphical interface software from International Business Machines IBM for configuring and managing the Power System family of servers. The software is primarily used to manage hardware such as servers. A path traversal vulnerability exis...

Security Bulletin: Vulnerability in openssl library (CVE-2024-5535) affects Power HMC.

Summary The openssl library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-5535 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a buffer over-read flaw in the SSLselectnextproto API function when...

Security Bulletin: Vulnerability in bzip library (CVE-2019-12900) affects Power HMC.

Summary The bzip library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2019-12900 DESCRIPTION: bzip2 is vulnerable to a denial of service, caused by an out-of-bounds write flaw when there are many selectors in the...

Security Bulletin: Vulnerability in expact library (CVE-2024-50602) affects Power HMC.

Summary The expat library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-50602 DESCRIPTION: An issue was discovered in libexpat before 2.6.4. There is a crash within the XMLResumeParser function because XMLStopParser ca...

Security Bulletin: Vulnerability in Apache Tomcat Server (CVE-2024-52317) affects Power HMC.

Summary The Apache Tomcat Server is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-52317 DESCRIPTION: Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response...

Security Bulletin: Vulnerability in Apache Tomcat Server (CVE-2024-52318) affects Power HMC.

Summary The Apache Tomcat Server is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-52318 DESCRIPTION: Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31,...

Security Bulletin: Vulnerabilities in IBM Java SDK (CVE-2024-21217, CVE-2024-21208, CVE-2024-10917) affect Power HMC.

Summary The IBM Java SDK library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2024-21217 DESCRIPTION: Vulnerability in Java SE component: Serialization. Difficult to exploit vulnerability allows unauthenticated attacker...

CVE-2024-56477

IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...