vim: Vim path traversal

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive...

EUVD-2025-74037

It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account...

kernel: information leak via transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information...

kernel: transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries...

CVE-2025-9055

CVE-2025-9055 relates to Axis VAPIX Edge storage API. A privilege-escalation flaw allows an administrator-privileged VAPIX user to gain Linux root privileges after authenticating with an administrator-privileged service account. Exploitation is local and requires high privileges, with the root ou...

CVE-2025-8998

CVE-2025-8998 affects Axis OS (edge devices) and is triggered by uploading files with a specific name into a temporary directory. The underlying effect is process crashes, reducing availability, and exploitation requires authentication with an operator- or administrator-privileged service account...

CVE-2025-9524

The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account...

CVE-2025-6571

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

CVE-2025-6571

A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it...

CVE-2025-6571

CVE-2025-6571 affects AXIS OS (Axis edge device OS). A third-party component exposes its password in process arguments, allowing low-privilege users to access it. The available documents describe the root cause (password exposure in parameters) and the impact (local access by low-privilege users)...

Code Injection

Gardener Extensions is vulnerable to Code Injection. The vulnerability is due to improper handling of user-controlled input in Terraformer-based infrastructure provisioning across AWS, Azure, OpenStack, and GCP providers, which allows an attacker with administrative privileges in a Gardener proje...

EUVD-2025-60984

Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and integrity and high impact on availability o...

CVE-2025-42888

SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability...

CVE-2025-42882

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

SUSE CVE-2025-64436

KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could...

CVE-2025-42895 Code Injection vulnerability in SAP HANA JDBC Client

Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and integrity and high impact on availability o...

CVE-2025-42888 Information Disclosure vulnerability in SAP GUI for Windows

SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability...

PT-2025-46386

Name of the Vulnerable Software and Affected Versions IntelR CIP software versions prior to WIN DCA 2.4.0.11001 Description An improper access control issue exists in some IntelR CIP software. This may allow an information disclosure when running within Ring 3 User Applications. An unprivileged...

PT-2025-46312

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists that allows the upload of files with a specific name to a temporary directory. This can lead to process crashes and reduced usability. Exploitation requires authentication with an...

Siemens Spectrum Power 安全漏洞

Siemens Spectrum Power is an energy management system from Siemens, Germany. A security vulnerability exists in Siemens Spectrum Power 4 versions prior to V4.70 SP12 Update 2, which originates from a credentials file that can be read globally, potentially allowing an attacker to connect to the...