AirDrop Unauthorized Access

The vulnerability of the AirDrop wireless data transmission component in operating systems such as iPadOS, iOS, tvOS, and MacOS lies in the reading of data beyond the allowed range in memory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Important: Red Hat Security Advisory: mod_auth_openidc security update

An update for modauthopenidc is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

CVE-2025-4427 Authentication Bypass

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API...

CVE-2025-4427

CVE-2025-4427 affects Ivanti Endpoint Manager Mobile (EPMM) up to and including version 12.5.0.0 (and earlier). The vulnerability is an authentication bypass in the API component , allowing an attacker to access protected resources without credentials via crafted API requests. Root cause cited in...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

CVE-2025-4427: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API...

iOS SwiftZero CVE-2025-24203 Proof of Concept

SwiftZero is a proof of concept exploit for iOS versions 16.0 through 18.3.2 that performs a protected file overwrite...

CVE-2025-31247

A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system...

GitLab Session Expiration Unauthorized Access

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Online Store Access Control Bypass

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to lack of access control mechanisms. Exploiting these vulnerabilities can allow unauthorized actors to bypass existing security...

Backup & Restore Module Unauthorized Access

The vulnerability of the Backup & Restore module of the Device Admin app for the ctrlX OS operating system is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by...

Apple macOS security vulnerabilities

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that originates from possible access to protected portions of the file system...

Linux kernel fair sched detachtasks buffer overflow DoS

The vulnerability of the detachtasks function in the kernel/sched/fair.c module of the Linux operating system’s resource management subsystem is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibili...

acpi_device_add() Function Heap Buffer Overflow DoS

Vulnerability of the acpideviceadd function in the drivers/acpi/scan.c module – The ACPI support driver for the Linux kernel’s processor is vulnerable to a vulnerability where improper memory release occurs before removing the last reference point memory leak. Exploiting this vulnerability could...

EntireX Error Reporting Unauthorized Access

The vulnerability of the software for integrating old and new IBM EntireX technologies is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

IBM Cloud Pak for Business Automation Disclosure

The vulnerability of the web interface of the IBM Cloud Pak for Business Automation cloud platform relates to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...

XWiki Platform Authentication Bypass

The vulnerability of the “org.xwiki.platform:xwiki-platform-security-authentication-ui” component of the XWiki Platform involves the absence of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

XWiki Platform Unauthorized Access

The vulnerability of the org.xwiki.platform:xwiki-platform-component-wiki component of the XWiki Platform involves the absence of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

IBM Engineering Requirements Management DOORS Registration Information Disclosure

The vulnerability of the IBM Engineering Requirements Management DOORS Next software lies in the insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information remotely...

IBM Maximo Application Suite Unrestricted File Download

The vulnerability of the IBM Maximo Application Suite, a platform for managing corporate assets based on artificial intelligence, lies in its ability to allow unlimited uploading of sensitive files. Exploiting this vulnerability could enable an attacker operating remotely to gain unauthorized...