CVE-2025-0505 On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state

On Arista CloudVision systems virtual or physical on-premise deployments, Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that...

CVE-2025-0505 On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state

On Arista CloudVision systems virtual or physical on-premise deployments, Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that...

CVE-2025-0505

Arista CloudVision ZTP privilege escalation (CVE-2025-0505) affects on-prem CloudVision Portal/CUE; ZTP can grant admin privileges beyond what’s necessary, enabling querying/manipulation of managed devices. CloudVision as-a-Service is not affected. On-premise CloudVision Portal versions listed in...

PT-2025-20408 · Arista · Arista Cloudvision

Name of the Vulnerable Software and Affected Versions: Arista CloudVision affected versions not specified Description: The issue allows an attacker to gain admin privileges on the CloudVision system using Zero Touch Provisioning, with more permissions than necessary. This can be used to query or...

Microsoft Secures MSA Signing with Azure Confidential VMs Following Storm-0558 Breach

Microsoft on Monday announced that it has moved the Microsoft Account MSA signing service to Azure confidential virtual machines VMs and that it's also in the process of migrating the Entra ID signing service as well. The disclosure comes about seven months after the tech giant said it completed...

CVE-2025-30702

Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Fleet Patching and amp; Provisioning...

Unable to create a new machine catalog using SCVMM

Unable to create new machine catalog with the Microsoft System Center Virtual Machine Manager. This error is seen StudioErrorId : ProvisioningTaskError ErrorCategory : NotSpecified TaskState : FailedToCreateImagePreparationVm TaskStateInformation : Terminated ErrorId :...

CVE-2025-30702

Vulnerability in the Fleet Patching and amp; Provisioning component of Oracle Database Server. Supported versions that are affected are 19.3-19.26. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Fleet Patching and amp; Provisioning...

Oracle Database Server 安全漏洞

Oracle Database Server is a relational database management system from Oracle Corporation USA. This database management system provides data management, distributed processing, and other functions. A security vulnerability exists in Fleet Patching and Provisioning versions 19.3 through 19.26 of...

SUSE CVE-2010-4324

Cross-site scripting XSS vulnerability in the Approval Form in the User Application in the Roles Based Provisioning Module 3.7.0 before 370D in Novell Identity Manager aka IDM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Citrix Provisioning - SoapService errors in the event viewer after installing 2042 CU2

Since installing 2402 CU2 there are multiple errors in the event viewer. The event logged during Citrix PVS Soap Server start: Source: SoapService Event ID: 1 Level: Error Event Data:MapiException: ErrorCodeOtherException An unexpected MAPI error occurred. The event logged every 5 minutes: Source...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-ironic) security update

An update for openstack-ironic is now available for Red Hat OpenStack Platform 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Citrix Director: Infrastructure Monitoring - Incorrect PVS Site Name displayed

Wen admin checks Director Infrastructure Monitoring Provisioning Service; incorrect PVS Site Name maight be displayed in multi-site environemnts. Director displays the same Site Name and Site ID for all servers from the same PVS Farm and different PVS Sites. You cannot select other correct PVS...

be.mogo.iam:mogo-provisioning (=1.0.1.RELEASE), be.personify.iam:personify-frontend (>=1.5.1.RELEASE <=1.5.2.RELEASE) +947 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.1.0 <=6.1.1)

org.springframework.security:spring-security-crypto MAVEN version =6.1.0, =1.5.1.RELEASE, =2.1.0.RELEASE, =1.1.4.2, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.1.0.5, =3.0.6.4, =3.0.6.4, =3.0.6.4, =3.1.1.3 and more Source cves: CVE-2025-22228 Source advisory:...

SUSE CVE-2025-2241

A flaw was found in Hive, a component of Multicluster Engine MCE and Advanced Cluster Management ACM. This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract...

CVE-2025-2241 Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm

A flaw was found in Hive, a component of Multicluster Engine MCE and Advanced Cluster Management ACM. This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract...

CVE-2025-2241 Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm

A flaw was found in Hive, a component of Multicluster Engine MCE and Advanced Cluster Management ACM. This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract...

Authentication Bypass

github.com/fleetdm/fleet is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of SAML authentication assertions, allowing an attacker to forge responses and create unauthorized accounts if Just-In-Time JIT provisioning or MDM enrollment is enabled...

CVE-2025-27509

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...

CVE-2025-27509

fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time JIT provisioning is enabled, or create new...