PT-2025-16388 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 122.0.6261.132 Description: The issue is related to an Out-Of-Bounds Write in the TPM2 Reference Library, allowing an attacker with root access to gain persistence and bypass operating system verification. This is...

PT-2025-16371 · Nmap +1 · Nmap +3

Name of the Vulnerable Software and Affected Versions: Extron SMP 111 versions 3.01 and earlier Extron SMP 351 versions 2.16 and earlier Extron SMP 352 versions 2.16 and earlier Description: A command injection issue in the Nmap diagnostic tool within the admin web console allows a remote...

PT-2025-16386 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 122.0.6261.132 Description: The issue is related to an Out-Of-Bounds Write in the TPM2 Reference Library, allowing an attacker with root access to gain persistence and bypass operating system verification. This is...

The vulnerability of the command-line interface (CLI) of Cisco IOS XR operating systems allows a hacker to elevate their privileges to the root level and execute arbitrary commands.

The vulnerability of the command-line interface CLI of Cisco IOS XR operating systems exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level and execute arbitrary commands...

PT-2025-36: Local Privilege Escalation (LPE) in Amnezia VPN

The vulnerability was identified in Amnezia VPN, versions to 4.8.6.0, on MacOS. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 12.04.2025 Recommendations: Update to...

CVE-2024-13861

A code injection vulnerability in the Debian package component of Taegis Endpoint Agent Linux versions older than 1.3.10 allows local users arbitrary code execution as root. Redhat-based systems using RPM packages are not affected...

CVE-2024-13861

CVE-2024-13861 affects Taegis Endpoint Agent (Linux) specifically the Debian package component, with versions older than 1.3.10 vulnerable to local code execution as root due to a code-injection issue. Redhat-based RPM deployments are not affected. Remediation: update Debian-based installations t...

CVE-2025-0127

CVE-2025-0127 concerns Palo Alto Networks PAN-OS VM-Series. Affected component: PAN-OS software on VM-Series appliances. Issue: an authenticated administrator can bypass restrictions and run arbitrary commands as root via a command-injection vulnerability. Impact described as high, including full...

PT-2025-16113 · Debian +1 · Debian +1

Name of the Vulnerable Software and Affected Versions: Taegis Endpoint Agent Linux versions prior to 1.3.10 Description: A code injection issue in the Debian package component allows local users to execute arbitrary code as root. This issue does not affect Redhat-based systems that use RPM...

Secureworks Taegis Endpoint Agent 安全漏洞

Secureworks Taegis Endpoint Agent is a security platform from US-based Secureworks. A security vulnerability exists in Secureworks Taegis Endpoint Agent versions prior to 1.3.10, which stems from a code injection that could cause a local user to execute arbitrary code with root privileges...

CVE-2025-23386

A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before 2.5.0-1.1...

CVE-2025-3364

The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access the entire file system...

openSUSE Tumbleweed 安全漏洞

openSUSE Tumbleweed is a desktop and server operating system from openSUSE Germany. A security vulnerability exists in openSUSE Tumbleweed versions prior to 2.5.0-1.1, which stems from an incorrect default privilege that could cause a service user to elevate to root privileges...

(Pwn2Own) Synology BeeStation BST150-4T Cleartext Transmission of Sensitive Information Vulnerability

This vulnerability allows network-adjacent attackers to spoof specific configuration values on affected installations of Synology BeeStation BST150-4T devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of configuration informatio...

CVE-2025-20936

Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root...

CVE-2025-20936

CVE-2025-20936 concerns improper access control in the HDCP trustlet, affecting Samsung mobile devices prior to SMR Apr-2025 Release 1. The root cause is local privilege escalation to root via shell privileges. Impact is high (local, high confidentiality/integrity/availability impact) per cited C...

CVE-2025-20936

Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root...

Siemens SENTRON 7KT PAC1260 Data Manager 操作系统命令注入漏洞

Siemens SENTRON 7KT PAC1260 Data Manager is a device for power monitoring and energy management from Siemens Germany. The Siemens SENTRON 7KT PAC1260 Data Manager suffers from an OS command injection vulnerability that stems from not cleaning up the region parameter of a specific POST request,...

Siemens SENTRON 7KT PAC1260 Data Manager 操作系统命令注入漏洞

Siemens SENTRON 7KT PAC1260 Data Manager is a device for power monitoring and energy management from Siemens Germany. The Siemens SENTRON 7KT PAC1260 Data Manager suffers from an OS command injection vulnerability that stems from not cleaning up the input parameter of a specific GET request, whic...

Siemens SENTRON 7KT PAC1260 Data Manager 操作系统命令注入漏洞

Siemens SENTRON 7KT PAC1260 Data Manager is a device for power monitoring and energy management from Siemens Germany. The Siemens SENTRON 7KT PAC1260 Data Manager suffers from an OS command injection vulnerability that stems from not cleaning up the language parameter of a specific POST request,...