B&R Automation Runtime security vulnerabilities

B&R Automation Runtime is an automation runtime from B&R Automation. A security vulnerability exists in B&R Automation Runtime versions prior to 6.4, which stems from the presence of reflective cross-site scripting in System Diagnostics Manager that could lead to the execution of arbitrary...

PT-2025-41208

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.5.3 Deno versions prior to 2.2.15 Description Deno is a JavaScript, TypeScript, and WebAssembly runtime. The Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync functions are not limited by the...

CVE-2025-3448: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting XSS vulnerabilities exist in System Diagnostics Manager SDM of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

CVE-2025-3450: Improper Resource Locking

An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions...

CVE-2025-3449: Generation of Predictable Numbers or Identifiers

A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions...

PT-2025-41146

Name of the Vulnerable Software and Affected Versions B&R Industrial Automation Automation Runtime versions 6.0 through 6.3, before Q4.93 Description An improper resource locking issue exists in B&R Industrial Automation Automation Runtime. This can lead to a denial-of-service DoS condition. The...

PT-2025-41145

Name of the Vulnerable Software and Affected Versions B Industrial Automation Automation Runtime versions 6.0 through 6.4 Description A flaw exists in the generation of numbers or identifiers within B Industrial Automation Automation Runtime. This issue could potentially compromise the security o...

B&R Automation Runtime security vulnerabilities

B&R Automation Runtime is an automation runtime from B&R Automation. A security vulnerability exists in B&R Automation Runtime versions prior to 6.4 that stems from the SDM component's generation of predictable numbers or identifiers, which could lead to an unauthenticated cyber attacker taking...

B&R Automation Runtime security vulnerabilities

B&R Automation Runtime is an automation runtime from B&R Automation. A security vulnerability exists in B&R Automation Runtime versions prior to 6.3 and prior to Q4.93 that stems from improper resource locking of the SDM component, which could lead to a denial of service...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986340)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986340 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hwparams and hwfree calls Currently we have neither proper...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987339)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987339 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986767 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/ioremap: Map EFI-reserved memory as encrypted for SEV Some drivers require memory that is...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986366)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986366 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tomcat (UTSA-2025-986105)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986105 advisory. Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This wa...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986441)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986441 advisory. In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: avoid null dereference in deinit If venusprobe fails at pmruntimeputsync the...

Unity Linux 20.1070e Security Update: flatpak (UTSA-2025-680646)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680646 advisory. Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986392)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986392 advisory. In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-987282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987282 advisory. In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have...

CVE-2025-59489

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be...

EUVD-2025-32545

In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the loss of integrity and confidentiality...