CVE-2025-52915

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabli...

CVE-2025-55139

SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote authenticated attacker with admin privileges to enumerate internal...

CVE-2025-55139

SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote authenticated attacker with admin privileges to enumerate internal...

CVE-2025-55139

CVE-2025-55139 is an SSRF issue affecting Ivanti Connect Secure (ICS) prior to 22.7R2.9/22.8R2, Ivanti Policy Secure prior to 22.7R1.6, Ivanti ZTA Gateway prior to 2.8R2.3-723, and Ivanti Neurons for Secure Access prior to 22.8R1.4. The root cause is a server-side request forgery that lets a remo...

HTTP.sys Denial of Service Vulnerability

Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network...

Windows MultiPoint Services Elevation of Privilege Vulnerability

Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally...

Microsoft Windows Internet Information Services 缓冲区错误漏洞

Microsoft Windows Internet Information Services IIS is a Web server from Microsoft Corporation USA for the Windows Server platform. A buffer error vulnerability exists in Microsoft Windows Internet Information Services IIS. An attacker could exploit this vulnerability to cause a denial of service...

PT-2025-36828

Name of the Vulnerable Software and Affected Versions: Windows Internet Information Services affected versions not specified Description: An out-of-bounds read issue exists in Windows Internet Information Services, potentially allowing an unauthorized attacker to cause a denial-of-service conditi...

PT-2025-36858

Name of the Vulnerable Software and Affected Versions: Windows MultiPoint Services affected versions not specified Description: An improper access control issue in Windows MultiPoint Services may allow an attacker to elevate privileges locally. This can allow attackers to affect the system...

Microsoft Xbox Gaming Services 后置链接漏洞

Microsoft Xbox Gaming Services is an Xbox-related gaming service from Microsoft Corporation USA. A backlink vulnerability exists in Microsoft Xbox Gaming Services. An attacker could exploit the vulnerability to elevate privileges...

PT-2025-36845

Name of the Vulnerable Software and Affected Versions: Windows Management Services affected versions not specified Description: A use-after-free issue exists in Windows Management Services that could allow an attacker to gain elevated privileges locally. This vulnerability enables attackers to...

Ivanti多款产品 代码问题漏洞

Ivanti Connect Secure ICS and others are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti ZTA Gateway is a component in a network access software. A code issue...

KLA87443 PE vulnerabuility in Microsoft Apps

An elevation of privilege vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2025-55245 Related products Xbox-Gaming-Services CVE list CVE-2025-55245 critical Solution Install necessary updates from the KB section,...

Microsoft Xbox Gaming Services < 30.104.13001.0 Elevation of Privilege (September 2025)

The version of Microsoft Xbox Gaming Services on the remote Windows host is prior to 30.104.13001.0. It is, therefore, affected by an elevation of privilege vulnerability: - Improper link resolution before file access 'link following' in Xbox allows an authorized attacker to elevate privileges...

KLA87444 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation...

CVE-2025-52915

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabli...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerability in Apache Commons (CVE-2025-48924)

Summary SPSS Collaboration and Deployment Services is affected by vulnerability in Apache Commons CVE-2025-48924. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue...

GO-2025-3925 Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw

Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw...

PT-2025-36649

Versity panic induced by AWS chunked data sent to port in github.com/versity/versitygw...

aws-mcp-server 操作系统命令注入漏洞

aws-mcp-server is a lightweight service by Alexei Ledenev, a personal developer, that enables AI assistants to execute AWS CLI commands in a secure containerized environment via the Model Context Protocol MCP. An operating system command injection vulnerability exists in versions prior to...