CVE-2025-22392

Out-of-bounds read in firmware for some IntelR AMT and IntelR Standard Manageability may allow a privileged user to potentially enable information disclosure via network access...

Linux Distros Unpatched Vulnerability : CVE-2017-7495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs- flushing-before-commit list, which allows local users...

Django: SQL Injection when using FilteredRelation

A SQL injection vulnerability was discovered in the Django framework when using the FilteredRelation feature. The vulnerability was located in the tests/filteredrelation/tests.py file. The vulnerability allowed an attacker to inject malicious SQL code through the userdata parameter used in the...

Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

...

CVE-2025-54397

CVE-2025-54397 affects Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25161.02. The issue: sensitive information is inserted into data sent to authenticated users, exposing data during transit. The CVSS v3.1 base score is 4.3 (Medium) with network attack vecto...

ROS-20250806-02

A vulnerability in the modauthopenidc module of the Apache HTTP Server HTTPD web server is related to insufficient user data validation when OIDCPreservePost is enabled in modauthopenidc. Exploitation The vulnerability could allow an attacker acting remotely to cause a denial of service...

GHSA-57Q2-6CP4-9MQ3 XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Impact The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This allows any user to obtain the salted and hashed user accou...

CVE-2025-54593

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code...

A week in security (July 28 – August 3)

Last week on Malwarebytes Labs: Apple ID scam leads to $27,000 in-person theft of Ohio man OpenAI kills "short-lived experiment" where ChatGPT chats could be found on Google Trump Administration and Big Tech want you to share your health data Prison visitor details shared with all inmates at...

CVE-2025-43245

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data...

CVE-2025-43267

An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. An app may be able to access sensitive user data...

CVE-2025-43185

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6. An app may be able to access protected user data...

CVE-2025-43198

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protected user data...

CVE-2025-43206

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data...

CVE-2025-43220

This issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data...

CVE-2025-43246

This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access sensitive user data...

Apple macOS Sequoia has an unspecified vulnerability (CNVD-2025-18406)

Apple macOS Sequoia is an operating system from the American company Apple Apple. Apple macOS Sequoia suffers from a security vulnerability that stems from an insufficient code signature restriction, which can be exploited by an attacker to cause access to private user data...

Apple macOS Sequoia and Apple macOS Sonoma have unspecified vulnerabilities

Apple macOS Sequoia and Apple macOS Sonoma are both operating systems from the American company Apple. Apple macOS Sequoia and Apple macOS Sonoma contain a security vulnerability that can be exploited by attackers to access sensitive user data...

Apple macOS path traversal vulnerability

Apple macOS is a specialized operating system developed by Apple for Mac computers. Apple macOS suffers from a path traversal vulnerability that stems from improper handling of directory paths, which can be exploited by an attacker to gain access to protected user data...

Apple macOS Access Control Error Vulnerability (CNVD-2025-18438)

Apple macOS is a specialized operating system developed by Apple for Mac computers. An access control error vulnerability exists in Apple macOS, which can be exploited by an attacker to access sensitive user data...