8377 matches found
podman: podman missing TLS verification
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...
Security Filter Bypass
github.com/lxc/incus is vulnerable to security filter bypass. The vulnerability is due to incorrect generation of nftables rules when applying ACLs on devices connected to a bridge, which allows ARP spoofing and full spoofing of another VM/container on the same bridge...
podman -- TLS connection used to pull VM images was not validated
RedHat, Inc. reports: A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...
CVE-2025-46707
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU...
CVE-2025-46708
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU...
CLSA-2025-1751133361 open-vm-tools: Fix of CVE-2025-22247
CVE-2025-22247: prevent usage of illegal characters in user names and file paths...
CVE-2025-46707
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU...
CVE-2025-46708
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU...
CVE-2025-46708 GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU...
CVE-2025-46708 GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU...
CVE-2025-46708
CVE-2025-46708 affects Imagination Technologies PowerVR-GPU driver. The issue arises when software inside a Guest VM makes improper GPU system calls, delaying or blocking the GPU for other guests and preventing them from processing workloads. The vulnerability is described as enabling guest VMs t...
CVE-2025-46707
CVE-2025-46707 concerns Imagination Technologies graphics stack (PowerVR-GPU) where software in a Guest VM can override the firmware state and gain access to the GPU. The base CVSS shows it is a local issue with low privileges and no user interaction, scoped to change in confidentiality/integrity...
CVE-2025-46707 GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU...
PT-2025-27244 · Imagination Technologies · Graphics Ddk
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU. Recommendations: At the moment, there is no information about a newer version that...
PT-2025-27245 · Imagination Technologies · Graphics Ddk
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU. Recommendations: At the moment, there is no...
Podman Improper Certificate Validation; machine missing TLS verification
Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry which it does by default since 5.0.0 allowing a possible Man In The Middle attack. Patches...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the machine init process. An attacker can intercept or manipulate data in transit by performing a man-in-the-middle attack during the download of VM images from an OCI registry. Workaround This...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the machine init process. An attacker can intercept or manipulate data in transit by performing a man-in-the-middle attack during the download of VM images from an OCI registry. Workaround This...
GHSA-65GG-3W2W-HR4H Podman Improper Certificate Validation; machine missing TLS verification
Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry which it does by default since 5.0.0 allowing a possible Man In The Middle attack. Patches...