CISA Adds Five Actively Exploited Vulnerabilities in Advantive VeraCore and Ivanti EPM to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added five security flaws impacting Advantive VeraCore and Ivanti Endpoint Manager EPM to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation in the wild. The list of vulnerabilities is ...

PT-2025-20519

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the error path in xe migrate clear, where the code waits on m-fence, which could be the local fence, but th...

Ashlar-Vellum Cobalt 输入验证错误漏洞

Ashlar-Vellum Cobalt is a parameter-based computer-aided design and 3D modeling program from Ashlar-Vellum. An input validation error vulnerability exists in Ashlar-Vellum Cobalt that stems from an integer overflow when parsing an XE file, which could lead to remote code execution...

The vulnerability of the Simple Network Management Protocol (SNMP) implementation in Cisco IOS, Cisco IOS XR, and Cisco IOS XE operating systems allows a attacker to trigger a service failure.

The vulnerability of the Simple Network Management Protocol SNMP implementation in Cisco IOS, Cisco IOS XR, and Cisco IOS XE operating systems is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service...

SUSE CVE-2024-49570

In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TPprintk UAF The commit afd2627f727b "tracing: Check "%s" dereference via the field and not the TPprintk format" exposes potential UAFs in the xebomove trace event. Fix those by avoiding...

DEBIAN-CVE-2024-49570

In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TPprintk UAF The commit afd2627f727b "tracing: Check "%s" dereference via the field and not the TPprintk format" exposes potential UAFs in the xebomove trace event. Fix those by avoiding...

PT-2025-13217

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the handling of EFAULT errors in the Linux kernel, specifically in the drm/xe/userptr module. Currently, EFAULT errors from hmm range fault are treated as non-fat...

Cisco IOS XE Software Intermediate System to Intermediate System DoS (cisco-sa-isis-sGjyOUHX)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Intermediate System-to-Intermediate System IS-IS protocol of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of...

XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells

Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore, to drop reverse shells and web shells, and maintain persistent remote access to compromised systems. The zero-day exploitation o...

CVE-2024-57074

A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2025-20170

A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this...

Cisco IOS XE Software SNMP DoS (cisco-sa-snmp-dos-sdxnSUcW)

According to its self-reported version, Cisco IOS-XE Software is affected by multiple vulnerabilities. - A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix notifier vs folio deadlock User is reporting what smells like notifier vs folio deadlock, where migratepagesbatch on core kernel side is holding folio locks and then interacting with the mappings of it, howeve...

CVE-2024-57074

A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

Prototype Pollution

Overview org.webjars.npm:xe-utils is a JavaScript 函数库、工具类 Affected versions of this package are vulnerable to Prototype Pollution through the merge function. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into...

CVE-2019-1904

A vulnerability in the web-based UI web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacke...

CVE-2025-20175

A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this...

CVE-2025-20176

A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this...

CVE-2025-20172

A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper error handling when parsing SNMP requests. An attacker...

CVE-2025-20173

The CVE-2025-20173 issue concerns Cisco IOS/IOS XE/IOS XR SNMP handling. The SNMP subsystem fails to handle certain requests due to improper error handling, enabling an authenticated remote attacker to trigger a denial of service. Affected are SNMP versions 1, 2c, and 3; exploitation requires a v...