4244 matches found
Vulnerability fixed in Apple macOS, iOS and iPadOS
Apple has fixed a vulnerability in several Apple operating systems. The vulnerability is in how the systems handle processing malicious image files, which can lead to memory corruption. This problem has been addressed by improved memory limit controls. Apple says it has information that this...
Vulnerabilities fixed in Microsoft Exchange Server
Microsoft has fixed vulnerabilities in Microsoft Exchange Server. The vulnerabilities in Microsoft Exchange Server result from improper input validation and the improper handling of special elements, which allow unauthorized attackers to manipulate data and forge communications. This can lead to...
Vulnerability fixed in Microsoft Exchange
Microsoft has fixed a vulnerability in Microsoft Exchange Server hybrid deployments. The vulnerability allows a user with administrative privileges on an on-premises Microsoft Exchange server to elevate privileges to the cloud. Microsoft has released a Hot Fix to fix the vulnerability. See attach...
Vulnerabilities fixed in Microsoft SQL Server
Microsoft has fixed vulnerabilities in SQL Server. A malicious party could exploit the vulnerabilities to execute arbitrary code or gain access to sensitive data. Of the vulnerability with reference CVE-2025-49719, Microsoft says it has information that it has the attention of researchers on clos...
Vulnerability fixed in Commvault Command Center
Commvault has fixed a vulnerability in Command Center. The vulnerability can be exploited by an unauthenticated remote malicious person to execute arbitrary code. This requires sending a specially crafted http request to the vulnerable application containing a reference to a rogue zip file. The...
Vulnerabilities fixed in Apple macOS, iOS and iPadOS
Apple has fixed vulnerabilities in macOS, iOS and iPadOS. A malicious party could exploit the vulnerabilities to execute arbitrary code with user privileges, potentially gaining access to sensitive data. Apple reports having information that the vulnerabilities have been limited and highly target...
Vulnerabilities fixed in Oracle Java
Oracle has fixed vulnerabilities in Oracle Java SE and GraalVM Specifically for versions 17.0.14, 21.0.6, 21.0.6 and 24. The vulnerabilities in Oracle Java SE and GraalVM allow unauthenticated malicious actors with network access to manipulate or access critical data. This can lead to unauthorize...
Vulnerability fixed in Microsoft Dynamics
Microsoft has fixed a vulnerability in Dynamics. A vulnerability marked CVE-2025-29821, from incorrect input validation in Dynamics Business Central, allowed a malicious party to gain access to sensitive data. If successfully exploited, the malicious party can recover passwords in unencrypted tex...
Vulnerability fixed in Apple iOS, iPadOS, macOS Sequoia, visionOS and Safari
Apple has fixed a vulnerability in Apple iOS, iPadOS, macOS Sequoia, visionOS and Safari. The vulnerability with reference CVE-2025-24201 lies in the way Apple manages its operating systems. This includes an out-of-bounds write problem that can allow unauthorized actions. Apple has released updat...
Vulnerabilities fixed in VMware products
Broadcom has fixed vulnerabilities in VMware ESXi including Workstation and Fusion. The vulnerabilities include a TOCTOU vulnerability that allows a malicious person with local administrative privileges to execute code as the VMX process on the host via an out-of-bounds write. In addition, there ...
Vulnerability fixed in Exim
Exim's developers have fixed an SQL injection vulnerability. A malicious party could exploit the vulnerability to execute an SQL injection. This allows the malicious party to gain access to sensitive data and potentially execute arbitrary code with privileges from the Exim installation. The exim...
Vulnerabilities fixed in Microsoft Azure
Microsoft has fixed vulnerabilities in Azure Network Watcher and the HPC Linux Node Agent. A malicious person could grant themselves elevated privileges by exploiting the vulnerability with attribute CVE-2025-21188 in the Network Watcher, or to execute arbitrary code by exploiting the vulnerabili...
Vulnerabilities fixed in Mozilla Firefox and Thunderbird
Mozilla has fixed vulnerabilities in Firefox and Thunderbird Specifically for versions below 135 and 128.7. The vulnerabilities include a double-free vulnerability, use-after-free conditions, and race conditions that can lead to memory damage, unauthorized access, and privacy risks. Malicious...
Vulnerabilities fixed in Ivanti Cloud Security Appliance
Ivanti has fixed vulnerabilities in the Cloud Security Appliance CSA for versions prior to 5.0.3. The vulnerabilities are located in the admin web console of the Ivanti Cloud Security Appliance. The first vulnerability involves an authentication bypass, allowing remote unauthenticated attackers t...
Vulnerabilities fixed in Drupal Core
Drupal has fixed vulnerabilities in Drupal Core Specifically for versions 7.0 to 7.102, 8.0.0 to before 10.2.11, 10.3.0 to before 10.3.9, and 11.0.0 to before 11.0.8. The vulnerabilities in Drupal Core are related to privilege escalation and deserialization of untrusted data, which can lead to...
Vulnerability fixed in Microsoft Exchange Server
Microsoft has fixed a vulnerability in Exchange Server. The vulnerability is in the way Exchange Server handles P2 FROM headers that do not conform to RFC. A malicious party could exploit the vulnerability to impersonate another user and send emails in the victim's name. Although the server itsel...
Vulnerabilities fixed in SolarWinds Serv-U
SolarWinds has fixed vulnerabilities in Serv-U. A malicious party can exploit the vulnerability with reference CVE-2024-45711 to execute arbitrary code on the underlying system via path-traversal. Successful exploitation requires the malicious party to be authenticated beforehand, and code...
Vulnerability fixed in Mozilla Firefox
Mozilla has fixed a vulnerability in Firefox. A malicious party could exploit the vulnerability to execute arbitrary code. According to Mozilla, there have been signs of active misuse. Mozilla has released updates to fix the vulnerabilities in Firefox 131.0, Firefox ESR 115.16 and 128.3. For more...
Vulnerabilities fixed in Mozilla Firefox and Thunderbird
Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party could exploit the vulnerabilities to bypass security measures in the victim's context and potentially execute arbitrary code or access sensitive data in the browser context. Mozilla has released updates to fix the...
Vulnerabilities discovered in CUPS
Recently, a researcher discovered a number of vulnerabilities in CUPS that could lead to Remote Code Execution. These have been disclosed as "9.9 RCE affecting all GNU/Unix systems." Through a concatenation of the four vulnerabilities, a malicious person can execute arbitrary code within the...
Vulnerabilities fixed in Ivanti Cloud Services Appliance
Ivanti has fixed vulnerabilities in Cloud Services Appliance v 4.6. A malicious party could exploit the vulnerabilities to execute a command-injection via path-traversal, allowing the system to be operated and possibly taken over without prior authentication. Ivanti says it has information that t...
Vulnerability fixed in Ivanti Virtual Traffic Manager
Ivanti has fixed a vulnerability in Virtual Traffic Manager. A malicious person could exploit the vulnerability to bypass authentication on the management interface and create an adminiatrator account, which could be used to take over the system completely. For successful abuse, the malicious par...
Vulnerability fixed in Asterisk
A vulnerability has been fixed in Asterisk. A malicious person could exploit the vulnerability to grant themselves elevated privileges and execute arbitrary code with application privileges. For successful abuse, the malicious party must have prior authentication. The researcher who discovered th...
Vulnerabilities fixed in RoundCube Webmail
Vulnerabilities have been fixed in RoundCube Webmail. A malicious party could exploit the vulnerabilities to launch a Cross-Site Scripting attack. Such an attack could lead to execution of arbitrary code in the victim's browser, or access to sensitive data in the context of the victim's browser...
Vulnerabilities fixed in Mozilla Firefox and Thunderbird
Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party could exploit the vulnerabilities to bypass security measures in the victim's context and potentially execute arbitrary code or access sensitive data in the browser context. Successful exploitation requires the...
Vulnerability fixed in Google Chrome
Google has fixed a vulnerability in Chrome. A malicious party could exploit the vulnerability to cause a buffer overflow and thereby potentially execute arbitrary code with privileges of the victim, or possibly gain access to sensitive data in the context of the browser. Google states that it is...
Vulnerability fixed in Microsoft SQL Server
Microsoft has fixed a vulnerability in SQL Server. The vulnerability is located in the Power BI Client JavaScript SDK and allows a malicious party to gain access to sensitive data. Successful exploitation requires the malicious party to trick the deceive the victim into visiting a page with...
Vulnerability fixed in Google Chrome
Google has fixed a vulnerability in Chrome. The vulnerability is located in the Visuals component, and a malicious party can exploit the exploit the vulnerability to execute arbitrary code in the context of the browser, or to cause a Denial-of-Service DoS cause. Google reports being aware that...
Vulnerabilities fixed in Mozilla Firefox, Firefox ESR and Thunderbird
Mozilla has fixed vulnerabilities in Firefox, Firefox ESR and Thunderbird. A malicious party could potentially exploit the vulnerabilities to execute attacks that could result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User...
Vulnerabilities fixed in IBM Websphere Application Server
Vulnerabilities have been fixed in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty.The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Server Side Request Forgery SSRF. Access to sensitive data IBM has releas...
Vulnerability fixed in node.js
A vulnerability has been fixed in node.js. A malicious party can exploit the vulnerability to use a command-injection to execute arbitrary code on the system with permissions of the application running in the vulnerable node.js. The developers of node.js have released updates to fix the...
Vulnerability fixed in pgAdmin
A vulnerability has been fixed in pgAdmin. A malicious party can exploit the vulnerability to execute arbitrary code on the underlying system. For successful abuse, the malicious party must have prior authentication on the vulnerable pgAdmin installation. The developers of pgAdmin have released...
Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure Gateways
Ivanti has fixed vulnerabilities in Ivanti Connect Secure and Policy Secure. The vulnerabilities allow an unauthenticated malicious party able to remotely perform a Denial of Service execution. For CVE-2024-21894, Ivanti indicates that in certain circumstances could potentially lead to the...
Vulnerabilities fixed in IBM DB2
IBM has fixed vulnerabilities in DB2. A malicious party could exploit the exploit the vulnerabilities to cause a denial-of-service, or to gain access to sensitive data. IBM has released updates to fix the vulnerabilities in IBM DB2. For more information, see:...
Vulnerabilities fixed in Mozilla Firefox, Firefox ESR and Thunderbird
Mozilla has fixed vulnerabilities in Firefox, Firefox ESR and Thunderbird. A malicious party could potentially exploit the vulnerabilities to execute attacks that could result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User...
Vulnerability fixed in Mozilla Thunderbird
Mozilla has fixed a vulnerability in Thunderbird. Due to an flaw in the processing of email messages in the local cache, the encrypted data, such as the subject line, from email messages could be included in other email messages. When the user replies to such such an infected email message, for...
Vulnerabilities fixed in Cisco Nexus
Cisco has fixed vulnerabilities in NX-OS, as in use on various Nexus platforms. A malicious party could exploit them to bypass security measures to allow allow unauthorized network traffic to pass through, or to cause a denial-of-service attack. Cisco has released updates to fix the vulnerabiliti...
Vulnerability fixed in Eclipse Jetty
A vulnerability has been fixed in Jetty. A malicious person at remote can exploit the vulnerability to cause a denial-of-service DoS attack. Eclipse has released updates to fix the vulnerability in Eclipse Jetty. For more information, see: https://eclipse.dev/jetty/download.php...
Vulnerability fixed in Progress Kemp LoadMaster
Progress Kemp has fixed a vulnerability in LoadMaster. The vulnerability allows a malicious party to use specially API calls to issue system commands without being authorized. being authorized to do so. For successful exploitation, the malicious party must have access to the management interface...
Vulnerabilities fixed in Mozilla Firefox, Firefox ESR and Thunderbird
Mozilla has fixed vulnerabilities in Firefox, Firefox ESR and Thunderbird. A malicious party could potentially exploit the vulnerabilities to execute attacks that could result in the following categories of damage: Remote code execution User Rights Spoofing Increased user privileges Access to...
Vulnerabilities fixed in ConnectWise ScreenConnect
Connectwise has fixed vulnerabilities in ScreenConnect. A unauthenticated malicious person could exploit the vulnerabilities to create a new administrator account. An exploit is available that makes the chance of exploitation significant. At this no CVEs have yet been assigned to the...
Vulnerabilities fixed in IBM WebSphere Application Server
IBM has fixed vulnerabilities in WebSphere. The vulnerabilities are located in the Java component of WebSphere and allow a malicious party to carry out attacks that could lead to loss of data integrity and confidentiality. IBM did not release any other detailed information. A more precise risk...
Vulnerabilities fixed in Scheider Electric EcoStruxture and Modicon
Schneider Electric has fixed vulnerabilities in EcoStruxture and Modicon systems. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or to bypass security measures, allowing the malicious party to affect the operation of PLC components. For successful misuse, the...
Vulnerabilities fixed in Microsoft .NET
Microsoft has fixed vulnerabilities in .NET. A malicious person could exploit the vulnerabilities to cause a denial-of-service cause. Microsoft has made updates available that fix the described vulnerabilities described. We recommend that you install these updates. install. More information about...
Vulnerability fixed in Microsoft Exchange
Microsoft has fixed a vulnerability in Exchange Server. A malicious party could exploit the vulnerability to use a previously stolen NTLM hash to gain access to the account and the data of the victim. Successful exploitation thus requires a previous successful attack on a client that uses NTLM...
Vulnerability fixed in Ivanti Connect Secure and Policy Secure Gateways
Ivanti has fixed a vulnerability in Ivanti Connect Secure, Policy Secure and ZTA gateway. The vulnerability allows a malicious party to use an XML External Entity attack to gain access to system resources without having the required authentication. The vulnerability was discovered during the...
Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways
Mitigation measures are available for two vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure Gateways that are being are being actively exploited. The vulnerability with attribute CVE-2023-46805 enables an unauthenticated remote malicious person to bypass authentication. The...
Vulnerability fixed in Microsoft SQL Server
Microsoft has fixed a vulnerability in SQL Server. A malicious party can exploit the vulnerability to use a Man-in-the-Middle attack to intercept and decrypt, potentially gaining access to the sensitive data in that traffic. Abuse is not easily accomplished and requires the malicious party is in...
Vulnerabilities fixed in Mozilla Firefox and Thunderbird
Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS; Circumvention of security measure; Remote code execution User Rights;...
Vulnerability fixed in OpenSSH
A vulnerability has been fixed in OpenSSH. A malicious party could potentially use a Man-in-the-Middle attack to weaken the connection between a client and server and thus gain access to the data transmitted over this connection. This Man-in-the-Middle attack has been given the name "Terrapin...