Archive
12 February 2025
Vulnerabilities first published on this day (UTC), newest first.
88 results · Clear filters · Feed
-
High 7.4
Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may a…
-
High 7.2
Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged use…
-
High 7.5
Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a …
-
High 7.5
Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a pri…
-
High 7.5
Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged use…
-
High 7.9
Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a …
-
High 7.4
NULL pointer dereference in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 2…
-
High 7.9
NULL pointer dereference for some Intel(R) MLC software before version v3.11b may allow an authenticated user to potent…
-
High 7.8
Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authen…
-
High 7.3
Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) …
-
High 8.2
Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(…
-
High 7.5
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enab…
-
High 7.5
Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged us…
-
High 7.5
Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to…
-
High 7.5
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enab…
-
High 8.2
Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enab…
-
High 7.7
Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authen…
-
High 7.5
Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potential…
-
High 7.5
Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 m…
-
High 8.2
Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potenti…
-
High 8.8
Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escala…
-
High 7.8
Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated u…
-
High 7.5
PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig Plugin
A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands.…
-
High 7.8
An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devi…
-
High 7.1
Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace
Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.
-
High 8.1
CrowdStrike Falcon Sensor for Linux TLS Issue
CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Control…
-
High 7.5
parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memory
parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per o…
-
High 8.2CVE-2025-25205 Public exploit
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers ca…
-
High 7.5
BCryptGenerateSymmetricKey memory leak
go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to `cng.TLS1PRF` don't release the key handle, producing a small memory leak every time. Commit f4…
-
High 7.1CVE-2025-25198 Public exploit
mailcow: dockerized vulnerable to password reset poisoning
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointin…
-
High 7.1
Telerik Document Processing RTF Export of Arbitrary File Path
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.
-
High 8.3
Telerik Document Processing Path Traversal
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.
-
High 7.8
Progress UI for WinForms decompression path traversal vulnerability
In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory.
-
High 8.8
Telerik Report Server Clear Text Transmission of Agent Commands
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunne…
-
High 7.8
Improper neutralization special element in hyperlinks
In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink elements.
-
High 8.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.
-
High 8.8
Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or …
-
High 7.8
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag: depending on that flag, the pages in the address space …
-
High 7.1
Revert "libfs: fix infinite directory reads for offset dir"
In the Linux kernel, the following vulnerability has been resolved: Revert "libfs: fix infinite directory reads for offset dir" The current directory offset allocator (based on mtree_alloc_cyclic) stores the next offset value to return in octx->next_offset. T…
-
High 8.8
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0…