Threat database

CVE-2025-21590 is an improper isolation or compartmentalization vulnerability in Juniper Junos OS that allows a local attacker with high privileges to inject arbitrary code. The vulnerability affects multiple versions of Junos OS prior to specific fixed releases. It has a medium severity score and has been exploited in the wild. A fix is available in the specified patched versions.

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVE-2025-24983 is a use-after-free vulnerability in the Microsoft Windows Win32 Kernel Subsystem that allows a local authorized attacker to elevate privileges. This vulnerability has been exploited in the wild and is rated with a high severity score of 7. The vulnerability requires high attack complexity and low privileges but no user interaction. It impacts confidentiality, integrity, and availability with high impact. No specific affected Windows versions or patch information is provided in the available data.

CVE-2025-26633 is a high-severity vulnerability in Microsoft Windows Management Console (MMC) that allows a local unauthorized attacker to bypass a security feature. The vulnerability involves improper neutralization, leading to potential full compromise of confidentiality, integrity, and availability. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

A heap-based buffer overflow vulnerability exists in Microsoft Windows NTFS that allows local unauthorized attackers to execute code. This vulnerability has been exploited in the wild and carries a high severity rating.

CVE-2025-24984 is a medium severity information disclosure vulnerability in Microsoft Windows NTFS. It involves insertion of sensitive information into log files, allowing an unauthorized attacker with physical access to potentially read portions of heap memory. The vulnerability affects multiple Windows 10 and Windows Server versions prior to specific fixed releases. Exploitation does not require user interaction but requires physical access. A fix is available in the listed updated versions.

CVE-2025-24985 is an integer overflow vulnerability in the Microsoft Windows Fast FAT File System Driver that allows local attackers to execute code. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. It requires local access with low privileges and user interaction. No specific affected versions or patch information is provided.

CVE-2025-24991 is an out-of-bounds read vulnerability in the Microsoft Windows NTFS file system. It allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability affects multiple Windows versions prior to specific fixed releases. It has been exploited in the wild and is rated with a medium severity score of 5.5.

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

Red Hat has issued a security advisory for a kernel update addressing two vulnerabilities in the Linux kernel. The first vulnerability (CVE-2024-50302) involves the HID core where the report buffer was not zero-initialized, potentially leading to security issues. The second vulnerability (CVE-2024-53197) affects the ALSA usb-audio driver, fixing potential out-of-bound accesses for Extigy and Mbox devices. These issues affect Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The update requires a system reboot to take effect.

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.