**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.
**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
CVE-2025-0994 is a high-severity deserialization vulnerability in Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10. It allows an authenticated user to execute remote code on the Microsoft IIS web server hosting the application. The vulnerability arises from unsafe deserialization of untrusted data. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.
A vulnerability in 7-Zip allows remote attackers to bypass the Mark-of-the-Web security feature, enabling execution of arbitrary code with the current user's privileges. This flaw has been exploited in the wild and is rated as high severity.
Microsoft Outlook contains a critical improper input validation vulnerability that enables remote code execution. This flaw allows attackers to bypass the Office Protected View security feature, causing documents to open directly in editing mode instead of protected mode. The vulnerability has been exploited in the wild, posing a significant risk to users. No specific affected versions or patch information is provided in the available data.
Sophos XG Firewall has a buffer overflow vulnerability in its HTTP/S bookmark feature that enables remote code execution. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.
CyberoamOS (CROS) contains a SQL injection vulnerability in its WebAdmin interface that allows unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability is classified as high severity due to its potential impact on system integrity and confidentiality.
CVE-2022-23748 is a process control vulnerability in the Dante Discovery application, specifically in the mDNSResponder.exe component. This flaw allows a local attacker to perform a DLL sideloading attack, enabling arbitrary code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104)
* kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Microsoft .NET Framework has an information disclosure vulnerability identified as CVE-2024-29059. This flaw exposes the ObjRef URI to attackers, which can lead to remote code execution. The vulnerability has a high severity score of 7.5 and is known to be exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2018-9276 is an OS command injection vulnerability in Paessler PRTG Network Monitor that allows attackers with administrative privileges to execute arbitrary operating system commands via the PRTG System Administrator web console. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Paessler PRTG Network Monitor has a local file inclusion vulnerability (CVE-2018-19410) that enables a remote, unauthenticated attacker to create users with read-write privileges, including administrator access. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.