Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Jenkins contains a remote code execution vulnerability identified as CVE-2017-1000353. The flaw allows attackers to send a serialized Java SignedObject to the Jenkins CLI remoting interface, which is then deserialized using a new ObjectInputStream. This process bypasses the existing blocklist-based protection, enabling remote code execution. The vulnerability has been exploited in the wild.
Smartbedded Meteobridge contains a command injection vulnerability (CVE-2025-4008) that allows remote unauthenticated attackers to execute arbitrary commands with root privileges. The vulnerability has a high severity score of 8.7 and is known to be exploited in the wild. No affected versions or patch information are currently provided.
GNU Bash contains an OS command injection vulnerability (CVE-2014-6278) that allows remote attackers to execute arbitrary commands via a crafted environment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
Juniper ScreenOS has an improper authentication vulnerability (CVE-2015-7755) that allows unauthorized remote administrative access to affected devices. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Adminer contains a server-side request forgery (SSRF) vulnerability that allows a remote attacker to obtain potentially sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:
An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials.
An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device.
An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks.
This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
Note: This vulnerability affects all versions of SNMP.
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5.a fix has been released in 5.5.7.
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2025-10585 is a high-severity type confusion vulnerability in the Google Chromium V8 JavaScript and WebAssembly engine. This flaw allows an attacker to cause type confusion, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory.
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
CVE-2025-20333 is a critical buffer overflow vulnerability in the VPN web server component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. It allows an authenticated remote attacker with valid VPN credentials to send crafted HTTP(S) requests that can lead to arbitrary code execution as root. Successful exploitation could result in full compromise of the affected device. The vulnerability arises from improper validation of user-supplied input in HTTP(S) requests. The CVSS v3.1 base score is 9.9, indicating critical severity. Multiple specific 9.8.x and 9.8.3.x versions are affected. Exploits are known to be in the wild. No patch information is provided in the input data.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.
This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.
Both products have reached the status of EOL (end-of-life).
It's recommending to
purchase the new
product to ensure better performance and security. If replacement is not
an option in the short term, please use the second reference link to
download and install the patch(es).