When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update.
Fax modem hardware dependent on this specific driver will no longer work on Windows.
Microsoft recommends removing any existing dependencies on this hardware.
SKYSEA Client View suffers from an improper authentication vulnerability that enables remote code execution through a flaw in how authentication is processed on the TCP connection with the management console. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided.
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2025-11371 is an unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox. It affects all versions up to and including 16.7.10368.56560. This flaw allows attackers to disclose system files without authentication. Exploitation has been observed in the wild. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2021-43798 is a path traversal vulnerability in Grafana that allows unauthorized access to local files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.
Security Fix(es):
* open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2010-3765 is a critical heap buffer overflow vulnerability affecting multiple Mozilla products including Firefox, SeaMonkey, and Thunderbird. The flaw involves memory corruption triggered by JavaScript operations related to nsCSSFrameConstructor::ContentAppended, appendChild method, and frame creation. It allows remote attackers to execute arbitrary code when JavaScript is enabled. The vulnerability was actively exploited in the wild and was fixed in Firefox 3.5.15, 3.6.12, SeaMonkey 2.0.10, and Thunderbird 3.0.10 and 3.1.6.
CVE-2013-3918 is an out-of-bounds write vulnerability in the Microsoft Windows InformationCardSigninHelper Class ActiveX control (icardie.dll). An attacker can exploit this by crafting a malicious webpage that, when viewed by a user, may allow remote code execution with the same privileges as the current user. The affected Windows product may be end-of-life or end-of-service, and users are advised to discontinue its use.
CVE-2021-22555 is a heap out-of-bounds write vulnerability in the Linux Kernel that can be exploited by an attacker to gain elevated privileges or cause a denial of service through heap memory corruption. The vulnerability arises from improper handling of user namespace operations. It has been observed to be exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2011-3402 is a high-severity remote code execution vulnerability in the Microsoft Windows kernel, specifically in the TrueType font parsing engine within win32k.sys. This flaw allows remote attackers to execute arbitrary code by delivering crafted font data embedded in Word documents or web pages. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2021-43226 is a privilege escalation vulnerability in the Microsoft Windows Common Log File System Driver. It allows a local attacker with some privileges to bypass certain security mechanisms, potentially leading to elevated privileges. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow remote code execution. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. Exploits for this vulnerability have been observed in the wild.
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Jenkins contains a remote code execution vulnerability identified as CVE-2017-1000353. The flaw allows attackers to send a serialized Java SignedObject to the Jenkins CLI remoting interface, which is then deserialized using a new ObjectInputStream. This process bypasses the existing blocklist-based protection, enabling remote code execution. The vulnerability has been exploited in the wild.
GNU Bash contains an OS command injection vulnerability (CVE-2014-6278) that allows remote attackers to execute arbitrary commands via a crafted environment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
Juniper ScreenOS has an improper authentication vulnerability (CVE-2015-7755) that allows unauthorized remote administrative access to affected devices. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.