Bundesamt für Sicherheit in der Informationstechnik vulnerabilities and threats

A cross-site scripting (XSS) vulnerability (CVE-2025-4123) has been identified in Grafana, an open-source analytics and visualization software. The flaw involves custom frontend plugins and an open redirect issue. Red Hat has issued a security advisory with an update that addresses this vulnerability in Red Hat Enterprise Linux 10. Public exploit code is available, but no exploitation in the wild has been reported.

Multiple vulnerabilities have been reported affecting Intel processors, as noted by the Bundesamt für Sicherheit in der Informationstechnik. The provided information is limited, with no specific technical details, affected versions, or direct impact described. The vendor advisory content included relates primarily to Google Cloud and other unrelated vulnerabilities, with no direct mention of patches or mitigations for these Intel processor issues.

Multiple vulnerabilities affecting Intel processors have been reported that could allow information disclosure. The processor is the central computing unit of a computer. The provided vendor advisory content primarily references unrelated Google Cloud Platform security bulletins and does not provide specific remediation or detailed impact information for these Intel processor vulnerabilities.

A vulnerability in the Golang programming language allows information disclosure. The issue affects versions prior to 1.24.3 and version 1.24.3 itself. A fixed version, 1.24.3, is available to address this vulnerability.

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Multiple vulnerabilities have been identified in Grafana, an open-source analytics and visualization software. These issues affect versions prior to 11.6.0+security-01 and the specific 11.6.0+security-01 version. A fixed version 11.6.0+security-01 is available to address these vulnerabilities.

Multiple vulnerabilities in InsydeH2O UEFI BIOS firmware used by Dell systems allow execution of arbitrary code with administrator privileges. These issues affect versions prior to 13.2.3. A fixed version 13.2.3 is available to mitigate these vulnerabilities.

A vulnerability in FFmpeg up to version 7.1 was discovered involving incorrect handling of LPC order calculation, leading to a stack-based buffer overflow. This flaw can cause FFmpeg to crash when processing specially crafted input, resulting in a denial of service. There is also a potential for code execution, although this is not explicitly confirmed. Ubuntu has released patches for various supported releases, with fixes available through standard updates or Ubuntu Pro Extended Security Maintenance (ESM). No known exploits are reported in the wild at this time.

Multiple security vulnerabilities have been identified in Intel microcode affecting various Intel processors. These issues involve improper implementation of finite state machines in hardware logic, improper access restrictions in Intel SGX, and UEFI firmware access control weaknesses. Local privileged or authenticated attackers could exploit these flaws to cause denial of service conditions. Fixes have been released in updated Intel microcode packages for several Ubuntu releases, requiring system updates and reboots to apply.

A vulnerability in Grafana, an open-source analytics and visualization software, allows information disclosure. The issue affects versions up to and including 11.5.0. A fix is available in version 11.5.0.

Multiple vulnerabilities in the Linux kernel have been identified that could allow denial of service conditions. The Linux kernel is the core component of the Linux operating system. No specific affected versions or detailed technical information are provided.

OpenSSL contains a timing side-channel vulnerability in ECDSA signature computations that could allow a remote attacker to recover private data. Additionally, improper handling of memory operations in low-level GF(2^m) elliptic curve APIs with untrusted polynomial values can lead to crashes or potential arbitrary code execution. These issues have been addressed in updated OpenSSL packages provided by Ubuntu.

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Multiple vulnerabilities in the GStreamer multimedia framework can lead to denial of service conditions. GStreamer is a plugin-based architecture used across various platforms. No specific affected versions or detailed technical information are provided.

Multiple vulnerabilities in the Linux kernel have been identified that could allow denial of service conditions. The Linux kernel is the core component of the Linux operating system. No specific affected versions or detailed technical information are provided.

A vulnerability in Grafana allows bypassing security measures. Grafana is an open-source analytics and visualization software. The issue affects versions prior to 11.3.0+security-01 and is fixed in version 11.3.0+security-01.

A vulnerability in Grafana, an open-source analytics and visualization software, allows for code execution. The issue affects versions prior to 11.0.5+security-01 and is fixed in version 11.0.5+security-01. Public exploit code is available via Metasploit, but no exploitation in the wild has been reported.

This entry references multiple vulnerabilities in the Linux kernel related to Broadcom components. The Linux kernel is the core of the Linux operating system. No specific technical details, affected versions, or impact information are provided.

CVE-2024-38796 is an integer overflow vulnerability in the PeCoffLoaderRelocateImage function of the TianoCore EDK2 UEFI firmware implementation. This flaw can lead to a denial of service condition. Red Hat has released security updates addressing this issue in their edk2 packages for various Red Hat Enterprise Linux 9.x versions. The vulnerability affects the UEFI firmware used in virtual machines, specifically in QEMU and KVM environments.

Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen.