Security feed

Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass a…

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass a…

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass a…

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass a…

Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories. CISA required action: Apply updates per vendor instructions.

Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access. CISA required action: Apply updates per vendor instructions.

Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure. CISA required action: Apply updates per vendor instructions.

Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server. CISA required action: Apply updates per vendor instructions.

NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution. CISA required action: Apply updates per vendor instructions.

NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.

A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface. CISA required action: Apply updates per vendor…

VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. CISA required action: Apply updates…

Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution. CISA required action: Apply updates per vendor instructions.

Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution. CISA required action: Apply updates per vendor instructions.

The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application. CISA required action: Apply updates per vendor instructions.

A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. CISA r…

A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory. CISA required action: Apply updates per vendor instructions.

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. CISA required action: Apply updates per vendor instructions.