Mozilla 產品多個漏洞

發佈日期: 2025年05月28日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行程式碼、阻斷服務、繞過保安限制及敏感資料洩露。

 

---

影響

• 資料洩露
• 遠端執行程式碼
• 阻斷服務
• 繞過保安限制

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Thunderbird 128.11
• Thunderbird 139
• Firefox ESR 128.11
• Firefox ESR 115.24
• Firefox 139

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Thunderbird 128.11
• Thunderbird 139
• Firefox ESR 128.11
• Firefox ESR 115.24
• Firefox 139

---

漏洞識別碼

• CVE-2025-5262
• CVE-2025-5263
• CVE-2025-5264
• CVE-2025-5265
• CVE-2025-5266
• CVE-2025-5267
• CVE-2025-5268
• CVE-2025-5269
• CVE-2025-5270
• CVE-2025-5271
• CVE-2025-5272

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-46/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-45/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-44/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-43/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-42/

Mozilla Products Multiple Vulnerabilities

Release Date: 28 May 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Products. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution,  denial of service condition, security restriction bypass and sensitive information disclosure on the targeted system.

---

Impact

• Information Disclosure
• Remote Code Execution
• Denial of Service
• Security Restriction Bypass

---

System / Technologies affected

Versions prior to:

 

• Thunderbird 128.11
• Thunderbird 139
• Firefox ESR 128.11
• Firefox ESR 115.24
• Firefox 139

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Thunderbird 128.11
• Thunderbird 139
• Firefox ESR 128.11
• Firefox ESR 115.24
• Firefox 139

---

Vulnerability Identifier

• CVE-2025-5262
• CVE-2025-5263
• CVE-2025-5264
• CVE-2025-5265
• CVE-2025-5266
• CVE-2025-5267
• CVE-2025-5268
• CVE-2025-5269
• CVE-2025-5270
• CVE-2025-5271
• CVE-2025-5272

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-46/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-45/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-44/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-43/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-42/

Debian Linux 內核多個漏洞

發佈日期: 2025年05月27日

風險: 中度風險

類型: 操作系統 - LINUX

於 Debian Linux 內核發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升及洩露敏感資料。

---

影響

• 權限提升
• 資料洩露
• 阻斷服務

---

受影響之系統或技術

• Debian bookworm 6.1.140-1 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://lists.debian.org/debian-security-announce/2025/msg00088.html

---

漏洞識別碼

• CVE-2024-26618
• CVE-2024-26783
• CVE-2024-26807
• CVE-2024-28956
• CVE-2024-35790
• CVE-2024-36903
• CVE-2024-36927
• CVE-2024-43840
• CVE-2024-46751
• CVE-2024-53203
• CVE-2024-53209
• CVE-2024-57945
• CVE-2025-21645
• CVE-2025-21839
• CVE-2025-21931
• CVE-2025-22062
• CVE-2025-37819
• CVE-2025-37890
• CVE-2025-37897
• CVE-2025-37901
• CVE-2025-37902
• CVE-2025-37903
• CVE-2025-37905
• CVE-2025-37909
• CVE-2025-37911
• CVE-2025-37912
• CVE-2025-37913
• CVE-2025-37914
• CVE-2025-37915
• CVE-2025-37917
• CVE-2025-37921
• CVE-2025-37923
• CVE-2025-37924
• CVE-2025-37927
• CVE-2025-37928
• CVE-2025-37929
• CVE-2025-37930
• CVE-2025-37932
• CVE-2025-37936
• CVE-2025-37947
• CVE-2025-37948
• CVE-2025-37949
• CVE-2025-37951
• CVE-2025-37953
• CVE-2025-37959
• CVE-2025-37961
• CVE-2025-37962
• CVE-2025-37963
• CVE-2025-37964
• CVE-2025-37967
• CVE-2025-37969
• CVE-2025-37970
• CVE-2025-37972
• CVE-2025-37990
• CVE-2025-37991

---

資料來源

• Debian

---

相關連結

• https://lists.debian.org/debian-security-announce/2025/msg00088.html

Debian Linux Kernel Multiple Vulnerabilities

Release Date: 27 May 2025

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in Debian Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and sensitive information disclosure on the targeted system.

---

Impact

• Elevation of Privilege
• Information Disclosure
• Denial of Service

---

System / Technologies affected

• Debian bookworm versions prior to 6.1.140-1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://lists.debian.org/debian-security-announce/2025/msg00088.html

---

Vulnerability Identifier

• CVE-2024-26618
• CVE-2024-26783
• CVE-2024-26807
• CVE-2024-28956
• CVE-2024-35790
• CVE-2024-36903
• CVE-2024-36927
• CVE-2024-43840
• CVE-2024-46751
• CVE-2024-53203
• CVE-2024-53209
• CVE-2024-57945
• CVE-2025-21645
• CVE-2025-21839
• CVE-2025-21931
• CVE-2025-22062
• CVE-2025-37819
• CVE-2025-37890
• CVE-2025-37897
• CVE-2025-37901
• CVE-2025-37902
• CVE-2025-37903
• CVE-2025-37905
• CVE-2025-37909
• CVE-2025-37911
• CVE-2025-37912
• CVE-2025-37913
• CVE-2025-37914
• CVE-2025-37915
• CVE-2025-37917
• CVE-2025-37921
• CVE-2025-37923
• CVE-2025-37924
• CVE-2025-37927
• CVE-2025-37928
• CVE-2025-37929
• CVE-2025-37930
• CVE-2025-37932
• CVE-2025-37936
• CVE-2025-37947
• CVE-2025-37948
• CVE-2025-37949
• CVE-2025-37951
• CVE-2025-37953
• CVE-2025-37959
• CVE-2025-37961
• CVE-2025-37962
• CVE-2025-37963
• CVE-2025-37964
• CVE-2025-37967
• CVE-2025-37969
• CVE-2025-37970
• CVE-2025-37972
• CVE-2025-37990
• CVE-2025-37991

---

Source

• Debian

---

Related Link

• https://lists.debian.org/debian-security-announce/2025/msg00088.html

思科產品多個漏洞

發佈日期: 2025年05月23日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於思科產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發跨網站指令碼及資料篡改。

---

影響

• 篡改
• 跨網站指令碼

---

受影響之系統或技術

• Cisco Webex
• Cisco Webex Meetings

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cache-Q4xbkQBG
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8

---

漏洞識別碼

• CVE-2025-20246
• CVE-2025-20247
• CVE-2025-20250
• CVE-2025-20255

---

資料來源

• Cisco

---

相關連結

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cache-Q4xbkQBG
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8

Cisco Products Multiple Vulnerabilities

Release Date: 23 May 2025

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Cisco products. A remote attacker could exploit some of these vulnerabilities to trigger cross-site scripting and data manipulation on the targeted system.

---

Impact

• Data Manipulation
• Cross-Site Scripting

---

System / Technologies affected

• Cisco Webex
• Cisco Webex Meetings

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cache-Q4xbkQBG
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8

---

Vulnerability Identifier

• CVE-2025-20246
• CVE-2025-20247
• CVE-2025-20250
• CVE-2025-20255

---

Source

• Cisco

---

Related Link

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cache-Q4xbkQBG
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8

ModSecurity 阻斷服務漏洞

發佈日期: 2025年05月23日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於 ModSecurity 發現一個漏洞。遠端攻擊者可利用這個漏洞，於目標系統觸發阻斷服務狀況。

---

影響

• 阻斷服務

---

受影響之系統或技術

• ModSecurity 版本 2.9.8

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r

---

漏洞識別碼

• CVE-2025-47947

---

資料來源

• ModSecurity

---

相關連結

• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r

ModSecurity Denial of Service Vulnerability

Release Date: 23 May 2025

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

A vulnerability was identified in ModSecurity. A remote attacker could exploit this vulnerability to trigger denial of service condition on the targeted system.

---

Impact

• Denial of Service

---

System / Technologies affected

• ModSecurity version 2.9.8

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r

---

Vulnerability Identifier

• CVE-2025-47947

---

Source

• ModSecurity

---

Related Link

• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r

OpenSSL 繞過保安限制漏洞

發佈日期: 2025年05月23日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於 OpenSSL 中發現一個漏洞。遠端攻擊者可利用這個漏洞，於目標系統觸發繞過保安限制。

---

影響

• 繞過保安限制

---

受影響之系統或技術

• OpenSSL 3.5 版本

---

解決方案

在安裝軟體之前，請先瀏覽軟體供應商之網站，以獲得更多詳細資料。

 

• 對於 3.5 版本，更新至 3.5.1 版本

---

漏洞識別碼

• CVE-2025-4575

---

資料來源

• OpenSSL

---

相關連結

• https://openssl-library.org/news/secadv/20250522.txt

OpenSSL Security Restriction Bypass Vulnerability

Release Date: 23 May 2025

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

A vulnerability was identified in OpenSSL. A remote attacker could exploit this vulnerability to trigger security restriction bypass.

---

Impact

• Security Restriction Bypass

---

System / Technologies affected

• OpenSSL version 3.5

---

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

 

• For version 3.5, upgrade to version 3.5.1

---

Vulnerability Identifier

• CVE-2025-4575

---

Source

• OpenSSL

---

Related Link

• https://openssl-library.org/news/secadv/20250522.txt

GitLab 多個漏洞

發佈日期: 2025年05月22日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 GitLab 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料、阻斷服務狀況及繞過保安限制。

---

影響

• 阻斷服務
• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

• GitLab Community Edition (CE) 18.0.1, 17.11.3 及 17.10.7 以前的版本
• GitLab Enterprise Edition (EE) 18.0.1, 17.11.3 及 17.10.7 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/

---

漏洞識別碼

• CVE-2024-7803
• CVE-2024-9163
• CVE-2024-12093
• CVE-2025-0605
• CVE-2025-0679
• CVE-2025-0993
• CVE-2025-1110
• CVE-2025-2853
• CVE-2025-3111
• CVE-2025-4979

---

資料來源

• GitLab

---

相關連結

• https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/

GitLab Multiple Vulnerabilities

Release Date: 22 May 2025

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in GitLab. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure, denial of service condition and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

• GitLab Community Edition (CE) versions prior to 18.0.1, 17.11.3, and 17.10.7
• GitLab Enterprise Edition (EE) versions prior to 18.0.1, 17.11.3, and 17.10.7

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/

---

Vulnerability Identifier

• CVE-2024-7803
• CVE-2024-9163
• CVE-2024-12093
• CVE-2025-0605
• CVE-2025-0679
• CVE-2025-0993
• CVE-2025-1110
• CVE-2025-2853
• CVE-2025-3111
• CVE-2025-4979

---

Source

• GitLab

---

Related Link

• https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released/

Google Chrome 繞過保安限制漏洞

發佈日期: 2025年05月22日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發繞過保安限制。

---

影響

• 繞過保安限制

---

受影響之系統或技術

• Google Chrome 137.0.7151.40/.41 (Mac) 之前的版本
• Google Chrome 137.0.7151.40/.41 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 137.0.7151.40/.41 (Mac) 或之後版本
• 更新至 137.0.7151.40/.41 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2025-5063
• CVE-2025-5064
• CVE-2025-5065
• CVE-2025-5066
• CVE-2025-5067

---

資料來源

• Chrome

---

相關連結

• https://chromereleases.googleblog.com/2025/05/early-stable-update-for-desktop.html

Google Chrome Security Restriction Bypass Vulnerability

Release Date: 22 May 2025

RISK: Medium Risk

TYPE: Clients - Browsers

A vulnerability was identified in Google Chrome. A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.

---

Impact

• Security Restriction Bypass

---

System / Technologies affected

• Google Chrome prior to 137.0.7151.40/.41 (Mac)
• Google Chrome prior to 137.0.7151.40/.41 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 137.0.7151.40/.41 (Mac) or later
• Update to version 137.0.7151.40/.41 (Windows) or later

---

Vulnerability Identifier

• CVE-2025-5063
• CVE-2025-5064
• CVE-2025-5065
• CVE-2025-5066
• CVE-2025-5067

---

Source

• Chrome

---

Related Link

• https://chromereleases.googleblog.com/2025/05/early-stable-update-for-desktop.html

VMWare 產品多個漏洞

發佈日期: 2025年05月21日

風險: 中度風險

類型: 操作系統 - 網絡操作系統

於 VMware 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發跨網站指令碼、遠端執行程式碼及阻斷服務狀況。

---

影響

• 跨網站指令碼
• 阻斷服務
• 遠端執行程式碼

---

受影響之系統或技術

• vCenter Server 8.0
• vCenter Server 7.0
• VMware ESXi 8.0
• VMware ESXi 7.0 
• VMware Cloud Foundation (vCenter) 5.x
• VMware Cloud Foundation (vCenter) 4.5.x
• VMware Cloud Foundation (ESXi) 5.x
• VMware Cloud Foundation (ESXi) 4.5.x
• VMware Telco Cloud Platform (ESXi) 5.x, 4.x, 3.x, 2.x
• VMware Telco Cloud Infrastructure (ESXi) 3.x
• VMware Telco Cloud Infrastructure (ESXi) 2.x
• VMware Telco Cloud Platform (vCenter) 5.x, 4.x, 3.x, 2.x
• VMware Telco Cloud Infrastructure (vCenter) 3.x
• VMware Telco Cloud Infrastructure (vCenter) 2.x
• VMware Workstation 17.x
• VMware Fusion 13.x

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

• 安裝供應商提供的修補程式：
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

---

漏洞識別碼

• CVE-2025-41225
• CVE-2025-41226
• CVE-2025-41227
• CVE-2025-41228

---

資料來源

• VMware

---

相關連結

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

VMWare Products Multiple Vulnerabilities

Release Date: 21 May 2025

RISK: Medium Risk

TYPE: Operating Systems - VM Ware

Multiple vulnerabilities were identified in VMware products. A remote attacker could exploit some of these vulnerabilities to trigger cross-site scripting, remote code execution and denial of service condition on the targeted system.

---

Impact

• Cross-Site Scripting
• Denial of Service
• Remote Code Execution

---

System / Technologies affected

• vCenter Server 8.0
• vCenter Server 7.0
• VMware ESXi 8.0
• VMware ESXi 7.0 
• VMware Cloud Foundation (vCenter) 5.x
• VMware Cloud Foundation (vCenter) 4.5.x
• VMware Cloud Foundation (ESXi) 5.x
• VMware Cloud Foundation (ESXi) 4.5.x
• VMware Telco Cloud Platform (ESXi) 5.x, 4.x, 3.x, 2.x
• VMware Telco Cloud Infrastructure (ESXi) 3.x
• VMware Telco Cloud Infrastructure (ESXi) 2.x
• VMware Telco Cloud Platform (vCenter) 5.x, 4.x, 3.x, 2.x
• VMware Telco Cloud Infrastructure (vCenter) 3.x
• VMware Telco Cloud Infrastructure (vCenter) 2.x
• VMware Workstation 17.x
• VMware Fusion 13.x

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

• Apply fixes issued by the vendor:
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

---

Vulnerability Identifier

• CVE-2025-41225
• CVE-2025-41226
• CVE-2025-41227
• CVE-2025-41228

---

Source

• VMware

---

Related Link

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

Microsoft Edge 多個漏洞

發佈日期: 2025年05月19日

風險: 高度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料及遠端執行任意程式碼。

 

注意：

CVE-2025-4664 正在被廣泛利用。分配給此 CVE 的漏洞位於 Chromium 開放原始碼軟體 (OSS)，此軟體由 Microsoft Edge (基於 Chromium) 使用。136.0.7103.113 之前的 Google Chrome 版本中 Loader 的政策執行不足導致遠端攻擊者透過精心設計的 HTML 頁面洩露跨網域資料。因此，風險等級被評為高風險。

---

影響

• 遠端執行程式碼
• 資料洩露

---

受影響之系統或技術

• Microsoft Edge 136.0.3240.76 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 136.0.3240.76 或之後版本

---

漏洞識別碼

• CVE-2025-4609
• CVE-2025-4664

---

資料來源

• Microsoft Edge

---

相關連結

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#may-15-2025
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-4664
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-4609

Microsoft Edge Multiple Vulnerabilities

Release Date: 19 May 2025

RISK: High Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure and remote code execution on the targeted system.

 

Note:

CVE-2025-4664 is being exploited in the wild. The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Hence, the risk level is rated as High Risk.

 

---

Impact

• Remote Code Execution
• Information Disclosure

---

System / Technologies affected

• Microsoft Edge version prior to 136.0.3240.76

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 136.0.3240.76 or later

---

Vulnerability Identifier

• CVE-2025-4609
• CVE-2025-4664

---

Source

• Microsoft Edge

---

Related Link

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#may-15-2025
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-4664
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-4609

IBM WebSphere 產品多個漏洞

發佈日期: 2025年05月19日

風險: 中度風險

類型: 伺服器 - 互聯網應用伺服器

於 IBM WebSphere 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發篡改及洩露敏感資料。

---

影響

• 篡改
• 資料洩露

---

受影響之系統或技術

• IBM WebSphere Application Server 9.0
• IBM WebSphere Application Server 8.5

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://www.ibm.com/support/pages/node/7233442

---

漏洞識別碼

• CVE-2025-4447
• CVE-2025-21587

---

資料來源

• IBM

---

相關連結

• https://www.ibm.com/support/pages/node/7233442

IBM WebSphere Products Multiple Vulnerabilities

Release Date: 19 May 2025

RISK: Medium Risk

TYPE: Servers - Internet App Servers

Multiple vulnerabilities were identified in IBM WebSphere Products. A remote attacker could exploit some of these vulnerabilities to trigger data manipulation and sensitive information disclosure on the targeted system.

---

Impact

• Data Manipulation
• Information Disclosure

---

System / Technologies affected

• IBM WebSphere Application Server 9.0
• IBM WebSphere Application Server 8.5

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.ibm.com/support/pages/node/7233442

---

Vulnerability Identifier

• CVE-2025-4447
• CVE-2025-21587

---

Source

• IBM

---

Related Link

• https://www.ibm.com/support/pages/node/7233442

Mozilla Firefox 多個漏洞

發佈日期: 2025年05月19日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla Firefox 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼及資料洩露。

 

---

影響

• 阻斷服務
• 遠端執行程式碼
• 資料洩露

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Firefox ESR 128.10.1
• Firefox ESR 115.23.1
• Firefox 138.0.4

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Firefox ESR 128.10.1
• Firefox ESR 115.23.1
• Firefox 138.0.4

 

---

漏洞識別碼

• CVE-2025-4918
• CVE-2025-4919

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-36/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-37/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-38/

Mozilla Firefox Multiple Vulnerabilities

Release Date: 19 May 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Firefox. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution and information disclosure on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution
• Information Disclosure

---

System / Technologies affected

Versions prior to:

 

• Firefox ESR 128.10.1
• Firefox ESR 115.23.1
• Firefox 138.0.4

 

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Firefox ESR 128.10.1
• Firefox ESR 115.23.1
• Firefox 138.0.4

---

Vulnerability Identifier

• CVE-2025-4918
• CVE-2025-4919

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-36/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-37/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-38/

Mozilla 產品多個漏洞

發佈日期: 2025年05月16日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發過保安限制及仿冒。

 

---

影響

• 繞過保安限制
• 仿冒

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Thunderbird 138.0.1
• Thunderbird 128.10.1

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Thunderbird 138.0.1
• Thunderbird 128.10.1

---

漏洞識別碼

• CVE-2025-3875
• CVE-2025-3877
• CVE-2025-3909
• CVE-2025-3932

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-35/

Mozilla Products Multiple Vulnerabilities

Release Date: 16 May 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Products. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass and spoofing on the targeted system.

---

Impact

• Security Restriction Bypass
• Spoofing

---

System / Technologies affected

Versions prior to:

 

• Thunderbird 138.0.1
• Thunderbird 128.10.1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Thunderbird 138.0.1
• Thunderbird 128.10.1

---

Vulnerability Identifier

• CVE-2025-3875
• CVE-2025-3877
• CVE-2025-3909
• CVE-2025-3932

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-35/

Palo Alto 產品多個漏洞

發佈日期: 2025年05月16日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於 Palo Alto 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼、洩露敏感資料、權限提升、跨網站指令碼及繞過保安限制。

 

---

影響

• 遠端執行程式碼
• 阻斷服務
• 繞過保安限制
• 資料洩露
• 跨網站指令碼
• 權限提升

---

受影響之系統或技術

• Prisma Cloud Compute Edition 中 34.00.141 之前的版本
• Prisma Access 所有版本
• PAN-OS 11.2 中 11.2.7 之前的版本
• PAN-OS 11.2 中 11.2.5 之前的版本
• PAN-OS 11.1 中 11.1.8 之前的版本
• PAN-OS 11.1 中 11.1.7-h2 之前的版本
• PAN-OS 11.1 中 11.1.6-h1 之前的版本
• PAN-OS 11.1 中 11.1.5 之前的版本
• PAN-OS 11.1 中 11.1.11 之前的版本
• PAN-OS 11.0 中 11.0.7 之前的版本
• PAN-OS 10.2 中 10.2.17 之前的版本
• PAN-OS 10.2 中 10.2.13 之前的版本
• PAN-OS 10.2 中 10.2.11 之前的版本
• PAN-OS 10.1 中 10.1.14-h14 之前的版本
• PAN-OS 10.1 所有版本
• MetaDefender Endpoint Security SDK 4.3.0 中 4.3.4451 on Windows 之前的版本
• GlobalProtect App 6.3 中 6.3.3 on macOS 之前的版本
• GlobalProtect App 6.2 中 6.2.8 on macOS 之前的版本
• GlobalProtect App 6.1 on macOS 所有版本
• GlobalProtect App 6.0 on macOS 所有版本
• Cortex XDR Broker VM 26.0.0 中 26.0.119 之前的版本
• Cloud NGFW 所有版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://security.paloaltonetworks.com/CVE-2025-0130
• https://security.paloaltonetworks.com/CVE-2025-0131
• https://security.paloaltonetworks.com/CVE-2025-0132
• https://security.paloaltonetworks.com/CVE-2025-0133
• https://security.paloaltonetworks.com/CVE-2025-0134
• https://security.paloaltonetworks.com/CVE-2025-0135
• https://security.paloaltonetworks.com/CVE-2025-0136
• https://security.paloaltonetworks.com/CVE-2025-0137
• https://security.paloaltonetworks.com/CVE-2025-0138

---

漏洞識別碼

• CVE-2025-0130
• CVE-2025-0131
• CVE-2025-0132
• CVE-2025-0133
• CVE-2025-0134
• CVE-2025-0135
• CVE-2025-0136
• CVE-2025-0137
• CVE-2025-0138

---

資料來源

• Palo Alto

---

相關連結

• https://security.paloaltonetworks.com/
• https://security.paloaltonetworks.com/CVE-2025-0130
• https://security.paloaltonetworks.com/CVE-2025-0131
• https://security.paloaltonetworks.com/CVE-2025-0132
• https://security.paloaltonetworks.com/CVE-2025-0133
• https://security.paloaltonetworks.com/CVE-2025-0134
• https://security.paloaltonetworks.com/CVE-2025-0135
• https://security.paloaltonetworks.com/CVE-2025-0136
• https://security.paloaltonetworks.com/CVE-2025-0137
• https://security.paloaltonetworks.com/CVE-2025-0138

Palo Alto Products Multiple Vulnerabilities

Release Date: 16 May 2025

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Palo Alto Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, sensitive information disclosure, elevation of privilege,  cross-site scripting and security restriction bypass on the targeted system.

 

---

Impact

• Remote Code Execution
• Denial of Service
• Security Restriction Bypass
• Information Disclosure
• Cross-Site Scripting
• Elevation of Privilege

---

System / Technologies affected

• Prisma Cloud Compute Edition versions earlier than 34.00.141
• Prisma Access All versions
• PAN-OS 11.2 versions earlier than 11.2.7
• PAN-OS 11.2 versions earlier than 11.2.5
• PAN-OS 11.1 versions earlier than 11.1.8
• PAN-OS 11.1 versions earlier than 11.1.7-h2
• PAN-OS 11.1 versions earlier than 11.1.6-h1
• PAN-OS 11.1 versions earlier than 11.1.5
• PAN-OS 11.1 versions earlier than 11.1.11
• PAN-OS 11.0 versions earlier than 11.0.7
• PAN-OS 10.2 versions earlier than 10.2.17
• PAN-OS 10.2 versions earlier than 10.2.13
• PAN-OS 10.2 versions earlier than 10.2.11
• PAN-OS 10.1 versions earlier than 10.1.14-h14
• PAN-OS 10.1 All versions
• MetaDefender Endpoint Security SDK 4.3.0 versions earlier than 4.3.4451 on Windows
• GlobalProtect App 6.3 versions earlier than 6.3.3 on macOS
• GlobalProtect App 6.2 versions earlier than 6.2.8 on macOS
• GlobalProtect App 6.1 All versions on macOS
• GlobalProtect App 6.0 All versions on macOS
• Cortex XDR Broker VM 26.0.0 versions earlier than 26.0.119
• Cloud NGFW All versions

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://security.paloaltonetworks.com/CVE-2025-0130
• https://security.paloaltonetworks.com/CVE-2025-0131
• https://security.paloaltonetworks.com/CVE-2025-0132
• https://security.paloaltonetworks.com/CVE-2025-0133
• https://security.paloaltonetworks.com/CVE-2025-0134
• https://security.paloaltonetworks.com/CVE-2025-0135
• https://security.paloaltonetworks.com/CVE-2025-0136
• https://security.paloaltonetworks.com/CVE-2025-0137
• https://security.paloaltonetworks.com/CVE-2025-0138

---

Vulnerability Identifier

• CVE-2025-0130
• CVE-2025-0131
• CVE-2025-0132
• CVE-2025-0133
• CVE-2025-0134
• CVE-2025-0135
• CVE-2025-0136
• CVE-2025-0137
• CVE-2025-0138

---

Source

• Palo Alto

---

Related Link

• https://security.paloaltonetworks.com/
• https://security.paloaltonetworks.com/CVE-2025-0130
• https://security.paloaltonetworks.com/CVE-2025-0131
• https://security.paloaltonetworks.com/CVE-2025-0132
• https://security.paloaltonetworks.com/CVE-2025-0133
• https://security.paloaltonetworks.com/CVE-2025-0134
• https://security.paloaltonetworks.com/CVE-2025-0135
• https://security.paloaltonetworks.com/CVE-2025-0136
• https://security.paloaltonetworks.com/CVE-2025-0137
• https://security.paloaltonetworks.com/CVE-2025-0138

SonicWall 產品繞過保安限制漏洞

發佈日期: 2025年05月16日

風險: 中度風險

類型: 操作系統 - Network

於 SonicWall 產品發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發繞過保安限制。

 

---

影響

• 繞過保安限制

---

受影響之系統或技術

• SonicWall SMA 1000 系列 12.4.3-02925 (platform-hotfix) 及更早版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-encoded-url-ssrf-vulnerability/250513120756710

---

漏洞識別碼

• CVE-2025-40595

---

資料來源

• SonicWall

---

相關連結

• https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-encoded-url-ssrf-vulnerability/250513120756710

SonicWall Products Security Restriction Bypass Vulnerability

Release Date: 16 May 2025

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

A vulnerability was identified in SonicWall Products.  A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.

 

---

Impact

• Security Restriction Bypass

---

System / Technologies affected

• SonicWall SMA 1000 Series 12.4.3-02925 (platform-hotfix) and earlier versions

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-encoded-url-ssrf-vulnerability/250513120756710

---

Vulnerability Identifier

• CVE-2025-40595

---

Source

• SonicWall

---

Related Link

• https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-encoded-url-ssrf-vulnerability/250513120756710

Google Chrome 多個漏洞

發佈日期: 2025年05月15日

風險: 高度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料及遠端執行任意程式碼。

 

注意：

CVE-2025-4664 正在被廣泛利用，136.0.7103.113 之前的 Google Chrome 版本中 Loader 的政策執行不足導致遠端攻擊者透過精心設計的 HTML 頁面洩露跨網域資料。因此，風險等級被評為高風險。

---

影響

• 資料洩露
• 遠端執行程式碼

---

受影響之系統或技術

• Google Chrome 136.0.7103.113 (Linux) 之前的版本
• Google Chrome 136.0.7103.113/.114 (Mac) 之前的版本
• Google Chrome 136.0.7103.113/.114 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 136.0.7103.113 (Linux) 或之後版本
• 更新至 136.0.7103.113/.114 (Mac) 或之後版本
• 更新至 136.0.7103.113/.114 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2025-4609
• CVE-2025-4664

---

資料來源

• Chrome

---

相關連結

• https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html

Google Chrome Multiple Vulnerabilities

Release Date: 15 May 2025

RISK: High Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure and remote code execution on the targeted system.

 

Note:

CVE-2025-4664 is being exploited in the wild, insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Hence, the risk level is rated as High Risk.

---

Impact

• Information Disclosure
• Remote Code Execution

---

System / Technologies affected

• Google Chrome prior to 136.0.7103.113 (Linux)
• Google Chrome prior to 136.0.7103.113/.114 (Mac)
• Google Chrome prior to 136.0.7103.113/.114 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 136.0.7103.113 (Linux) or later
• Update to version 136.0.7103.113/.114 (Mac) or later
• Update to version 136.0.7103.113/.114 (Windows) or later

---

Vulnerability Identifier

• CVE-2025-4609
• CVE-2025-4664

---

Source

• Chrome

---

Related Link

• https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html

Node.js 多個漏洞

發佈日期: 2025年05月15日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 Node.js 發現一些漏洞，遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及繞過保安限制。

---

影響

• 阻斷服務
• 繞過保安限制

---

受影響之系統或技術

• Node.js 20.19.2 (LTS) 以前的版本
• Node.js 22.15.1 (LTS) 以前的版本
• Node.js 23.11.1 (Current) 以前的版本
• Node.js 24.0.2 (Current) 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 更新至 Node.js 20.19.2 (LTS) 版本
• 更新至 Node.js 22.15.1 (LTS) 版本
• 更新至 Node.js 23.11.1 (Current) 版本
• 更新至 Node.js 24.0.2 (Current) 版本

---

漏洞識別碼

• CVE-2025-23165
• CVE-2025-23166
• CVE-2025-23167

---

資料來源

• Node.js

---

相關連結

• https://nodejs.org/en/blog/vulnerability/may-2025-security-releases
• https://nodejs.org/en/blog/release/v20.19.2/
• https://nodejs.org/en/blog/release/v22.15.1/
• https://nodejs.org/en/blog/release/v23.11.1/
• https://nodejs.org/en/blog/release/v24.0.2