Apache Tomcat 多個漏洞

發佈日期: 2025年06月18日

風險: 中度風險

類型: 伺服器 - 網站伺服器

於 Apache Tomcat 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制及阻斷服務狀況。

---

影響

• 阻斷服務
• 繞過保安限制

---

受影響之系統或技術

• Apache Tomcat 9.0.0.M1 至 9.0.105 版本
• Apache Tomcat 10.1.0-M1 至 10.1.41 版本
• Apache Tomcat 11.0.0-M1 至 11.0.7 版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8

---

漏洞識別碼

• CVE-2025-48976
• CVE-2025-48988
• CVE-2025-49124
• CVE-2025-49125

---

資料來源

• Apache Tomcat

---

相關連結

• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8

Apache Tomcat Multiple Vulnerabilities

Release Date: 18 Jun 2025

RISK: Medium Risk

TYPE: Servers - Web Servers

Multiple vulnerabilities were identified in Apache Tomcat. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass and denial of service condition on the targeted system.

---

Impact

• Denial of Service
• Security Restriction Bypass

---

System / Technologies affected

• Apache Tomcat version 9.0.0.M1 to 9.0.105
• Apache Tomcat version 10.1.0-M1 to 10.1.41
• Apache Tomcat version 11.0.0-M1 to 11.0.7

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8

---

Vulnerability Identifier

• CVE-2025-48976
• CVE-2025-48988
• CVE-2025-49124
• CVE-2025-49125

---

Source

• Apache Tomcat

---

Related Link

• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8

Citrix 產品多個漏洞

發佈日期: 2025年06月18日

風險: 中度風險

類型: 操作系統 - Network

於 Citrix 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制及洩露敏感資料。

 

 

---

影響

• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

• NetScaler ADC 和 NetScaler Gateway 14.1 中 14.1-43.56 之前的版本
• NetScaler ADC 和 NetScaler Gateway 13.1 中 13.1-58.32 之前的版本
• NetScaler ADC 13.1-FIPS 中 13.1-37.235 之前的版本
• NetScaler ADC 13.1-NDcPP 中 13.1-37.235 之前的版本
• NetScaler ADC 12.1-FIPS 中 12.1-55.321 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

---

漏洞識別碼

• CVE-2025-5349
• CVE-2025-5777

---

資料來源

• Citrix

---

相關連結

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

Citrix Products Multiple Vulnerabilities

Release Date: 18 Jun 2025

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

Multiple vulnerabilities were identified in Citrix Products. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass and sensitive information disclosure on the targeted system.

 

 

---

Impact

• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

• NetScaler ADC and NetScaler Gateway 14.1 before  14.1-43.56
• NetScaler ADC and NetScaler Gateway 13.1  before  13.1-58.32
• NetScaler ADC 13.1-FIPS before  13.1-37.235
• NetScaler ADC 13.1-NDcPP before  13.1-37.235
• NetScaler ADC 12.1-FIPS before  12.1-55.328

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

---

Vulnerability Identifier

• CVE-2025-5349
• CVE-2025-5777

---

Source

• Citrix

---

Related Link

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

Google Chrome 多個漏洞

發佈日期: 2025年06月18日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。

---

影響

• 阻斷服務
• 遠端執行程式碼

---

受影響之系統或技術

• Google Chrome 137.0.7151.119 (Linux) 之前的版本
• Google Chrome 137.0.7151.119/.120 (Mac) 之前的版本
• Google Chrome 137.0.7151.119/.120 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 137.0.7151.119 (Linux) 或之後版本
• 更新至 137.0.7151.119/.120 (Mac) 或之後版本
• 更新至 137.0.7151.119/.120 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2025-6191
• CVE-2025-6192

---

資料來源

• Chrome

---

相關連結

• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html

Google Chrome Multiple Vulnerabilities

Release Date: 18 Jun 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service and remote code execution on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution

---

System / Technologies affected

• Google Chrome prior to 137.0.7151.119 (Linux)
• Google Chrome prior to 137.0.7151.119/.120 (Mac)
• Google Chrome prior to 137.0.7151.119/.120 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 137.0.7151.119 (Linux) or later
• Update to version 137.0.7151.119/.120 (Mac) or later
• Update to version 137.0.7151.119/.120 (Windows) or later

---

Vulnerability Identifier

• CVE-2025-6191
• CVE-2025-6192

---

Source

• Chrome

---

Related Link

• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html

TP-Link 路由器遠端執行任意程式碼漏洞

發佈日期: 2025年06月17日

風險: 極高度風險

類型: 操作系統 - Network

於 TP-Link 路由器發現一個漏洞。遠端攻擊者可利用這個漏洞，於目標系統觸發遠端執行程式碼。

 

---

影響

• 遠端執行程式碼

---

受影響之系統或技術

• TP-Link TL-WR740N V1/V2
• TP-Link TL-WR841N V8/V10
• TP-Link TL-WR940N V2/V4

---

解決方案

受影響的產品可能是生命週期結束 (EoL) 和/或服務終止 (EoS)。使用者應停止使用受影響的產品。

---

漏洞識別碼

• CVE-2023-33538

---

資料來源

• https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

---

相關連結

• https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.tp-link.com/nordic/support/faq/3562/

TP-Link Router Remote Code Execution Vulnerability

Release Date: 17 Jun 2025

RISK: Extremely High Risk

TYPE: Operating Systems - Networks OS

A vulnerability was identified in TP-Link router. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

---

Impact

• Remote Code Execution

---

System / Technologies affected

• TP-Link TL-WR740N V1/V2
• TP-Link TL-WR841N V8/V10
• TP-Link TL-WR940N V2/V4

 

 

---

Solutions

The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue affected product utilization.

 

---

Vulnerability Identifier

• CVE-2023-33538

---

Source

• https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

---

Related Link

• https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.tp-link.com/nordic/support/faq/3562/

蘋果產品繞過保安限制漏洞

發佈日期: 2025年06月16日

風險: 中度風險

類型: 操作系統 - 流動裝置及操作系統

於蘋果產品發現一個漏洞。遠端攻擊者可利用這個漏洞，於目標系統觸發繞過保安限制。

 

注意：

對於 CVE-2025-43200，通過 iCloud Link 處理共享的惡意製作的照片或影片時存在邏輯問題。 Apple 注意到一份報告稱，此漏洞可能已被利用於針對特定目標用戶的極其複雜的攻擊。蘋果已於 2025 年 2 月 10 日發布修補程式修復此漏洞。

---

影響

• 繞過保安限制

---

受影響之系統或技術

• iOS 18.3.1 以前的版本
• iPadOS 17.7.5 以前的版本
• iPadOS 18.3.1 以前的版本
• macOS Sequoia 15.3.1 以前的版本
• macOS Sonoma 14.7.4 以前的版本
• macOS Ventura 13.7.4 以前的版本
• watchOS 11.3.1 以前的版本
• visionOS 2.3.1 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝供應商提供的修補程式：

 

• iOS 18.3.1 或之後的版本
• iPadOS 17.7.5 或之後的版本
• iPadOS 18.3.1 或之後的版本
• macOS Sequoia 15.3.1 或之後的版本
• macOS Sonoma 14.7.4 或之後的版本
• macOS Ventura 13.7.4 或之後的版本
• watchOS 11.3.1 或之後的版本
• visionOS 2.3.1 或之後的版本

---

漏洞識別碼

• CVE-2025-43200

---

資料來源

• Apple

---

相關連結

• https://support.apple.com/en-us/122173
• https://support.apple.com/en-us/122174
• https://support.apple.com/en-us/122900
• https://support.apple.com/en-us/122901
• https://support.apple.com/en-us/122902
• https://support.apple.com/en-us/122903
• https://support.apple.com/en-us/122904

Apple Products Security Restriction Bypass Vulnerability

Release Date: 16 Jun 2025

RISK: Medium Risk

TYPE: Operating Systems - Mobile & Apps

A vulnerability was identified in Apple Products. A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.

 

Note:

For CVE-2025-43200, a logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Apple had released patch to fix this vulnerability on 10 Feb 2025.

---

Impact

• Security Restriction Bypass

---

System / Technologies affected

• Versions prior to iOS 18.3.1
• Versions prior to iPadOS 17.7.5
• Versions prior to iPadOS 18.3.1
• Versions prior to macOS Sequoia 15.3.1
• Versions prior to macOS Sonoma 14.7.4
• Versions prior to macOS Ventura 13.7.4
• Versions prior to watchOS 11.3.1
• Versions prior to visionOS 2.3.1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

 

• iOS 18.3.1 or later versions
• iPadOS 17.7.5 or later versions
• iPadOS 18.3.1 or later versions
• macOS Sequoia 15.3.1 or later versions
• macOS Sonoma 14.7.4 or later versions
• macOS Ventura 13.7.4 or later versions
• watchOS 11.3.1 or later versions
• visionOS 2.3.1 or later versions

---

Vulnerability Identifier

• CVE-2025-43200

---

Source

• Apple

---

Related Link

• https://support.apple.com/en-us/122173
• https://support.apple.com/en-us/122174
• https://support.apple.com/en-us/122900
• https://support.apple.com/en-us/122901
• https://support.apple.com/en-us/122902
• https://support.apple.com/en-us/122903
• https://support.apple.com/en-us/122904

Microsoft Edge 多個漏洞

發佈日期: 2025年06月16日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。

---

影響

• 遠端執行程式碼
• 阻斷服務

---

受影響之系統或技術

• Microsoft Edge 137.0.3296.83 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 137.0.3296.83 或之後版本

---

漏洞識別碼

• CVE-2025-5958
• CVE-2025-5959

---

資料來源

• Microsoft Edge

---

相關連結

• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#june-13-2025
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5958
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5959

Microsoft Edge Multiple Vulnerabilities

Release Date: 16 Jun 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and remote code execution on the targeted system.

---

Impact

• Remote Code Execution
• Denial of Service

---

System / Technologies affected

• Microsoft Edge version prior to 137.0.3296.83

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 137.0.3296.83 or later

---

Vulnerability Identifier

• CVE-2025-5958
• CVE-2025-5959

---

Source

• Microsoft Edge

---

Related Link

• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#june-13-2025
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5958
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5959

GitLab 多個漏洞

發佈日期: 2025年06月13日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 GitLab 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發跨網站指令碼、洩露敏感資料、阻斷服務狀況及繞過保安限制。

---

影響

• 阻斷服務
• 繞過保安限制
• 資料洩露
• 跨網站指令碼

---

受影響之系統或技術

• GitLab Community Edition (CE) 18.0.2, 17.11.4 及 17.10.8 以前的版本
• GitLab Enterprise Edition (EE) 18.0.2, 17.11.4 及 17.10.8 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/

---

漏洞識別碼

• CVE-2024-9512
• CVE-2025-0673
• CVE-2025-1478
• CVE-2025-1516
• CVE-2025-2254
• CVE-2025-4278
• CVE-2025-5121
• CVE-2025-5195
• CVE-2025-5982
• CVE-2025-5996

---

資料來源

• GitLab

---

相關連結

• https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/

GitLab Multiple Vulnerabilities

Release Date: 13 Jun 2025

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in GitLab. A remote attacker could exploit some of these vulnerabilities to trigger cross-site scripting, sensitive information disclosure, denial of service condition and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Security Restriction Bypass
• Information Disclosure
• Cross-Site Scripting

---

System / Technologies affected

• GitLab Community Edition (CE) versions prior to 18.0.2, 17.11.4, and 17.10.8
• GitLab Enterprise Edition (EE) versions prior to 18.0.2, 17.11.4, and 17.10.8

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/

---

Vulnerability Identifier

• CVE-2024-9512
• CVE-2025-0673
• CVE-2025-1478
• CVE-2025-1516
• CVE-2025-2254
• CVE-2025-4278
• CVE-2025-5121
• CVE-2025-5195
• CVE-2025-5982
• CVE-2025-5996

---

Source

• GitLab

---

Related Link

• https://about.gitlab.com/releases/2025/06/11/patch-release-gitlab-18-0-2-released/

Palo Alto 產品多個漏洞

發佈日期: 2025年06月13日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於 Palo Alto 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發洩露敏感資料、權限提升及繞過保安限制。

 

---

影響

• 權限提升
• 資料洩露
• 繞過保安限制

---

受影響之系統或技術

• PAN-OS 10.1.14-h16 之前的 PAN-OS 10.1 版本
• PAN-OS 10.2.17 之前的 PAN-OS 10.2 版本
• PAN-OS 11.0.3 之前的 PAN-OS 11.0 版本
• PAN-OS 11.1.10 之前的 PAN-OS 11.1 版本
• PAN-OS 11.2.7 之前的 PAN-OS 11.2 版本
• GlobalProtect App 6.3 中 6.3.3-h1 on Windows, macOS 之前的版本
• GlobalProtect App 6.2 中 6.2.8-h2 on Windows, macOS 之前的版本
• GlobalProtect App 6.1 on Windows, macOS 所有版本
• GlobalProtect App 6.0 on Windows, macOS 所有版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://security.paloaltonetworks.com/CVE-2025-4227
• https://security.paloaltonetworks.com/CVE-2025-4229
• https://security.paloaltonetworks.com/CVE-2025-4230
• https://security.paloaltonetworks.com/CVE-2025-4231
• https://security.paloaltonetworks.com/CVE-2025-4232

---

漏洞識別碼

• CVE-2025-4227
• CVE-2025-4229
• CVE-2025-4230
• CVE-2025-4231
• CVE-2025-4232

---

資料來源

• Palo Alto

---

相關連結

• https://security.paloaltonetworks.com/CVE-2025-4227
• https://security.paloaltonetworks.com/CVE-2025-4229
• https://security.paloaltonetworks.com/CVE-2025-4230
• https://security.paloaltonetworks.com/CVE-2025-4231
• https://security.paloaltonetworks.com/CVE-2025-4232

Palo Alto Products Multiple Vulnerabilities

Release Date: 13 Jun 2025

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Palo Alto Products. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure, elevation of privilege and security restriction bypass on the targeted system.

 

---

Impact

• Elevation of Privilege
• Information Disclosure
• Security Restriction Bypass

---

System / Technologies affected

• PAN-OS 10.1 versions earlier than PAN-OS 10.1.14-h16
• PAN-OS 10.2 versions earlier than PAN-OS 10.2.17
• PAN-OS 11.0 versions earlier than PAN-OS 11.0.3
• PAN-OS 11.1 versions earlier than PAN-OS 11.1.10
• PAN-OS 11.2 versions earlier than PAN-OS 11.2.7
• GlobalProtect App 6.3 versions earlier than 6.3.3-h1 on Windows, macOS
• GlobalProtect App 6.2 versions earlier than 6.2.8-h2 on Windows, macOS
• GlobalProtect App 6.1 all versions on Windows, macOS
• GlobalProtect App 6.0 all versions on Windows, macOS

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://security.paloaltonetworks.com/CVE-2025-4227
• https://security.paloaltonetworks.com/CVE-2025-4229
• https://security.paloaltonetworks.com/CVE-2025-4230
• https://security.paloaltonetworks.com/CVE-2025-4231
• https://security.paloaltonetworks.com/CVE-2025-4232

---

Vulnerability Identifier

• CVE-2025-4227
• CVE-2025-4229
• CVE-2025-4230
• CVE-2025-4231
• CVE-2025-4232

---

Source

• Palo Alto

---

Related Link

• https://security.paloaltonetworks.com/CVE-2025-4227
• https://security.paloaltonetworks.com/CVE-2025-4229
• https://security.paloaltonetworks.com/CVE-2025-4230
• https://security.paloaltonetworks.com/CVE-2025-4231
• https://security.paloaltonetworks.com/CVE-2025-4232

SAP Business One 繞過保安限制漏洞

發佈日期: 2025年06月12日

風險: 中度風險

類型: 用戶端 - 辦公室應用

於 SAP Business One 發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發繞過保安限制。

---

影響

• 繞過保安限制

---

受影響之系統或技術

• SAP Business One Integration Framework B1_ON_HANA 10.0, SAP-M-BO 10.0 版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html

---

漏洞識別碼

• CVE-2025-42998

---

資料來源

• SAP

---

相關連結

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html

SAP Business One Security Restriction Bypass Vulnerability

Release Date: 12 Jun 2025

RISK: Medium Risk

TYPE: Clients - Productivity Products

A vulnerability was identified in SAP Business One. A remote attacker could exploit this vulnerability to trigger security restriction bypass on the targeted system.

---

Impact

• Security Restriction Bypass

---

System / Technologies affected

• SAP Business One Integration Framework Versions – B1_ON_HANA 10.0, SAP-M-BO 10.0

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html

---

Vulnerability Identifier

• CVE-2025-42998

---

Source

• SAP

---

Related Link

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2025.html

Trend Micro 產品多個漏洞

發佈日期: 2025年06月12日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於 Trend Micro 產品發現多個漏洞。攻擊者可利用這些漏洞，於目標系統觸發提升權限、遠端執行程式碼及篡改。

 

---

影響

• 權限提升
• 遠端執行程式碼
• 篡改

---

受影響之系統或技術

• Trend Micro Apex One - 2019 (On-prem)
• Trend Micro Apex One as a Service (SaaS)
• Trend Micro Apex Central - 2019 (On-prem)
• Trend Micro Apex Central as a Service (SaaS)

---

解決方案

在安裝軟體之前，請先瀏覽軟體供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://success.trendmicro.com/en-US/solution/KA-0019917
• https://success.trendmicro.com/en-US/solution/KA-0019926

---

漏洞識別碼

• CVE-2025-49154
• CVE-2025-49155
• CVE-2025-49156
• CVE-2025-49157
• CVE-2025-49158
• CVE-2025-49219
• CVE-2025-49220

---

資料來源

• Trend Micro

---

相關連結

• https://success.trendmicro.com/en-US/solution/KA-0019917
• https://success.trendmicro.com/en-US/solution/KA-0019926

Trend Micro Products Multiple Vulnerabilities

Release Date: 12 Jun 2025

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Trend Micro Products. An attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution and data manipulation on the targeted system.

 

---

Impact

• Elevation of Privilege
• Remote Code Execution
• Data Manipulation

---

System / Technologies affected

• Trend Micro Apex One - 2019 (On-prem)
• Trend Micro Apex One as a Service (SaaS)
• Trend Micro Apex Central - 2019 (On-prem)
• Trend Micro Apex Central as a Service (SaaS)

---

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

 

Apply fixes issued by the vendor:

• https://success.trendmicro.com/en-US/solution/KA-0019917
• https://success.trendmicro.com/en-US/solution/KA-0019926

---

Vulnerability Identifier

• CVE-2025-49154
• CVE-2025-49155
• CVE-2025-49156
• CVE-2025-49157
• CVE-2025-49158
• CVE-2025-49219
• CVE-2025-49220

---

Source

• Trend Micro

---

Related Link

• https://success.trendmicro.com/en-US/solution/KA-0019917
• https://success.trendmicro.com/en-US/solution/KA-0019926

Apache Kafka 權限提升漏洞

發佈日期: 2025年06月11日

風險: 中度風險

類型: 伺服器 - 網站伺服器

於 Apache Kafka發現一個漏洞。遠端攻擊者可利用這個漏洞，於目標系統觸發權限提升及敏感資料洩露。

 

---

影響

• 權限提升
• 資料洩露

---

受影響之系統或技術

• Apache Kafka Client 3.1.0 至 3.9.0

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• Apache Kafka Client 4.0.0 版本

---

漏洞識別碼

• CVE-2025-27817

---

資料來源

• Apache

---

相關連結

• https://lists.apache.org/thread/ok29h7h0l5hwpoq9v4nlfngvzz71ndvs

Apache Kafka Elevation of Privilege Vulnerability

Release Date: 11 Jun 2025

RISK: Medium Risk

TYPE: Servers - Web Servers

A vulnerability was identified in Apache Kafka. A remote attacker could exploit this vulnerability to trigger elevation of privilege and sensitive information disclosure on the targeted system.

 

 

---

Impact

• Elevation of Privilege
• Information Disclosure

---

System / Technologies affected

• Apache Kafka Client versions 3.1.0 through 3.9.0

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• Apache Kafka Client version 4.0.0

---

Vulnerability Identifier

• CVE-2025-27817

---

Source

• Apache

---

Related Link

• https://lists.apache.org/thread/ok29h7h0l5hwpoq9v4nlfngvzz71ndvs

Fortinet 產品多個漏洞

發佈日期: 2025年06月11日

風險: 中度風險

類型: 操作系統 - Network

於 Fortinet 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升、遠端執行任意程式碼、洩露敏感資料、繞過保安限制、篡改及仿冒。

---

影響

• 遠端執行程式碼
• 資料洩露
• 繞過保安限制
• 篡改
• 仿冒
• 權限提升

---

受影響之系統或技術

FortiOS

• FortiOS 6.2 所有版本
• FortiOS 6.4 所有版本
• FortiOS 7.0 所有版本
• FortiOS 7.2 所有版本
• FortiOS 7.4.0 至 7.4.7
• FortiOS 7.6.0 至 7.6.1

FortiProxy

• FortiProxy 1.1 所有版本
• FortiProxy 1.2 所有版本
• FortiProxy 2.0 所有版本
• FortiProxy 7.0.0 至 7.0.20
• FortiProxy 7.2.0 所有版本
• FortiProxy 7.4.0 至 7.4.8
• FortiProxy 7.6.0 至 7.6.2

FortiClientWindows

• FortiClientWindows 7.0 所有版本
• FortiClientWindows 7.2 至 7.2.6
• FortiClientWindows 7.4.0

FortiClientEMS

• FortiClientEMS 6.2 所有版本
• FortiClientEMS 6.4 所有版本
• FortiClientEMS 7.0 所有版本
• FortiClientEMS 7.2.0 至 7.2.6
• FortiClientEMS 7.4.0 至 7.4.1

FortiWeb

• FortiWeb 7.4.0 至 7.4.4
• FortiWeb 7.6.0 至 7.6.1

FortiSASE

• FortiSASE 24.4.b
• FortiSASE 25.1.a.2
• FortiSASE 25.1.c

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://fortiguard.fortinet.com/psirt/FG-IR-23-008
• https://fortiguard.fortinet.com/psirt/FG-IR-23-342
• https://fortiguard.fortinet.com/psirt/FG-IR-23-375
• https://fortiguard.fortinet.com/psirt/FG-IR-24-058
• https://fortiguard.fortinet.com/psirt/FG-IR-24-257
• https://fortiguard.fortinet.com/psirt/FG-IR-24-287
• https://fortiguard.fortinet.com/psirt/FG-IR-24-339
• https://fortiguard.fortinet.com/psirt/FG-IR-24-365
• https://fortiguard.fortinet.com/psirt/FG-IR-24-385
• https://fortiguard.fortinet.com/psirt/FG-IR-24-544
• https://fortiguard.fortinet.com/psirt/FG-IR-25-006

---

漏洞識別碼

• CVE-2023-29184
• CVE-2023-48786
• CVE-2024-32119
• CVE-2024-50562
• CVE-2024-50568
• CVE-2024-54019
• CVE-2025-22251
• CVE-2025-22254
• CVE-2025-22862
• CVE-2025-24471
• CVE-2025-25250

---

資料來源

• Fortinet

---

相關連結

• https://fortiguard.fortinet.com/psirt/FG-IR-23-008
• https://fortiguard.fortinet.com/psirt/FG-IR-23-342
• https://fortiguard.fortinet.com/psirt/FG-IR-23-375
• https://fortiguard.fortinet.com/psirt/FG-IR-24-058
• https://fortiguard.fortinet.com/psirt/FG-IR-24-257
• https://fortiguard.fortinet.com/psirt/FG-IR-24-287
• https://fortiguard.fortinet.com/psirt/FG-IR-24-339
• https://fortiguard.fortinet.com/psirt/FG-IR-24-365
• https://fortiguard.fortinet.com/psirt/FG-IR-24-385
• https://fortiguard.fortinet.com/psirt/FG-IR-24-544
• https://fortiguard.fortinet.com/psirt/FG-IR-25-006

Fortinet Products Multiple Vulnerabilities

Release Date: 11 Jun 2025

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

Multiple vulnerabilities were identified in Fortinet Products. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution, sensitive information disclosure, security restriction bypass, data manipulation and spoofing on the targeted system.

---

Impact

• Remote Code Execution
• Information Disclosure
• Security Restriction Bypass
• Data Manipulation
• Spoofing
• Elevation of Privilege

---

System / Technologies affected

FortiOS

• FortiOS 6.2 all versions
• FortiOS 6.4 all versions
• FortiOS 7.0 all versions
• FortiOS 7.2 all versions
• FortiOS 7.4.0 through 7.4.7
• FortiOS 7.6.0 through 7.6.1

FortiProxy

• FortiProxy 1.1 all versions
• FortiProxy 1.2 all versions
• FortiProxy 2.0 all versions
• FortiProxy 7.0.0 through 7.0.20
• FortiProxy 7.2.0 all versions
• FortiProxy 7.4.0 through 7.4.8
• FortiProxy 7.6.0 through 7.6.2

FortiClientWindows

• FortiClientWindows 7.0 all versions
• FortiClientWindows 7.2 through 7.2.6
• FortiClientWindows 7.4.0

FortiClientEMS

• FortiClientEMS 6.2 all versions
• FortiClientEMS 6.4 all versions
• FortiClientEMS 7.0 all versions
• FortiClientEMS 7.2.0 through 7.2.6
• FortiClientEMS 7.4.0 through 7.4.1

FortiWeb

• FortiWeb 7.4.0 through 7.4.6
• FortiWeb 7.6.0 through 7.6.1

FortiSASE

• FortiSASE 24.4.b
• FortiSASE 25.1.a.2
• FortiSASE 25.1.c

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://fortiguard.fortinet.com/psirt/FG-IR-23-008
• https://fortiguard.fortinet.com/psirt/FG-IR-23-342
• https://fortiguard.fortinet.com/psirt/FG-IR-23-375
• https://fortiguard.fortinet.com/psirt/FG-IR-24-058
• https://fortiguard.fortinet.com/psirt/FG-IR-24-257
• https://fortiguard.fortinet.com/psirt/FG-IR-24-287
• https://fortiguard.fortinet.com/psirt/FG-IR-24-339
• https://fortiguard.fortinet.com/psirt/FG-IR-24-365
• https://fortiguard.fortinet.com/psirt/FG-IR-24-385
• https://fortiguard.fortinet.com/psirt/FG-IR-24-544
• https://fortiguard.fortinet.com/psirt/FG-IR-25-006

---

Vulnerability Identifier

• CVE-2023-29184
• CVE-2023-48786
• CVE-2024-32119
• CVE-2024-50562
• CVE-2024-50568
• CVE-2024-54019
• CVE-2025-22251
• CVE-2025-22254
• CVE-2025-22862
• CVE-2025-24471
• CVE-2025-25250

---

Source

• Fortinet

---

Related Link

• https://fortiguard.fortinet.com/psirt/FG-IR-23-008
• https://fortiguard.fortinet.com/psirt/FG-IR-23-342
• https://fortiguard.fortinet.com/psirt/FG-IR-23-375
• https://fortiguard.fortinet.com/psirt/FG-IR-24-058
• https://fortiguard.fortinet.com/psirt/FG-IR-24-257
• https://fortiguard.fortinet.com/psirt/FG-IR-24-287
• https://fortiguard.fortinet.com/psirt/FG-IR-24-339
• https://fortiguard.fortinet.com/psirt/FG-IR-24-365
• https://fortiguard.fortinet.com/psirt/FG-IR-24-385
• https://fortiguard.fortinet.com/psirt/FG-IR-24-544
• https://fortiguard.fortinet.com/psirt/FG-IR-25-006

Google Chrome 多個漏洞

發佈日期: 2025年06月11日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。

---

影響

• 阻斷服務
• 遠端執行程式碼

---

受影響之系統或技術

• Google Chrome 137.0.7151.103 (Linux) 之前的版本
• Google Chrome 137.0.7151.103/.104 (Mac) 之前的版本
• Google Chrome 137.0.7151.103/.104 (Windows) 之前的版本
• Google Chrome 137.0.7151.89 (Android) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 137.0.7151.103 (Linux) 或之後版本
• 更新至 137.0.7151.103/.104 (Mac) 或之後版本
• 更新至 137.0.7151.103/.104 (Windows) 或之後版本
• 更新至 137.0.7151.89 (Android) 或之後版本

---

漏洞識別碼

• CVE-2025-5958
• CVE-2025-5959

---

資料來源

• Chrome

---

相關連結

• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html
• https://chromereleases.googleblog.com/2025/06/chrome-for-android-update_0960553905.html

Google Chrome Multiple Vulnerabilities

Release Date: 11 Jun 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service and remote code execution on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution

---

System / Technologies affected

• Google Chrome prior to 137.0.7151.103 (Linux)
• Google Chrome prior to 137.0.7151.103/.104 (Mac)
• Google Chrome prior to 137.0.7151.103/.104 (Windows)
• Google Chrome prior to 137.0.7151.89 (Android)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 137.0.7151.103 (Linux) or later
• Update to version 137.0.7151.103/.104 (Mac) or later
• Update to version 137.0.7151.103/.104 (Windows) or later
• Update to version 137.0.7151.89 (Android) or later

---

Vulnerability Identifier

• CVE-2025-5958
• CVE-2025-5959

---

Source

• Chrome

---

Related Link

• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html
• https://chromereleases.googleblog.com/2025/06/chrome-for-android-update_0960553905.html

Mozilla 產品多個漏洞

發佈日期: 2025年06月11日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務、繞過保安限制及敏感資料洩露。

 

---

影響

• 資料洩露
• 阻斷服務
• 繞過保安限制

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Thunderbird 128.11.1
• Thunderbird 139.0.2
• Firefox 139.0.4

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Thunderbird 128.11.1
• Thunderbird 139.0.2
• Firefox 139.0.4

---

漏洞識別碼

• CVE-2025-5986
• CVE-2025-49709
• CVE-2025-49710

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-47/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-50/

Mozilla Products Multiple Vulnerabilities

Release Date: 11 Jun 2025

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, security restriction bypass and sensitive information disclosure on the targeted system.

---

Impact

• Information Disclosure
• Denial of Service
• Security Restriction Bypass

---

System / Technologies affected

Versions prior to:

 

• Thunderbird 128.11.1
• Thunderbird 139.0.2
• Firefox 139.0.4

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Thunderbird 128.11.1
• Thunderbird 139.0.2
• Firefox 139.0.4

---

Vulnerability Identifier

• CVE-2025-5986
• CVE-2025-49709
• CVE-2025-49710

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-47/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-50/

Adobe 每月保安更新 (2025年6月)

發佈日期: 2025年06月11日

風險: 中度風險

類型: 用戶端 - 辦公室應用

Adobe已為產品提供本月保安更新：

 

受影響產品	風險程度	影響	備註	詳情（包括 CVE）
Adobe InCopy	中度風險	遠端執行程式碼		APSB25-41
Adobe Experience Manager	中度風險	權限提升 遠端執行程式碼 跨網站指令碼 繞過保安限制		APSB25-48
Adobe Commerce	中度風險	跨網站指令碼 遠端執行程式碼 繞過保安限制 權限提升		APSB25-50
Adobe InDesign	中度風險	遠端執行程式碼 資料洩露 阻斷服務		APSB25-53
Substance 3D Sampler	中度風險	遠端執行程式碼		APSB25-55
Adobe Acrobat and Reader	中度風險	遠端執行程式碼 資料洩露 阻斷服務 繞過保安限制		APSB25-57
Substance 3D Painter	中度風險	遠端執行程式碼		APSB25-58

 

「極高度風險」產品數目：0

「高度風險」產品數目：0

「中度風險」產品數目：7

「低度風險」產品數目：0

整體「風險程度」評估：中度風險

---

影響

• 遠端執行程式碼
• 權限提升
• 跨網站指令碼
• 繞過保安限制
• 資料洩露
• 阻斷服務

---

受影響之系統或技術

• Adobe InCopy  20.2 及以前版本
• Adobe InCopy  19.5.3 及以前版本
• Adobe Experience Manager (AEM) AEM Cloud Service (CS)
• Adobe Experience Manager (AEM) 6.5.22 及以前版本
• Adobe Commerce 2.4.8 2.4.7-p5 及以前版本
• Adobe Commerce B2B 1.5.2 及以前版本
• Magento Open Source 2.4.8 2.4.7-p5 及以前版本
• Adobe InDesign ID20.2 及以前版本
• Adobe InDesign ID19.5.3 及以前版本
• Adobe Substance 3D Sampler 5.0 及以前版本
• Acrobat DC 25.001.20521 及以前版本
• Acrobat Reader DC 25.001.20521 及以前版本
• Acrobat 2024 24.001.30235 及以前版本
• Acrobat 2020 20.005.30763 及以前版本
• Acrobat Reader 2020 20.005.30763 及以前版本
• Adobe Substance 3D Painter 11.0.1 及以前版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 安裝供應商提供的修補程式。個別產品詳情可參考上表「詳情」一欄或執行軟件更新。

---

漏洞識別碼

• https://www.cvedetails.com/vulnerability-list.php?vendor_id=53&year=2025&month=06

---

資料來源

• Adobe

---

相關連結

• https://helpx.adobe.com/security.html/security/security-bulletin.html

Adobe Monthly Security Update (June 2025)

Release Date: 11 Jun 2025

RISK: Medium Risk

TYPE: Clients - Productivity Products

Adobe has released monthly security update for their products:

 

Vulnerable Product	Risk Level	Impacts	Notes	Details (including CVE)
Adobe InCopy	Medium Risk	Remote Code Execution		APSB25-41
Adobe Experience Manager	Medium Risk	Elevation of Privilege Remote Code Execution Cross-site Scripting Security Restriction Bypass		APSB25-48
Adobe Commerce	Medium Risk	Cross-site Scripting Remote Code Execution Security Restriction Bypass Elevation of Privilege		APSB25-50
Adobe InDesign	Medium Risk	Remote Code Execution Information Disclosure Denial of Service		APSB25-53
Substance 3D Sampler	Medium Risk	Remote Code Execution		APSB25-55
Adobe Acrobat and Reader	Medium Risk	Remote Code Execution Information Disclosure Denial of Service Security Restriction Bypass		APSB25-57
Substance 3D Painter	Medium Risk	Remote Code Execution		APSB25-58

 

Number of 'Extremely High Risk' product(s): 0

Number of 'High Risk' product(s): 0

Number of 'Medium Risk' product(s): 7

Number of 'Low Risk' product(s): 0

Evaluation of overall 'Risk Level': Medium Risk

---

Impact

• Remote Code Execution
• Elevation of Privilege
• Cross-Site Scripting
• Security Restriction Bypass
• Information Disclosure
• Denial of Service

---

System / Technologies affected

• Adobe InCopy  20.2 and earlier versions
• Adobe InCopy  19.5.3 and earlier versions
• Adobe Experience Manager (AEM) AEM Cloud Service (CS)
• Adobe Experience Manager (AEM) 6.5.22 and earlier versions
• Adobe Commerce 2.4.8 2.4.7-p5 and earlier versions
• Adobe Commerce B2B 1.5.2 and earlier versions
• Magento Open Source 2.4.8 2.4.7-p5 and earlier versions
• Adobe InDesign ID20.2 and earlier versions
• Adobe InDesign ID19.5.3 and earlier versions
• Adobe Substance 3D Sampler 5.0 and earlier versions
• Acrobat DC 25.001.20521 and earlier versions
• Acrobat Reader DC 25.001.20521 and earlier versions
• Acrobat 2024 24.001.30235 and earlier versions
• Acrobat 2020 20.005.30763 and earlier versions
• Acrobat Reader 2020 20.005.30763 and earlier versions
• Adobe Substance 3D Painter 11.0.1 and earlier versions

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Apply fixes issued by the vendor. Please refer to 'Details' column in the above table for details of individual product update or run software update.

---

Vulnerability Identifier

• https://www.cvedetails.com/vulnerability-list.php?vendor_id=53&year=2025&month=06

---

Source

• Adobe

---

Related Link

• https://helpx.adobe.com/security.html/security/security-bulletin.html