CVE-2025-46406 – “Schneider Electric Command Centre Server Privilege Escalation”

July 10, 2025

CVE ID : CVE-2025-46406

Published : July 10, 2025, 3:15 a.m. | 49 minutes ago

Description : A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.

This issue affects Command Centre Server:

9.30 prior to 9.30.1874 (MR1), 9.20 prior to 9.20.2337 (MR3), 9.10 prior to 9.10.3194 (MR6), 9.00 prior to 9.00.3371 (MR7), all versions of 8.90 and prior.

Severity: 5.6 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-53748 – Apache HTTP Server Authentication Bypass

Next Article CVE-2025-53746 – Apache HTTP Server Unvalidated User Input

Highlights

CVE-2025-52968 – xdg-utils CSRF Vulnerability

June 23, 2025

CVE ID : CVE-2025-52968

Published : June 23, 2025, 3:15 p.m. | 3 hours, 9 minutes ago

Description : xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.

Severity: 2.7 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Newest LF Decentralized Trust Lab HOPrS identifies if photos have been altered

Coder reimagines development environments to make them more ideal for AI agents

Report: AI coding productivity gains cancelled out by other friction points that slow developers down

15 Proven Benefits of Outsourcing Node.js Development for Large Organizations

How passkeys work: Do your favorite sites even support passkeys?

Samsung Galaxy Z Fold 7 vs. Z Fold 6: I tried both phones, and the difference is dramatic

Cor, blimey! The ASUS ROG Ally drops to its lowest-ever price for Amazon Prime Day in the UK — the only Windows handheld to permanently replace my Steam Deck

Owlcat Games talks to us about about WH40K: Rogue Trader, the next game ‘Dark Heresy’ — and how the studio feels about working with Xbox Game Pass

Cally – Small, feature-rich calendar components

Cally – Small, feature-rich calendar components

Working with the Command Line and WP-CLI

Access to Care Is Evolving: What Consumer Insights and Behavior Models Reveal

Cor, blimey! The ASUS ROG Ally drops to its lowest-ever price for Amazon Prime Day in the UK — the only Windows handheld to permanently replace my Steam Deck

Cor, blimey! The ASUS ROG Ally drops to its lowest-ever price for Amazon Prime Day in the UK — the only Windows handheld to permanently replace my Steam Deck

Owlcat Games talks to us about about WH40K: Rogue Trader, the next game ‘Dark Heresy’ — and how the studio feels about working with Xbox Game Pass

Microsoft says ‘we have threads at home’ — rolls out feature Slack has had for years

CVE-2025-46406 – “Schneider Electric Command Centre Server Privilege Escalation”

CVE-2025-0139 – Palo Alto Networks Autonomous Digital Experience Manager Privilege Escalation Vulnerability

CVE-2025-0140 – Palo Alto Networks GlobalProtect App Privilege Escalation Vulnerability

CVE-2025-6310 – PHPGurukul Emergency Ambulance Hiring Portal SQL Injection Vulnerability

CVE-2025-5316 – “Apache Log4j Remote Code Execution Vulnerability”

AT&T customer? You might get a cut of $177 million data breach settlement

CVE-2025-41234 – VMware Spring Framework Reflected File Download Vulnerability

CVE-2025-52968 – xdg-utils CSRF Vulnerability

Design for the AI age

FidoCadJ is a graphical editor for electronics

Centralize HTTP Client Configuration with Laravel’s globalOptions Method

CVE-2025-46406 – “Schneider Electric Command Centre Server Privilege Escalation”

Related Posts