CVE-2025-0501

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-05029.1Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 b CVE-2025-05035.3Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs an CVE-2025-05045.4Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Man CVE-2025-050510.0On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on CVE-2025-05065.4The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag param CVE-2025-05076.4The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes CVE-2025-05085.9A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all ver CVE-2025-05096.8A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassin CVE-2025-05106.5Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-CVE-2025-05116.1The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and CVE-2025-05125.4The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_busine CVE-2025-05135.4In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the