🚨 CVE-2025-24288: CRITICAL vuln in Versa Director (21.2.2–22.1.4). Exposed default creds + open SSH/Postgres. No active exploitation yet, but PoC is out. Change passwords & audit logs! https://radar.offseq.com/threat/cve-2025-24288-vulnerability-in-versa-director-5ce1cb7a #OffSeq #Vulnerability #Cybersecurity

🚨 CRITICAL: Veeam Backup & Recovery 12.3.1 hit by RCE (CVE-2025-23121). Authenticated domain users can run code on backup servers—serious risk to data integrity & DR. Restrict access, monitor logs, prep for patches. https://radar.offseq.com/threat/cve-2025-23121-vulnerability-in-veeam-backup-and-r-3bbfd184 #OffSeq #Veeam #RCE #BlueTeam

Critical Veeam Backup Flaws Open Doors to Remote Code Execution: Urgent Patch Advised

Veeam Hit by Multiple High-Severity Security Vulnerabilities In a worrying turn for IT administrators and enterprises relying on Veeam’s data protection ecosystem, the company has disclosed several critical vulnerabilities affecting its Backup & Replication and Agent software. Chief among them is CVE-2025-23121, a flaw that carries a staggering CVSS score of 9.9, indicating…

https://undercodenews.com/critical-veeam-backup-flaws-open-doors-to-remote-code-execution-urgent-patch-advised/

Multiple security vulnerabilities patched in Veeam Backup & Replication, one critical

Veeam has patched three security vulnerabilities in their backup software, including a critical remote code execution vulnerability (CVE-2025-23121) that allows any authenticated domain user to execute code on domain-joined backup servers.

**If you use Veeam Backup & Replication or Veeam Agent for Windows, review the flaws and plan a patch cycle. The critical flaw is applicable if your Veeam server is joined to your Active Directory domain, so check that first.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-security-vulnerabilities-patched-in-veeam-backup-replication-one-critical-e-l-k-p-v/gD2P6Ple2L

Multiple security vulnerabilities patched in Veeam Backup & Replication, one critical

Veeam has patched three security vulnerabilities in their backup software, including a critical remote code execution vulnerability (CVE-2025-23121) that allows any authenticated domain user to execute code on domain-joined backup servers.

**If you use Veeam Backup & Replication or Veeam Agent for Windows, review the flaws and plan a patch cycle. The critical flaw is applicable if your Veeam server is joined to your Active Directory domain, so check that first.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-security-vulnerabilities-patched-in-veeam-backup-replication-one-critical-e-l-k-p-v/gD2P6Ple2L

Faille dans Veeam : n’importe quel utilisateur du domaine peut compromettre le serveur ! https://www.it-connect.fr/faille-veeam-cve-2025-23121/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Veeam

Veeam Patches CVE-2025-23121: Critical RCE Bug Rated 9.9 CVSS in Backup & Replication https://thehackernews.com/2025/06/veeam-patches-cve-2025-23121-critical.html

Veeam Patches CVE-2025-23121: Critical RCE Bug Rated 9.9 CVSS in Backup & Replication https://thehackernews.com/2025/06/veeam-patches-cve-2025-23121-critical.html

Veeam Patches CVE-2025-23121: Critical RCE Bug Rated 9.9 CVSS in Backup & Replication https://thehackernews.com/2025/06/veeam-patches-cve-2025-23121-critical.html

One of these has been evaluated as sev:CRIT.

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

https://nvd.nist.gov/vuln/detail/CVE-2025-6192

One of these has been evaluated as sev:CRIT.

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

https://nvd.nist.gov/vuln/detail/CVE-2025-6192

New.

Cisco has listed a couple of vulnerabilities.

- Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability (high) - CVE-2025-20271 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-sM5GCfm7

- ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability (medium) - CVE-2025-20234 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy @TalosSecurity #cybersecurity #infosec #Cisco

New.

Cisco has listed a couple of vulnerabilities.

- Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability (high) - CVE-2025-20271 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-sM5GCfm7

- ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability (medium) - CVE-2025-20234 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy @TalosSecurity #cybersecurity #infosec #Cisco

New.

Cisco has listed a couple of vulnerabilities.

- Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability (high) - CVE-2025-20271 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-sM5GCfm7

- ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability (medium) - CVE-2025-20234 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy @TalosSecurity #cybersecurity #infosec #Cisco

New.

Cisco has listed a couple of vulnerabilities.

- Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability (high) - CVE-2025-20271 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-sM5GCfm7

- ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability (medium) - CVE-2025-20234 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy @TalosSecurity #cybersecurity #infosec #Cisco

We've released the Netty Incubator QUIC codec version 0.0.73.Final.
This includes an updated version of Quiche which fixes CVE-2025-4820 and CVE-2025-4821.
See the release notes: https://netty.io/news/2025/06/18/quic-0-0-73-Final.html
#netty #java

Go DoS more Cloudflare shit.

https://github.com/cloudflare/quiche/security/advisories/GHSA-2v9p-3p3h-w56j

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support.

https://nvd.nist.gov/vuln/detail/CVE-2025-4820

https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.

https://nvd.nist.gov/vuln/detail/CVE-2025-4821

We've released the Netty Incubator QUIC codec version 0.0.73.Final.
This includes an updated version of Quiche which fixes CVE-2025-4820 and CVE-2025-4821.
See the release notes: https://netty.io/news/2025/06/18/quic-0-0-73-Final.html
#netty #java

Go DoS more Cloudflare shit.

https://github.com/cloudflare/quiche/security/advisories/GHSA-2v9p-3p3h-w56j

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support.

https://nvd.nist.gov/vuln/detail/CVE-2025-4820

https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.

https://nvd.nist.gov/vuln/detail/CVE-2025-4821

We've released the Netty Incubator QUIC codec version 0.0.73.Final.
This includes an updated version of Quiche which fixes CVE-2025-4820 and CVE-2025-4821.
See the release notes: https://netty.io/news/2025/06/18/quic-0-0-73-Final.html
#netty #java

Go DoS more Cloudflare shit.

https://github.com/cloudflare/quiche/security/advisories/GHSA-2v9p-3p3h-w56j

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support.

https://nvd.nist.gov/vuln/detail/CVE-2025-4820

https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.

https://nvd.nist.gov/vuln/detail/CVE-2025-4821

We've released the Netty Incubator QUIC codec version 0.0.73.Final.
This includes an updated version of Quiche which fixes CVE-2025-4820 and CVE-2025-4821.
See the release notes: https://netty.io/news/2025/06/18/quic-0-0-73-Final.html
#netty #java

Go DoS more Cloudflare shit.

https://github.com/cloudflare/quiche/security/advisories/GHSA-2v9p-3p3h-w56j

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support.

https://nvd.nist.gov/vuln/detail/CVE-2025-4820

https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.

https://nvd.nist.gov/vuln/detail/CVE-2025-4821

Hardcoded password in EoL D-Link VoIP phones.

https://cybermaya.in/posts/Post-37/

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially leading to unauthorized access to device functions or user accounts. This vulnerability exists due to insecure storage of sensitive information in the firmware binary.

https://nvd.nist.gov/vuln/detail/CVE-2025-45784

Hardcoded password in EoL D-Link VoIP phones.

https://cybermaya.in/posts/Post-37/

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially leading to unauthorized access to device functions or user accounts. This vulnerability exists due to insecure storage of sensitive information in the firmware binary.

https://nvd.nist.gov/vuln/detail/CVE-2025-45784

@DiogoConstantino https://ubuntu.com/security/CVE-2023-0386

米当局、Linuxカーネルの脆弱性悪用に注意喚起 - Security NEXT
Security NEXT

米当局は、「Linuxカーネル」の既知脆弱性「CVE-2023-0386」が悪用されているとして注意喚起を行った。 ：Security NEXT.
https://www.security-next.com/171506

Critical Linux Kernel Flaw Exploited: CISA Flags CVE-2023-0386 in Active Attacks

Introduction: A Wake-Up Call for Linux Systems The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has raised alarms once again by adding a significant Linux vulnerability—CVE-2023-0386—to its Known Exploited Vulnerabilities (KEV) catalog. This move is not just bureaucratic red tape; it signals that this flaw is actively being exploited in the wild. Targeting the widely-used…

https://undercodenews.com/critical-linux-kernel-flaw-exploited-cisa-flags-cve-2023-0386-in-active-attacks/

CISA Issues Urgent Warning Over Exploited Linux Kernel Vulnerability: CVE-2023-0386

CISA's High-Priority Alert for Linux Systems The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning to all U.S. federal agencies following the discovery of an actively exploited vulnerability in the Linux kernel. Known as CVE-2023-0386, this security flaw lies within the OverlayFS subsystem and allows attackers to gain root access, elevating local user…

https://undercodenews.com/cisa-issues-urgent-warning-over-exploited-linux-kernel-vulnerability-cve-2023-0386/

Linux users: imagine your system's hidden door left wide open. CVE-2023-0386 lets attackers snag root access in popular distros. Is your setup at risk? Dive in to learn more before it’s too late.

https://thedefendopsdiaries.com/understanding-cve-2023-0386-a-critical-linux-vulnerability/

#cve20230386
#linuxvulnerability
#overlayfs
#cybersecurity
#linuxsecurity

@DiogoConstantino https://ubuntu.com/security/CVE-2023-0386

CISA Flags CVE-2023-0386 as Actively Exploited Linux Kernel Privilege Escalation Threat https://thecyberexpress.com/cisa-warns-cve-2023-0386-linux-vulnerability/ #LinuxKernelPrivilegeEscalation #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE20230386 #Linuxkernel #CyberNews

CVE ID: CVE-2023-0386
Vendor: Linux
Product: Kernel
Date Added: 2025-06-17
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a ; https://access.redhat.com/security/cve/cve-2023-0386 ; https://security.netapp.com/advisory/ntap-20230420-0004/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-0386
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-0386

New.

CISA has added one entry to the KEV catalogue.

- CVE-2023-0386: Linux Kernel Improper Ownership Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-0386 #CISA #cybersecurity #infosec #Linux

Oh my. Check your Teleport, especially if on Community Edition.

https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.

https://nvd.nist.gov/vuln/detail/CVE-2025-49825

Go hack more AI shit.

https://github.com/langgenius/dify/security/advisories/GHSA-grmh-ww4v-5cgj

Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.

https://nvd.nist.gov/vuln/detail/CVE-2025-49149

Listed today.

NVIDIA NVDebug Tool - June 2025 - CVE-2025-23252, medium severity https://www.nvidia.com/en-us/product-security/

https://nvidia.custhelp.com/app/answers/detail/a_id/5651 #cybersecurity #infosec #Nvidia

Get ready to explain some things to some youngsters for this one. Undocumented root shell access on SIMCom modem.

https://sec-consult.com/vulnerability-lab/advisory/undocumented-root-shell-access-on-simcom-modem/

sev:MED

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands.

https://nvd.nist.gov/vuln/detail/CVE-2025-26412

RCE in KDE Konsole.

https://kde.org/info/security/advisory-20250609-1.txt

sev:HIGH 8.2 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L

KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.

https://nvd.nist.gov/vuln/detail/CVE-2025-49091

There are a couple other Tomcat CVEs folks might be interested in too.

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv

https://nvd.nist.gov/vuln/detail/CVE-2025-49124

and

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18

https://nvd.nist.gov/vuln/detail/CVE-2025-48988

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

DoS in Absolute Secure Access Server ( FKA NetMotion ).

https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-49080

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

Two more.

https://nvd.nist.gov/vuln/detail/CVE-2025-34510

https://nvd.nist.gov/vuln/detail/CVE-2025-34511

We've got one CVE for tracking so far.

https://nvd.nist.gov/vuln/detail/CVE-2025-34509

Two more.

https://nvd.nist.gov/vuln/detail/CVE-2025-34510

https://nvd.nist.gov/vuln/detail/CVE-2025-34511

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

PrivEsc in IBM i.

https://www.ibm.com/support/pages/node/7237040

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege.

https://nvd.nist.gov/vuln/detail/CVE-2025-33122

cc: @buherator since IIRC you were interested in IBM i things.

PrivEsc in linux-pam.

https://www.openwall.com/lists/oss-security/2025/06/17/1

https://access.redhat.com/security/cve/CVE-2025-6020

sev:HIGH 7.8 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

https://nvd.nist.gov/vuln/detail/CVE-2025-6020

I know some of you like a good race.

https://github.com/conda/conda-build/security/advisories/GHSA-vfp6-3v8g-vcmm

sev:MED 6.0 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, The write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access to all users. Attackers with filesystem access can exploit a race condition to overwrite the script before execution, enabling arbitrary code execution under the victim's privileges. This risk is significant in shared environments, potentially leading to full system compromise. Even with non-static directory names, attackers can monitor parent directories for file creation events. The brief window between script creation (with insecure permissions) and execution allows rapid overwrites. Directory names can also be inferred via timestamps or logs, and automation enables exploitation even with semi-randomized paths by acting within milliseconds of detection. This issue has been patched in version 25.3.1. A workaround involves restricting conda_build.sh permissions from 0o766 to 0o700 (owner-only read/write/execute). Additionally, use atomic file creation (write to a temporary randomized filename and rename atomically) to minimize the race condition window.

https://nvd.nist.gov/vuln/detail/CVE-2025-32797

Three DoS CVEs in libxml.

https://access.redhat.com/security/cve/CVE-2025-49794

https://access.redhat.com/security/cve/CVE-2025-49795

https://access.redhat.com/security/cve/CVE-2025-49796

There are a couple other Tomcat CVEs folks might be interested in too.

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105.

https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv

https://nvd.nist.gov/vuln/detail/CVE-2025-49124

and

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18

https://nvd.nist.gov/vuln/detail/CVE-2025-48988

Microsoft Outlook menacé par une nouvelle faille de sécurité et des attaques Zero-click : CVE-2025-47176 https://www.it-connect.fr/microsoft-outlook-menace-par-une-nouvelle-faille-de-securite-et-des-attaques-zero-click-cve-2025-47176/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #Outlook

近日，微软官方发布安全公告，确认其电子邮件客户端 Microsoft Outlook 存在一个 高危漏洞（CVE-2025-47176），攻击者可借此在目标系统上远程执行任意代码。尽管漏洞本质上为本地攻击向量，但其危害范围及利用条件使其具备远程利用的可能性。

微软已确认该漏洞的严重性，但当前 Microsoft 365 尚未发布修复补丁，预计将于后续版本中推送。微软承诺将在第一时间更新 CVE 页面以通知用户。
@board

Posted yesterday, if you missed it.

Trend Micro: Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html @TrendMicro #cybersecurity #infosec

More on the Langflow vuln ( CVE-2025-3248 ). In case you haven't followed it, it's hilarious. Literally rawdogging input to exec(). LMAO. People are going to keep trusting this shit.

Go hack more AI shit.

https://www.offsec.com/blog/cve-2025-3248/

#threatIntel

Flodrix Botnet Targets Langflow Servers via Critical Vulnerability: CVE-2025-3248

Langflow's AI Infrastructure Under Siege A dangerous new campaign has emerged in the cybersecurity landscape, exploiting a critical vulnerability in Langflow—an AI workflow builder. According to Trend Micro Research, attackers are actively leveraging CVE-2025-3248, a severe remote code execution (RCE) flaw, to install a new variant of the Flodrix botnet. This malware is capable of…

https://undercodenews.com/flodrix-botnet-targets-langflow-servers-via-critical-vulnerability-cve-2025-3248/

Posted yesterday, if you missed it.

Trend Micro: Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html @TrendMicro #cybersecurity #infosec

More on the Langflow vuln ( CVE-2025-3248 ). In case you haven't followed it, it's hilarious. Literally rawdogging input to exec(). LMAO. People are going to keep trusting this shit.

Go hack more AI shit.

https://www.offsec.com/blog/cve-2025-3248/

#threatIntel

Trend Micro: Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html @TrendMicro #cybersecurity #infosec

Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html

TrendMicro write-up on EITW exploitation of CVE-2025-3248 ( code exec in Langflow ). It's been EITW for at least a month or two but this is specifically about delivering Flodrix. Includes payloads and IOCs.

https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html

#threatIntel

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

🛡️ CVE-2025-49220: CRITICAL RCE in Trend Micro Apex Central <8.0.7007 via insecure deserialization (pre-auth). Major risk for EU orgs—restrict access, monitor, and prep for patch. https://radar.offseq.com/threat/cve-2025-49220-cwe-477-use-of-obsolete-function-in-e3f981fc #OffSeq #Vulnerability #InfoSec

Ooh, two very similar sev:CRIT CVEs for Trend Micro Apex Central.

https://success.trendmicro.com/en-US/solution/KA-0019926

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations.

https://nvd.nist.gov/vuln/detail/CVE-2025-49219

https://nvd.nist.gov/vuln/detail/CVE-2025-49220

Ooh, two very similar sev:CRIT CVEs for Trend Micro Apex Central.

https://success.trendmicro.com/en-US/solution/KA-0019926

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations.

https://nvd.nist.gov/vuln/detail/CVE-2025-49219

https://nvd.nist.gov/vuln/detail/CVE-2025-49220

When's the over / under on CVE-2025-5689 being EITW? I'm going with Tuesday for public PoC. Thursday for public disclosure of EITW incident. KEV Catalog on Monday.

These are the screenshots regarding the two toots on

https://polymaths.social/@dendrobatus_azureus/statuses/01JXWNX73GE30935ANP4ZKAVC9

and

https://polymaths.social/@dendrobatus_azureus/statuses/01JXWNXSB086TGQHGWJ09DBG7P

https://nvd.nist.gov/vuln/detail/CVE-2025-5689

https://github.com/ubuntu/authd/security/advisories/GHSA-g8qw-mgjx-rwjr

#InfoSec #Root #authD #systemD #Linux #POSIX #GNU #GPL

CVE-2025-5689 😂🙃

Fire up your "anyone we don't know gets root!" account SSH sessions to gain unmitigated control over Ubuntu systems running "Systemd AuthD"

Clown shoes over there, ffs how is this even a real CVE 🤦🏼‍♀️

- https://nvd.nist.gov/vuln/detail/CVE-2025-5689
- https://github.com/ubuntu/authd/security/advisories/GHSA-g8qw-mgjx-rwjr

#systemd #uhuhuhubuntu #ubuntu #infosec #cve #noreally #linux #authd

CVE ID: CVE-2025-43200
Vendor: Apple
Product: Multiple Products
Date Added: 2025-06-16
Notes: https://support.apple.com/en-us/122174 ; https://support.apple.com/en-us/122173 ; https://support.apple.com/en-us/122900 ; https://support.apple.com/en-us/122901 ; https://support.apple.com/en-us/122902 ; https://support.apple.com/en-us/122903 ; https://support.apple.com/en-us/122904 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43200
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-43200

New. And TP-Link is baaaaaack.

CISA has added two items to the KEV catalogue:

- CVE-2025-43200: Apple Multiple Products Unspecified Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-43200

- CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-33538 #CISA #cybersecurity #infosec #Apple #TPLink

Paragon's Graphite Spyware targets European journalists through iPhone flaws

Forensic investigation by Citizen Lab confirmed that Paragon's Graphite spyware platform conducted zero-click attacks against European journalists using CVE-2025-43200, a critical iOS vulnerability that enabled remote code execution through maliciously crafted iCloud Link photos or videos sent via iMessage in early 2025. Apple patched the zero-day vulnerability in iOS 18.3.1 on February 10, 2025.

**You may not be a prominent journalist, but this flaw is already six months old, and even ordinary criminals will find a way to exploit it. Patch your iPhone and iPad to latest version ASAP!**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/paragon-s-graphite-spyware-targets-european-journalists-through-iphone-flaws-w-x-y-7-s/gD2P6Ple2L

iOS zero-click attacks used to deliver Graphite spyware (CVE-2025-43200) https://www.helpnetsecurity.com/2025/06/13/ios-zero-click-attacks-used-to-deliver-graphite-spyware-cve-2025-43200/ #governmentbackedattacks #AmnestyInternational #RecordedFuture #vulnerability #CitizenLab #Don'tmiss #Hotstuff #exploit #privacy #spyware #Europe #News #iOS

“Graphite Caught
First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted”
⬇️
“On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists that consented for the technical analysis of their cases. The key findings from our forensic analysis of their devices are summarized below:
Our analysis finds forensic evidence confirming with high confidence that both a prominent European journalist (who requests anonymity), and Italian journalist Ciro Pellegrino, were targeted with Paragon’s Graphite mercenary spyware.
We identify an indicator linking both cases to the same Paragon operator.
Apple confirms to us that the zero-click attack deployed in these cases was mitigated as of iOS 18.3.1 and has assigned the vulnerability CVE-2025-43200.”
👇

https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

#cyberveille #spyware #forensic

Security Week: Critical Vulnerability Patched in Citrix NetScaler https://www.securityweek.com/critical-vulnerability-patched-in-citrix-netscaler/ @SecurityWeek

Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_5349_and_CVE_2025_5777 #cybersecurity #infosec

Security Week: Critical Vulnerability Patched in Citrix NetScaler https://www.securityweek.com/critical-vulnerability-patched-in-citrix-netscaler/ @SecurityWeek

Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_5349_and_CVE_2025_5777 #cybersecurity #infosec

Security Week: Critical Vulnerability Patched in Citrix NetScaler https://www.securityweek.com/critical-vulnerability-patched-in-citrix-netscaler/ @SecurityWeek

Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_5349_and_CVE_2025_5777 #cybersecurity #infosec

Security Week: Critical Vulnerability Patched in Citrix NetScaler https://www.securityweek.com/critical-vulnerability-patched-in-citrix-netscaler/ @SecurityWeek

Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_5349_and_CVE_2025_5777 #cybersecurity #infosec

CVE-2025-34508: Another File Sharing Application, Another Path Traversal https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-traversal/

The CVE lists the CVSS assessment as a sev:MED here.

sev:MED 5.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service.

Retrieving the files of other users does not seem like VC:L. And a DoS does not seem like VA:L. But IDK, I'm just a random crow on the Internet.

https://nvd.nist.gov/vuln/detail/CVE-2025-34508

Another sev:CRIT ../ ? This time in ZendTo. LMAO. PoC in the post.

https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-traversal/

We discovered a path traversal vulnerability in ZendTo versions 6.15-7 and prior. This vulnerability allows malicious actors to bypass the security controls of the service to access or modify potentially sensitive information of other users. This issue is patched in 6.15-8, and we encourage all users to upgrade as soon as possible.

#directoryTraversalMemes

Local post-auth to DA in FreeIPA ( not like the beer in either part of that misleading project name ).

https://access.redhat.com/security/cve/CVE-2025-4404

sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

https://nvd.nist.gov/vuln/detail/CVE-2025-4404

Another flaw in ASUS Armoury Crate mainboard update system enables System-level privilege escalation

ASUS has patched a high-severity authorization bypass vulnerability (CVE-2025-3464) in its Armoury Crate system management software that allows attackers with existing system access to manipulate hard links and bypass driver security controls, potentially gaining complete operating system compromise through extensive low-level privileges.

**If you are running an ASUS mainboard on your computer, update the Armory Crate software. The exploit chain is complicated, but hackers have found a way to abuse it before, so they will find a way to abuse it again.**
#cybersecurity #infosec #advisory #ransomware
https://beyondmachines.net/event_details/another-flaw-in-asus-armoury-crate-mainboard-update-system-enables-system-level-privilege-escalation-i-6-s-j-9/gD2P6Ple2L

New.

ASUS has released an update for the Armory Crate App that addresses the CVE-2025-3464 vulnerability and other flaws https://www.asus.com/content/asus-product-security-advisory/ #ASUS #cybersecurity #infosec

ASUS with another vuln in their Armoury Crate app. Good thing ASUS auth bypasses haven't been a big deal or anything.

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2150

https://www.asus.com/content/asus-product-security-advisory/

sev:HIGH 8.4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass.

https://nvd.nist.gov/vuln/detail/CVE-2025-3464

Go hack some Cloudflare shit.

https://github.com/opennextjs/opennextjs-cloudflare

sev:HIGH 7.8 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.

This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next.

https://nvd.nist.gov/vuln/detail/CVE-2025-6087

Hey @greynoise, you think this might be the reason for all that recent Tomcat scanning?

https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk

When using PreResources or PostResources mounted other than at the root
of the web application, it was possible to access those resources via an
unexpected path. That path was likely not to be protected by the same
security constraints as the expected path, allowing those security
constraints to be bypassed.

Edit to include the CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-49125

Released Ring 1.14.2 to fix a vulnerability with Apache FileUpload (https://nvd.nist.gov/vuln/detail/CVE-2025-48976)

#clojure

Heads up CVE watchers! We just published CVE-2025-48976: Apache Commons FileUpload: DoS via part headers. Pick up version 1.6.0 or 2.0.0-M4 https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 #cve #apache #security

The vulnerability in question is CVE-2023-33538 (CVSS score: 8.8), a command injection bug that could result in the execution of arbitrary system commands when processing the ssid1 parameter in a specially crafted HTTP GET request. https://thehackernews.com/2025/06/tp-link-router-flaw-cve-2023-33538.html

TP-Link Router Flaw CVE-2023-33538 Under Active Exploit, CISA Issues Immediate Alert https://thehackernews.com/2025/06/tp-link-router-flaw-cve-2023-33538.html

TP-Link Router Flaw CVE-2023-33538 Under Active Exploit, CISA Issues Immediate Alert https://thehackernews.com/2025/06/tp-link-router-flaw-cve-2023-33538.html

TP-Link Router Flaw CVE-2023-33538 Under Active Exploit, CISA Issues Immediate Alert https://thehackernews.com/2025/06/tp-link-router-flaw-cve-2023-33538.html

CVE ID: CVE-2023-33538
Vendor: TP-Link
Product: Multiple Routers
Date Added: 2025-06-16
Notes: https://www.tp-link.com/nordic/support/faq/3562/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-33538
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-33538

New. And TP-Link is baaaaaack.

CISA has added two items to the KEV catalogue:

- CVE-2025-43200: Apple Multiple Products Unspecified Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-43200

- CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-33538 #CISA #cybersecurity #infosec #Apple #TPLink

Critical alert: BeyondTrust Remote Support has a pre-auth RCE flaw (CVE-2025-5309) allowing attackers to take over systems. Cloud instances are patched, but on-prem users must update now. Already exploited in ransomware attacks. Patch ASAP! https://redteamnews.com/red-team/cve/beyondtrust-remote-support-vulnerability-cve-2025-5309-pre-auth-rce-analysis/

BeyondTrust's platforms are under fire—a new flaw (CVE-2025-5309) lets attackers run code remotely without any credentials. Are your systems patched up? Discover what you need to know.

https://thedefendopsdiaries.com/beyondtrusts-critical-security-flaw-cve-2025-5309/

#beyondtrust
#cve20255309
#cybersecurity
#ssti
#remotecodeexecution

BeyondTrust: CVE-2025-5309: chat feature within Remote Support (RS) and Privileged Remote Access (PRA) vulnerable to Server-Side Template Injection vulnerability @BeyondTrust #cybersecurity #Infosec @cR0w

I've already goofed on this company's name in the past so just take this SSTI in BeyondTrust's chat feature and run with it.

https://www.beyondtrust.com/trust-center/security-advisories/bt25-04

sev:HIGH 8.6 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Remote Support and Privileged Remote Access components do not properly escape input intended for the template engine, leading to a potential template injection vulnerability. This flaw may allow an attacker to execute arbitrary code in the context of the server. Notably, in the case of Remote Support, exploitation does not require authentication.

https://nvd.nist.gov/vuln/detail/CVE-2025-5309

🔒 CRITICAL: CVE-2025-49794 in libxml2 hits RHEL 10. Remote, unauthenticated use-after-free via crafted XML can crash apps or cause undefined behavior. Monitor for patches, filter XML inputs, and restrict access! https://radar.offseq.com/threat/cve-2025-49794-expired-pointer-dereference-in-red--18de3c2a #OffSeq #Linux #RHEL #CVE2025 #Infosec

Three DoS CVEs in libxml.

https://access.redhat.com/security/cve/CVE-2025-49794

https://access.redhat.com/security/cve/CVE-2025-49795

https://access.redhat.com/security/cve/CVE-2025-49796

5.1 KEKs for Pure Storage.

https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/topics/concept/c_flasharray_kek_logging_vulnerability_cve_2025_2327.html

A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.

https://nvd.nist.gov/vuln/detail/CVE-2025-2327

TOTOLINK: https://github.com/byxs0x0/cve2

https://github.com/byxs0x0/cve2/blob/main/9.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6129

https://github.com/byxs0x0/cve2/blob/main/8.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6128

cc: @Dio9sys @da_667

TOTOLINK: https://github.com/byxs0x0/cve2

https://github.com/byxs0x0/cve2/blob/main/9.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6129

https://github.com/byxs0x0/cve2/blob/main/8.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6128

cc: @Dio9sys @da_667

Three DoS CVEs in libxml.

https://access.redhat.com/security/cve/CVE-2025-49794

https://access.redhat.com/security/cve/CVE-2025-49795

https://access.redhat.com/security/cve/CVE-2025-49796

Protobuf isn't used anywhere, right? Cool.

https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901

sev:HIGH 8.2 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

https://nvd.nist.gov/vuln/detail/CVE-2025-4565

I'm beginning to see a theme for today.

https://www.tenable.com/security/tns-2025-11

sev:HIGH 7.8 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.

https://nvd.nist.gov/vuln/detail/CVE-2025-36632

CVE-2025-6029: KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack - asrg.io https://asrg.io/security-advisories/cve-2025-6029-kia-branded-aftermarket-generic-smart-keyless-entry-system-replay-attack/

CVE-2025-6029: KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack - asrg.io https://asrg.io/security-advisories/cve-2025-6029-kia-branded-aftermarket-generic-smart-keyless-entry-system-replay-attack/

Keyless Entry Vulnerability (CVE-2025-6029) Threatens KIA Vehicles in Ecuador, Researcher Reports
https://thecyberexpress.com/keyless-entry-vulnerability-cve-2025-6029/?utm_source=flipboard&utm_medium=activitypub

Posted into Cybersecurity Today @cybersecurity-today-rhudaur

Critical keyless entry vulnerability exposes KIA vehicles in Ecuador to theft

A critical vulnerability (CVE-2025-6029) has been discovered in KIA Ecuador's keyless entry systems affecting thousands of vehicles from 2022-2025, where outdated "learning code" technology using fixed codes instead of modern rolling codes makes cars vulnerable to signal cloning and brute force attacks. Despite being informed of the issue in May 2024, KIA Ecuador has not implemented any remediation for this flaw that essentially allows attackers to steal vehicles by exploiting the insecure aftermarket key fob technology.

**If you have a Kia car in Ecuador, reach out to the distributor for remediation or possibly disabling of the keyless system. Better to unlock manually then for your car to be stolen. If you are building security systems, don't go for the cheap solution that's been obsolete for decades. It's obsolete because it was breached. That applies both to physical devices and to software and algorithms.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-keyless-entry-vulnerability-exposes-kia-vehicles-in-ecuador-to-theft-o-z-w-x-s/gD2P6Ple2L

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

Three sev:CRIT command injections in UniBox Controller.

https://nvd.nist.gov/vuln/detail/CVE-2025-6102

https://nvd.nist.gov/vuln/detail/CVE-2025-6103

https://nvd.nist.gov/vuln/detail/CVE-2025-6104

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-pms_check.pdf

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-test_accesscodelogin.pdf

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-authentication_logout.pdf

cc: @Dio9sys @da_667

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

Time to strap on those Monday morning feed bags.

D-Link:

https://nvd.nist.gov/vuln/detail/CVE-2025-6121

https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content

https://nvd.nist.gov/vuln/detail/CVE-2025-6115

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6114

https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md

Tenda:

https://nvd.nist.gov/vuln/detail/CVE-2025-6113

https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1

https://nvd.nist.gov/vuln/detail/CVE-2025-6112

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b

https://nvd.nist.gov/vuln/detail/CVE-2025-6111

https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f

https://nvd.nist.gov/vuln/detail/CVE-2025-6110

https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120

And there is more fresh PoC in their repos:

https://github.com/xiaobor123/vul-finds

https://github.com/wudipjq/my_vuln

https://lavender-bicycle-a5a.notion.site/CVE-1ab53a41781f804898a0effa45d0f15d

cc: @Dio9sys @da_667

Perfect 10 in a Jinqu Router.

https://github.com/newym/cve/blob/main/utt1.md

https://nvd.nist.gov/vuln/detail/CVE-2025-6098

cc: @Dio9sys @da_667

Three sev:CRIT command injections in UniBox Controller.

https://nvd.nist.gov/vuln/detail/CVE-2025-6102

https://nvd.nist.gov/vuln/detail/CVE-2025-6103

https://nvd.nist.gov/vuln/detail/CVE-2025-6104

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-pms_check.pdf

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-test_accesscodelogin.pdf

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-authentication_logout.pdf

cc: @Dio9sys @da_667

Three sev:CRIT command injections in UniBox Controller.

https://nvd.nist.gov/vuln/detail/CVE-2025-6102

https://nvd.nist.gov/vuln/detail/CVE-2025-6103

https://nvd.nist.gov/vuln/detail/CVE-2025-6104

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-pms_check.pdf

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-billing-test_accesscodelogin.pdf

https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2025/1/Command%20Injection%20Vulnerability%20in%20Wifi-soft%20UniBox%20controller-authentication_logout.pdf

cc: @Dio9sys @da_667

../ in M-Files. I didn't know what that was so I made the mistake of looking at their website and yeah, I expect there are plenty more bugs to be found there.

https://nvd.nist.gov/vuln/detail/CVE-2025-5964

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

This one looks like it could be handy for ransomware crews.

https://www.ibm.com/support/pages/node/7236663

sev:HIGH 8.5 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system.

https://nvd.nist.gov/vuln/detail/CVE-2025-33108

Well that wasn't very Zero Trust of you.

In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specfic owenr_id.

https://nvd.nist.gov/vuln/detail/CVE-2025-6083

#Spring Framework maintenance releases day with 6.1.21 and 6.2.8. Both contain a fix for CVE-2025-41234 that we just published.

https://spring.io/blog/2025/06/12/spring-framework-6-1-21-and-6-2-8-releases-fix-cve-2025-41234

Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922) https://lobste.rs/s/o5hhsn #linux #security
https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/

⚠️ Si vous administrez un Roundcube Webmail (v ≤ 1.6.10), c'est le moment de vérifier et appliquer les mises à jour.
⬇️
Une vulnérabilité critique (CVE-2025-49113) permet une exécution de code à distance après login via désérialisation PHP mal sécurisée.

->Déjà exploitée et revendue sur forums cybercriminels.
->Service omniprésent proposé par défaut entre autres chez cPanel, Plesk, etc.
-> Très utilisé dans des universités et institutions publiques.

Détails + PoC ici
👇
https://fearsoff.org/research/roundcube
🛡 Versions corrigées : 1.6.11 / 1.5.10

Roundcube stocke les sessions utilisateurs avec un système maison basé sur la sérialisation PHP (une manière d’enregistrer des objets dans des chaînes de texte).
Or, une faille dans la fonction qui lit ces sessions permet, si on est connecté, d’y injecter du code malveillant déguisé en objet PHP
Particularité : cette faille était cachée depuis plus de 10 ans. Le code vulnérable était minuscule (1 caractère mal interprété !) mais suffisait pour ouvrir une porte...

✅ Nécessite un login / compte logué/authentifié (mais des chaînes CSRF sont possibles)

#Cyberveille #RoundCube CVE_2025_49113

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

CVEs published for this train wreck in OpenC3 Cosmos.

https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

• Cross-Site Scripting (XSS) in multiple tools within the web interface
• Remote Code Execution (RCE) via malicious plugin installation and improper script execution
• Arbitrary File Access and Manipulation through path traversal in multiple API endpoints
• Credential Leakage through modifiable environment variables in containers
• Insecure Authentication Mechanisms, including clear-text password usage and undocumented service accounts

• CVE-2025-28380
• CVE-2025-28381
• CVE-2025-28382
• CVE-2025-28384
• CVE-2025-28386
• CVE-2025-28388
• CVE-2025-28389

I'm just going to leave this one here and walk away.

https://www.cve.org/CVERecord?id=CVE-2022-4976

Palo Alto has patched several vulnerabilities across a range of products, including CVE-2025-4232 https://security.paloaltonetworks.com/

More:

Infosecurity-Magazine: https://www.infosecurity-magazine.com/news/palo-alto-networks-patches-series/ #cybersecurity #infosec #PaloAlto

The most severe of the resolved flaws is CVE-2025-4232, a high-severity improper neutralization of wildcards bug in GlobalProtect for macOS that leads to code injection. https://www.securityweek.com/palo-alto-networks-patches-privilege-escalation-vulnerabilities/

Oh hi there Palo Alto privesc!

An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.

https://security.paloaltonetworks.com/CVE-2025-4232

PoC Exploit for the NTLM reflection SMB flaw https://github.com/mverschu/CVE-2025-33073

@campuscodi SySS has also published its analysis of CVE-2025-33073 today:

https://blog.syss.com/posts/kerberos-reflection/

RedTeam Pentesting and Synacktiv have published technical analyses of CVE-2025-33073, a new way to execute NTLM reflection attacks.

This was fixed in this month's Patch Tuesday and also works against Kerberos.

https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/

https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

CVE-2025-33073: Windows SMB Client Zero-Day Lets Attackers Gain SYSTEM Privileges – Source: socprime.com https://ciso2ciso.com/cve-2025-33073-windows-smb-client-zero-day-lets-attackers-gain-system-privileges-source-socprime-com/ #rssfeedpostgeneratorecho #ElevationofPrivileges #CyberSecurityNews #MicrosoftZeroDay #CVE-2025-33073 #Latestthreats #Vulnerability #socprimecom #socprime #zeroday #Blog #CVE

#NTLM reflection is dead, long live NTLM reflection! – An in-depth analysis of CVE-2025-33073 #vulnerability

https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

A Look in the Mirror - The Reflective #Kerberos Relay Attack

https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/

NTLM reflection is dead, long live NTLM reflection! – An in-depth analysis of CVE-2025-33073 https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

Based on our testing, MS seems to have fixed CVE-2025-33073 by blocking the CredUnmarshalTargetInfo/CREDENTIAL_TARGET_INFORMATIONW trick!
@tiraniddo ‪@decoder_it #netsec #infosec #windows #cybersecurity

https://mastodon.social/@RedTeamPentesting/114663688487284108

CVE-2025-33073: A Look in the Mirror - The Reflective Kerberos Relay Attack https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/

🚨 Our new blog post about Windows CVE-2025-33073 which we discovered is live:

🪞The Reflective Kerberos Relay Attack - Remote privilege escalation from low-priv user to SYSTEM with RCE by applying a long forgotten NTLM relay technique to Kerberos:

https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/

Ivanti reports three high severity hardcoded keys flawa in Ivanti Workspace Control

Ivanti released security updates for three high-severity vulnerabilities (CVE-2025-5353, CVE-2025-22455, CVE-2025-22463) in its Workspace Control platform that involve hardcoded cryptographic keys allowing authenticated attackers to decrypt stored SQL credentials and environment passwords, potentially compromising entire enterprise environments.

**This one is not critical, but is still quite concerning. The flaws enable attackers to decrypt credentials due to hardcoded encryption keys (which can be easily found on other installations). An exploit does require local access, so you are not in immediate danger. But given that hackers LOVE Ivanti vulnerabilities, plan a patch of this one.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/ivanti-reports-three-high-severity-hardcoded-keys-flawa-in-ivanti-workspace-control-l-c-h-z-d/gD2P6Ple2L

Windows – CVE-2025-3052 : cette faille ouvre la porte à l’installation de malware Bootkits ! https://www.it-connect.fr/windows-cve-2025-3052-faille-ouvre-la-porte-a-installation-de-malware-bootkit/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft

Secure Boot firmado... pero vulnerable (CVE-2025-3052) https://www.hackplayers.com/2025/06/secure-boot-firmado-pero-vulnerable-cve.html #vulnerabilidades #amenazas #boot

GitLab patches multiple account takeover and injection vulnerabilities

GitLab released security updates addressing multiple high-severity vulnerabilities including account takeover through HTML injection (CVE-2025-4278), cross-site scripting enabling user impersonation (CVE-2025-2254), and unauthorized CI/CD job injection in GitLab Ultimate (CVE-2025-5121) affecting both Community and Enterprise editions.

**If you are running self-managed GitLab installations, plan a quick patch to versions 18.0.2, 17.11.4, or 17.10.8. There are three near-critical flaws, and GitLab is by it's nature open to multiple users so the risk is not trivial.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-patches-multiple-account-takeover-and-injection-vulnerabilities-c-2-g-u-l/gD2P6Ple2L

More Joomla! shenanigans.

sev:CRIT: https://nvd.nist.gov/vuln/detail/CVE-2025-30085

sev:HIGH: https://nvd.nist.gov/vuln/detail/CVE-2025-32465

sev:MED: https://nvd.nist.gov/vuln/detail/CVE-2025-32466

Doomla. LOL.

https://blog.blacklanternsecurity.com/p/doomla-zero-days

• CVE-2025-6001 – Cross-Site Request Forgery (CSRF):
  Allows attackers to trick authenticated users into performing unauthorized actions without their knowledge.

• CVE-2025-6002 – Unrestricted File Upload:
  Permits arbitrary file uploads, potentially leading to remote code execution or full server compromise.

https://nvd.nist.gov/vuln/detail/CVE-2025-6001

https://nvd.nist.gov/vuln/detail/CVE-2025-6002

Detect CVE-2025-33053 exploitation–zero-day RCE vulnerability in WebDAV used in Stealth Falcon APT attacks– with a set of Sigma rules in the SOC Prime Platform.
https://socprime.com/blog/cve-2025-33053-zero-day-webdav-vulnerability/?utm_source=mastodon&utm_medium=social&utm_campaign=latest-threats&utm_content=blog-post

The flaw, tracked as CVE-2025-33053, is a remote code execution vulnerability in Web Distributed Authoring and Versioning, or WebDAV. https://www.govinfosecurity.com/microsoft-patches-zero-day-exploited-by-emirati-hackers-a-28662

CVE-2025-33053 Exploitation: A Critical WebDAV Zero-Day RCE Vulnerability Actively Weaponized by Stealth Falcon APT Group – Source: socprime.com https://ciso2ciso.com/cve-2025-33053-exploitation-a-critical-webdav-zero-day-rce-vulnerability-actively-weaponized-by-stealth-falcon-apt-group-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #CVE-2025-33053 #Latestthreats #Vulnerability #socprimecom #socprime #zeroday #ZeroDay #Blog #CVE #rce

Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053) https://www.helpnetsecurity.com/2025/06/11/microsoft-fixes-zero-day-exploited-for-cyber-espionage-cve-2025-33053/ #securityupdate #WindowsServer #PatchTuesday #CheckPoint #Don'tmiss #Microsoft #Hotstuff #MSOffice #Magento #Tenable #Windows #Akamai #Adobe #News

Check Point Research discovered a new campaign conducted by the APT group Stealth Falcon. The attack used a .url file that exploited a zero-day vulnerability (CVE-2025-33053) to execute malware from an actor-controlled WebDAV server. https://research.checkpoint.com/2025/stealth-falcon-zero-day/

Microsoft releases June 2025 Patch, fixing actively exploited flaw and 65 additional vulnerabilities

Microsoft's June 2025 Patch Tuesday addressed 66 vulnerabilities including one actively exploited zero-day (CVE-2025-33053) that was weaponized by the Stealth Falcon APT group against a Turkish defense company through malicious WebDAV URLs, and nine additional critical flaws affecting core Windows services like Remote Desktop, SMB, and Office applications.

**This month prioritize updating Windows OS patching, Microsoft Office and Microsoft Sharepoint. All these have actively exploited or critical flaws. Then move on to the others. Don't delay on the Windows update, there are actively exploited flaws.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-releases-june-2025-patch-fixing-actively-exploited-flaw-and-65-additional-vulnerabilities-x-n-x-p-o/gD2P6Ple2L

GitLab patches multiple account takeover and injection vulnerabilities

GitLab released security updates addressing multiple high-severity vulnerabilities including account takeover through HTML injection (CVE-2025-4278), cross-site scripting enabling user impersonation (CVE-2025-2254), and unauthorized CI/CD job injection in GitLab Ultimate (CVE-2025-5121) affecting both Community and Enterprise editions.

**If you are running self-managed GitLab installations, plan a quick patch to versions 18.0.2, 17.11.4, or 17.10.8. There are three near-critical flaws, and GitLab is by it's nature open to multiple users so the risk is not trivial.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-patches-multiple-account-takeover-and-injection-vulnerabilities-c-2-g-u-l/gD2P6Ple2L

More Joomla! shenanigans.

sev:CRIT: https://nvd.nist.gov/vuln/detail/CVE-2025-30085

sev:HIGH: https://nvd.nist.gov/vuln/detail/CVE-2025-32465

sev:MED: https://nvd.nist.gov/vuln/detail/CVE-2025-32466

More Joomla! shenanigans.

sev:CRIT: https://nvd.nist.gov/vuln/detail/CVE-2025-30085

sev:HIGH: https://nvd.nist.gov/vuln/detail/CVE-2025-32465

sev:MED: https://nvd.nist.gov/vuln/detail/CVE-2025-32466

Patchez Wazuh : ces deux variantes du Botnet Mirai exploitent une faille de sécurité critique ! https://www.it-connect.fr/patch-wazuh-server-cve-2025-24016-botnet-mirai/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Doomla. LOL.

https://blog.blacklanternsecurity.com/p/doomla-zero-days

• CVE-2025-6001 – Cross-Site Request Forgery (CSRF):
  Allows attackers to trick authenticated users into performing unauthorized actions without their knowledge.

• CVE-2025-6002 – Unrestricted File Upload:
  Permits arbitrary file uploads, potentially leading to remote code execution or full server compromise.

https://nvd.nist.gov/vuln/detail/CVE-2025-6001

https://nvd.nist.gov/vuln/detail/CVE-2025-6002

Whoopsie in Nomad.

https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396

sev:HIGH 8.1 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

https://nvd.nist.gov/vuln/detail/CVE-2025-4922

For those who missed this, Microsoft posted a couple of updates yesterday on its security guide, both related to Chromium-based Edge.

- Chromium: CVE-2025-5959 Type Confusion in V8 New
CVE-2025-5959 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5959

- Chromium: CVE-2025-5958 Use after free in Media (new) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5958 #Microsoft #cybersecurity #Infosec

For those who missed this, Microsoft posted a couple of updates yesterday on its security guide, both related to Chromium-based Edge.

- Chromium: CVE-2025-5959 Type Confusion in V8 New
CVE-2025-5959 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5959

- Chromium: CVE-2025-5958 Use after free in Media (new) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5958 #Microsoft #cybersecurity #Infosec

Salesforce patches five vulnerabilities in Industry Cloud Components

Salesforce addressed multiple security vulnerabilities discovered by AppOmni researchers in its Industries platform components, including a critical SOQL data source flaw (CVE-2025-43698) that completely bypassed field-level security permissions and exposed sensitive data through Flexcards and Data Mappers. The company fixed three of five assigned CVEs and implemented customer-configurable security settings for the remaining vulnerabilities. They declined to assign CVEs to 16 additional issues classified as customer-responsibility misconfigurations.

**If you are using Salesforce industry cloud offerings, make sure to review your settings in Flexcard and DataMappers for the new security configuration. Then reach out to Salesforce support for the other 16 issues that the vendor claims are your problem.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/salesforce-patches-five-vulnerabilities-in-industry-cloud-components-q-r-o-p-4/gD2P6Ple2L

CVE-2025-32711 Vulnerability: “EchoLeak” Flaw in Microsoft 365 Copilot Could Enable a Zero-Click Attack on an AI Agent – Source: socprime.com https://ciso2ciso.com/cve-2025-32711-vulnerability-echoleak-flaw-in-microsoft-365-copilot-could-enable-a-zero-click-attack-on-an-ai-agent-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #CVE-2025-32711 #Latestthreats #Vulnerability #socprimecom #zeroclick #EchoLeak #socprime #Blog #CVE

Microsoft disclosed this new vulnerability yesterday, if you missed it.

Microsoft: M365 Copilot Information Disclosure Vulnerability - CVE-2025-32711 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-32711

More:

The Hacker News: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html @thehackernews #Microsoft #AI #cybersecurity #infosec

The attack was devised by Aim Labs researchers in January 2025, who reported their findings to Microsoft. The tech giant assigned the CVE-2025-32711 identifier and fixed it server-side in May, so no user action is required. https://www.bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot/

Critical vulnerability in Microsoft 365 Copilot AI called EchoLeak enabled data exfiltration

Microsoft disclosed "EchoLeak" (CVE-2025-32711), the first documented zero-click attack against an AI agent that exploits an "LLM Scope Violation" in Microsoft 365 Copilot. It allows attackers to exfiltrate sensitive organizational data through hidden prompt injection instructions in emails sent by attackers to an employee. The email is read by the Copilot and the prompt instructions are executed. Stolen data is sent via crafted URLs as parameters.

**Read how this flaw is exploited in detail. Be aware that similar attacks WILL happen across ALL AI integrated tools worldwide. So be very careful about content that looks like instructions to do something which makes little sense to you. If not needed, fully delete such content and report it to your admins so it's possibly not loaded into the AI.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/critical-vulnerability-in-microsoft-365-copilot-ai-called-echoleak-enabled-data-exfiltration-9-w-s-e-v/gD2P6Ple2L

This is patched now but go hack more AI shit.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711

sev:CRIT 9.3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

https://nvd.nist.gov/vuln/detail/CVE-2025-32711

Can't say Tenable isn't succinct in their descriptions. This one is in MySCADA Pro Manager.

https://www.tenable.com/security/research/tra-2025-18

sev:MED 5.5 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A password is exposed locally.

https://nvd.nist.gov/vuln/detail/CVE-2025-35941

@kubikpixel

Für #Debian wird es wohl kein zeitnahes Update geben, da die Lücke als "minor" eingestuft wird " <postponed> (Minor issue, fix along with June update)" #Thunderbird

https://security-tracker.debian.org/tracker/CVE-2025-5986

Watch this target space as more power utilities roll out virtual power plant projects.

https://csirt.divd.nl/cves/CVE-2025-29756/

sev:HIGH 8.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser.
The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to.
While the data that is transmitted through the MQTT server is encrypted and the credentials for the MQTT server are obtained though an API call, the credentials could be used to subscribe to any topic and the encryption key can be used to decrypt all messages received.
An attack with an account on iSolarCloud.com could extract MQTT credentials and the decryption key from the browser and then use an external program to subscribe to the topic '#' and thus recieve all messages from all connected devices.

https://nvd.nist.gov/vuln/detail/CVE-2025-29756

Hydroph0bia (CVE-2025-4275) - a trivial SecureBoot bypass for UEFI-compatible firmware based on Insyde H2O, part 1 https://lobste.rs/s/b1rxqt #reversing #security
https://coderush.me/hydroph0bia-part1/

#Hydroph0bia (CVE-2025-4275) - a trivial #SecureBoot bypass for UEFI-compatible firmware based on Insyde #H2O, part 1

https://coderush.me/hydroph0bia-part1/

Hydroph0bia (CVE​-2025​-4275): otro golpe a Secure Boot https://www.hackplayers.com/2025/06/hydroph0bia-cve-2025-4275-otro-golpe.html #vulnerabilidades #técnicas #bios #boot

🚨CVE-2025-48432: Improper Output Neutralization for Logs

FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJkamFuZ28i

FOFA Query: app="django"

Results: 1,696,617

Advisory: https://github.com/advisories/GHSA-7xr5-9hcq-chf9

CVSS: 4.0

https://www.nu11secur1ty.com/2025/06/cve-2025-47957-microsoft-excel-remote.html

Default credentials vulnerability discovered in Siemens Energy Services Digital Fault Recorder

Siemens reports a critical vulnerability (CVE-2025-40585) in its Energy Services solutions using the Elspec G5 Digital Fault Recorder, where hardcoded default admin credentials could allow attackers to remotely control devices and tamper with outputs. Users should immediately change default credentials and implement network segmentation to protect against potential exploitation.

**Change all default usernames and passwords of Energy Services using the Elspec G5 Digital Fault Recorder. There are hardcoded well known credentials in the system that will be abused if not reset. Also, make sure to isolate the system from the internet and be accessible only from trusted networks.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/default-credentials-vulnerability-discovered-in-siemens-energy-services-digital-fault-recorder-1-1-i-f-e/gD2P6Ple2L

Ivanti reports three high severity hardcoded keys flawa in Ivanti Workspace Control

Ivanti released security updates for three high-severity vulnerabilities (CVE-2025-5353, CVE-2025-22455, CVE-2025-22463) in its Workspace Control platform that involve hardcoded cryptographic keys allowing authenticated attackers to decrypt stored SQL credentials and environment passwords, potentially compromising entire enterprise environments.

**This one is not critical, but is still quite concerning. The flaws enable attackers to decrypt credentials due to hardcoded encryption keys (which can be easily found on other installations). An exploit does require local access, so you are not in immediate danger. But given that hackers LOVE Ivanti vulnerabilities, plan a patch of this one.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/ivanti-reports-three-high-severity-hardcoded-keys-flawa-in-ivanti-workspace-control-l-c-h-z-d/gD2P6Ple2L

Ivanti reports three high severity hardcoded keys flawa in Ivanti Workspace Control

Ivanti released security updates for three high-severity vulnerabilities (CVE-2025-5353, CVE-2025-22455, CVE-2025-22463) in its Workspace Control platform that involve hardcoded cryptographic keys allowing authenticated attackers to decrypt stored SQL credentials and environment passwords, potentially compromising entire enterprise environments.

**This one is not critical, but is still quite concerning. The flaws enable attackers to decrypt credentials due to hardcoded encryption keys (which can be easily found on other installations). An exploit does require local access, so you are not in immediate danger. But given that hackers LOVE Ivanti vulnerabilities, plan a patch of this one.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/ivanti-reports-three-high-severity-hardcoded-keys-flawa-in-ivanti-workspace-control-l-c-h-z-d/gD2P6Ple2L

CVE-2011-10007 was actually published on
2025-06-05.

🔗 Vulnerability details https://vulnerability.circl.lu/vuln/CVE-2011-10007

🔗 Details https://github.com/richardc/perl-file-find-rule/pull/4

🔗 "phasing out 2-arg open " https://www.nntp.perl.org/group/perl.perl5.porters/2025/06/msg269996.html
#cve #vulnerability

🌊 Drowning in tools and manual triage just to get clean findings into client reports or internal dashboards?

🔗 You can now push scan results directly into Nucleus Security to maintain separation between assets, scans, and clients, and to automate vuln management without sacrificing data structure.

🧠 Website scans got smarter with passive detections added to Light mode, GraphQL endpoint fuzzing, and new detection for response header injection.

✅ Sniper validates CVE-2024-56145 automatically, with payloads and screenshots included, so you don’t have to script it yourself.

Looking for more updates? Find them in the video below ⬇️

#ethicalhacking #offensivesecurity #cybersecurity

This Video Can #Exploit Your #iPhone (CVE-2025-31200)

https://www.youtube.com/watch?v=nTO3TRBW00E

Besides the clickbaity title, this video is actually a simple and fun initial analysis of the #1day in question.

As a side note, I started watching it on a device with no #adblocker and damn, YouTube has become so annoying and utterly unusable 😠

CVE-2025-4123 Vulnerability: “The Grafana Ghost” Zero-Day Enables Malicious Account Hijacking – Source: socprime.com https://ciso2ciso.com/cve-2025-4123-vulnerability-the-grafana-ghost-zero-day-enables-malicious-account-hijacking-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheGrafanaGhost #CVE-2025-4123 #Latestthreats #Vulnerability #socprimecom #socprime #zeroday #ZeroDay #Blog #CVE

'Grafana Ghost': vulnerabilidade CVE-2025-4123 permite roubo de contas em milhares de servidores
🔗 https://tugatech.com.pt/t68205-grafana-ghost-vulnerabilidade-cve-2025-4123-permite-roubo-de-contas-em-milhares-de-servidores

#ataque #grave #internet #mundo #online #segurança #servidor #vulnerabilidade 

Over 46,000 Grafana instances are at risk of a sneaky account takeover thanks to a crafty XSS glitch. Is your analytics platform safe? Dive in to learn how to protect against this looming threat.

https://thedefendopsdiaries.com/understanding-the-grafana-vulnerability-cve-2025-4123/

#grafana
#cve20254123
#xssvulnerability
#cybersecurity
#infosec

(29 May) ChatGPT’s o3 Model Found Remote Zeroday in Linux Kernel Code

OpenAI&#039;s o3 just uncovered a remote 0-day in the Linux kernel&#039;s SMB code—CVE-2025-37899. A patch has already been rolled out.

https://s.faithcollapsing.com/szvk9
Archive: ais: https://archive.md/wip/DlZCC ia: https://s.faithcollapsing.com/syjjb

#ai #kernel #latest-in-foss-tech #linux-&-open-source-news #security

Spoofing OpenPGP.js signature verification https://codeanlabs.com/blog/research/cve-2025-47934-spoofing-openpgp-js-signatures/

"CVE-2025-47934 – Spoofing OpenPGP.js signature verification":

https://codeanlabs.com/blog/research/cve-2025-47934-spoofing-openpgp-js-signatures/

🚨CVE-2025-24813: Apache Tomcat potential RCE and/or information disclosure and/or information corruption with partial PUT

ZoomEye Link: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcGFjaGUgVG9tY2F0Ig%3D%3D

ZoomEye Dork: app="Apache Tomcat"

Results: 815,431

Advisory: https://github.com/advisories/GHSA-83qj-6fr2-vhqg

PoC: https://github.com/absholi7ly/POC-CVE-2025-24813

CVSS: 9.2

——————————

Follow @zoomeye_team's official Twitter/X account and send the message “Dark Web Informer” via DM to receive an extra 15-day membership.

I am trying to do more for this community, so this is just the start! 💙

🚨CVE-2025-24813: Apache Tomcat potential RCE and/or information disclosure and/or information corruption with partial PUT

ZoomEye Link: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcGFjaGUgVG9tY2F0Ig%3D%3D

ZoomEye Dork: app="Apache Tomcat"

Results: 815,431

Advisory: https://github.com/advisories/GHSA-83qj-6fr2-vhqg

PoC: https://github.com/absholi7ly/POC-CVE-2025-24813

CVSS: 9.2

——————————

Follow @zoomeye_team's official Twitter/X account and send the message “Dark Web Informer” via DM to receive an extra 15-day membership.

I am trying to do more for this community, so this is just the start! 💙

Bug di Chrome sfruttato per prendere il controllo dei nostri sistemi: come difendersi

Il gruppo criminale TaxOff sta sfruttando in rete la vulnerabilità zero-day CVE-2025-2783 di Chrome per distribuire il backdoor Trinper:...

🔗️ [Cybersecurity360] https://link.is.it/YZgKCt

Bug di Chrome sfruttato per prendere il controllo dei nostri sistemi: come difendersi

Il gruppo criminale TaxOff sta sfruttando in rete la vulnerabilità zero-day CVE-2025-2783 di Chrome per distribuire il backdoor Trinper:...

🔗️ [Cybersecurity360] https://link.is.it/YZgKCt

Google Chrome Zero-Day CVE-2025-2783 Exploited by TaxOff to Deploy Trinper Backdoor – Source:thehackernews.com https://ciso2ciso.com/google-chrome-zero-day-cve-2025-2783-exploited-by-taxoff-to-deploy-trinper-backdoor-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #Google

Google Chrome Zero-Day CVE-2025-2783 Exploited by TaxOff to Deploy Trinper Backdoor https://thehackernews.com/2025/06/google-chrome-zero-day-cve-2025-2783.html

Google Chrome Zero-Day CVE-2025-2783 Exploited by TaxOff to Deploy Trinper Backdoor https://thehackernews.com/2025/06/google-chrome-zero-day-cve-2025-2783.html

Google Chrome Zero-Day CVE-2025-2783 Exploited by TaxOff to Deploy Trinper Backdoor https://thehackernews.com/2025/06/google-chrome-zero-day-cve-2025-2783.html

CVE-2024-4577: analisi di un payload

Come accennavo in questo post ho iniziato ad utilizzare i dati che il nostro honeypot sta collezionando per studiare alcuni tentatici di exploiting...

🔗️ [Roccosicilia] https://link.is.it/qgSYkQ

Fortinet posted this yesterday, if you missed it.

Fortinet: SimpleHelp Support Software Attack - CVE-2024-57727, high severity https://fortiguard.fortinet.com/outbreak-alert/simplehelp-ransomware-attack @fortinet #cybersecurity #Infosec

Also from yesterday.

GreyNoise Observes Exploit Attempts Targeting Zyxel CVE-2023-28771 https://www.greynoise.io/blog/exploit-attempts-targeting-zyxel-cve-2023-28771 @greynoise

CISA urges immediate patching for SimpleHelp flaw CVE-2024-57727 to protect organizations from ransomware gangs exploiting unpatched vulnerabilities.

https://www.techbeams.com/tech/cisa-urges-immediate-patching-for-simplehelp-flaw/

#tech #technews #technology #cybersecurity #techbeams

Picus: Ransomware Actors Exploit CVE-2024-57727 in Unpatched SimpleHelp RMM https://www.picussecurity.com/resource/blog/ransomware-actors-exploit-cve-2024-57727-in-unpatched-simplehelp-rmm #cybersecurity #infosec #ransomware

🚨CVE-2024-55591: Fortinet FortiOS Authentication Bypass

ZoomEye Link: https://www.zoomeye.ai/searchResult?q=YXBwPSJGb3J0aW5ldCBGaXJld2FsbCI%3D

ZoomEye Dork: app="Fortinet Firewall"

Results: 5,320,990

Advisory: https://nvd.nist.gov/vuln/detail/cve-2024-55591

PoC: https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591

CVSS: 9.8

—————-

Follow @zoomeye_team's official Twitter/X account and send the message “Dark Web Informer” via DM to receive an extra 15-day membership.

I am trying to do more for this community, so this is just the start! 💙

Data Breach at Cock.li email provider exposes over 1 Million user records

Privacy-focused email provider Cock.li suffered a data breach affecting over 1 million users after threat actors exploited an old SQL injection vulnerability (CVE-2021-44026) in their Roundcube webmail platform that had remained unpatched since 2016. The breach exposed login information for over 1 million users and contact details for 93,000 additional users.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/data-breach-at-cock-li-email-provider-exposes-over-1-million-user-records-c-n-7-a-5/gD2P6Ple2L

CISA warns attackers are exploiting a critical Linux kernel flaw (CVE-2024-1086) to gain root access. Patch now—federal agencies must fix by June 20. Check your kernel version and mitigate ASAP. Details: https://redteamnews.com/red-team/cve/cisa-warns-of-actively-exploited-linux-kernel-vulnerability-cve-2024-1086/