Tag: cve
-
Fix öffnet neue Angriffsfläche – Probleme mit Windows-Update für CVE-2025-21204
First seen on security-insider.de Jump to article: www.security-insider.de/patch-fuer-windows-schwachstelle-cve-2025-21204-oeffnet-neue-sicherheitsluecke-a-6d760f47ac11f9497d34d3e83e279b15/
-
watchTowr Warns of Active Exploitation of SonicWall SMA 100 Devices
watchTowr reveals active exploitation of SonicWall SMA 100 vulnerabilities (CVE-2024-38475 & CVE-2023-44221) potentially leading to full system takeover… First seen on hackread.com Jump to article: hackread.com/watchtowr-exploits-target-sonicwall-sma-100-devices/
-
CISA Adds Two New Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221
The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding two vulnerabilities, CVE-2024-38475 and CVE-2023-44221, that are currently being actively exploited. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisa-adds-cve-2024-38475-and-cve-2023-44221/
-
Attackers exploited old flaws to breach SonicWall SMA appliances (CVE-2024-38475, CVE-2023-44221)
Attackers have been using two previously known vulnerabilities (CVE-2024-38475, CVE-2023-44221) to compromise SonicWall secure mobile access devices, the vendor has confirmed … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/02/sonicwall-cve-2024-38475-cve-2023-44221-exploited/
-
How to Automate CVE and Vulnerability Advisory Response with Tines
Run by the team at workflow orchestration and AI platform Tines, the Tines library features pre-built workflows shared by security practitioners from across the community – all free to import and deploy through the platform’s Community Edition.A recent standout is a workflow that automates monitoring for security advisories from CISA and other vendors, enriches advisories…
-
NVIDIA TensorRT-LLM Vulnerability Let Hackers Run Malicious Code
NVIDIA has issued an urgent security advisory after discovering a significant vulnerability (CVE-2025-23254) in its popular TensorRT-LLM framework, urging all users to update to the latest version (0.18.2) to safeguard their systems against potential attacks. Overview of the Vulnerability The vulnerability, identified as CVE-2025-23254, affects all versions of the NVIDIA TensorRT-LLM framework before 0.18.2 across…
-
CISA Issues Alert on Actively Exploited Apache HTTP Server Escape Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a newly discovered and actively exploited vulnerability in the widely used Apache HTTP Server. The flaw, catalogued as CVE-2024-38475, affects the server’s mod_rewrite module and poses significant risks to organizations worldwide. Details of the Vulnerability CVE-2024-38475 is classified as an >>improper escaping…
-
Critical Vulnerabilities and Top CVEs of April 2025
Some vulnerabilities make headlines. Others quietly become someone’s worst day at work. The critical CVEs 2025 that surfaced in April weren’t just technical flaws, they were real entry points. Into… The post Critical Vulnerabilities and Top CVEs of April 2025 appeared first on Strobes Security. First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/05/critical-vulnerabilities-and-top-cves-of-april-2025/
-
Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code
A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own hacking competition, allows attackers to execute malicious code remotely via the vehicle’s Tire Pressure Monitoring System (TPMS). The vulnerability, now patched, highlights growing risks in automotive cybersecurity. Detail Description CVE ID CVE-2025-2082 CVSS Score 7.5 (High) Adjacent Network Attack Vector […]…
-
New Research Reveals: 95% of AppSec Fixes Don’t Reduce Risk
For over a decade, application security teams have faced a brutal irony: the more advanced the detection tools became, the less useful their results proved to be. As alerts from static analysis tools, scanners, and CVE databases surged, the promise of better security grew more distant. In its place, a new reality took hold”, one…
-
Two SonicWall SMA100 flaws actively exploited in the wild
SonicWall confirmed that threat actors actively exploited two vulnerabilities impacting its SMA100 Secure Mobile Access (SMA) appliances. SonicWall revealed that attackers actively exploited two security vulnerabilities, tracked as CVE-2023-44221 and CVE-2024-38475, in its SMA100 Secure Mobile Access appliances. Below are the descriptions of the two flaws: >>During further analysis, SonicWall and trusted security partners identified an…
-
SonicWall Confirms Active Exploitation of Flaws Affecting Multiple Appliance Models
SonicWall has revealed that two now-patched security flaws impacting its SMA100 Secure Mobile Access (SMA) appliances have been exploited in the wild.The vulnerabilities in question are listed below -CVE-2023-44221 (CVSS score: 7.2) – Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to First seen…
-
U.S. CISA adds SAP NetWeaver flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SAP NetWeaver flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)added SAP NetWeaver flaw, tracked as CVE-2025-31324, to its Known Exploited Vulnerabilities (KEV) catalog. Last week, researchers warned that a zero-day vulnerability, tracked asCVE-2025-31324(CVSS score of 10/10), in SAP NetWeaver is…
-
Brocade Fabric OS flaw could allow code injection attacks
Same KEV update included a Commvault flaw: CISA also added a high severity bugCVSS 8.7/10 affecting Commvault Web Server to its KEV Catalog, recommending patching under the same BOD directive.The flaw, tracked as CVE-2025-3928, is an unspecified vulnerability that can be exploited by a remote, authenticated attacker to execute webshells. All versions before 11.36.46, 11.32.89,…
-
Google Chrome Vulnerability Allows Attackers to Bypass Sandbox Restrictions Technical Details Revealed
A severe vulnerability, identified as CVE-2025-2783, has been discovered in Google Chrome, specifically targeting the Mojo inter-process communication (IPC) component on Windows systems. This high-impact flaw, with a CVSS score of 8.8, stems from improper handle validation and management within Mojo, enabling remote attackers to craft malicious payloads that, when triggered through user interaction like…
-
Broadcom-backed SAN devices face code injection attacks via a critical Fabric OS bug
Same KEV update included a Commvault flaw: CISA also added a high severity bugCVSS 8.7/10 affecting Commvault Web Server to its KEV Catalog, recommending patching under the same BOD directive.The flaw, tracked as CVE-2025-3928, is an unspecified vulnerability that can be exploited by a remote, authenticated attacker to execute webshells. All versions before 11.36.46, 11.32.89,…
-
CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two high-severity security flaws impacting Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The vulnerabilities in question are listed below -CVE-2025-1976 (CVSS score: 8.6) – A code injection flaw First…
-
SAP NetWeaver Visual Composer Flaw Under Active Exploitation
CVE-2025-31324 is a maximum severity bug that attackers exploited weeks before SAP released a patch for it. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/sap-netweaver-visual-composer-flaw-active-exploitation
-
Threat Actors Hacking SAP Critical Zero-Day
Unauthenticated Hackers Exploit CVE-2025-31324 to Upload Webshells. Threat actors are exploiting a zero-day flaw in a partially deprecated SAP tool still widely used by governments and businesses. On Friday, SAP’s security division, Onapsis, disclosed that CVE-2025-31324 is actively exploited in the wild. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/threat-actors-hacking-sap-critical-zero-day-a-28098
-
Critical Craft CMS Flaws Exploited in Wild: 300+ Servers Breached, Experts Warn
Cybersecurity experts are warning website owners after hackers began actively exploiting two critical vulnerabilities in Craft CMS, a content management system, leaving hundreds of servers compromised. The flaws, CVE-2024-58136 and CVE-2025-32432, were discovered by Orange Cyberdefense’s SensePost team during a forensic investigation in mid-February. Their research revealed that attackers are using these bugs […] First…
-
Rack Ruby Framework Vulnerabilities Let Attackers Inject and Manipulate Log Content
Researchers Thai Do and Minh Pham have exposed multiple critical vulnerabilities in the Rack Ruby framework, a cornerstone of Ruby-based web applications with over a billion global downloads. Identified as CVE-2025-25184, CVE-2025-27111, and CVE-2025-27610, these flaws pose significant risks to applications built on frameworks like Ruby on Rails and Sinatra. Rack, acting as a modular…
-
Breaking Down CVE-2025-31324 A Clear Threat to SAP Business Operations
When a vulnerability is rated 9.9 out of 10 on the CVSS scale, it deserves immediate attention. CVE-2025-31324 affects SAP NetWeaver AS Java, a platform many businesses rely on every… The post Breaking Down CVE-2025-31324 A Clear Threat to SAP Business Operations appeared first on Strobes Security. First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/04/breaking-down-cve-2025-31324-a-clear-threat-to-sap-business-operations/
-
4 big mistakes you’re probably still making in vulnerability management”¦and how to fix them
Tags: attack, automation, business, cloud, cve, data, endpoint, mitigation, office, risk, software, threat, tool, update, vulnerability, vulnerability-managementWhy is it a problem? Monthly, weekly, or even daily scans used to be adequate. Now? They leave blind spots. Cloud resources, remote endpoints, VMs”¦ can spin up and vanish in minutes, and you’ll never catch those with a scan that runs on a schedule.Fix it! Shift to continuous scanning. Use tools that integrate with…
-
âš¡ Weekly Recap: Critical SAP Exploit, AI-Powered Phishing, Major Breaches, New CVEs & More
What happens when cybercriminals no longer need deep skills to breach your defenses? Today’s attackers are armed with powerful tools that do the heavy lifting, from AI-powered phishing kits to large botnets ready to strike. And they’re not just after big corporations. Anyone can be a target when fake identities, hijacked infrastructure, and insider tricks…
-
Attackers chained Craft CMS zero-days attacks in the wild
Orange Cyberdefense’s CSIRT reported that threat actors exploited two vulnerabilities in Craft CMS to breach servers and steal data. Orange Cyberdefense’s CSIRT warns that threat actors chained two Craft CMS vulnerabilities in recent attacks. Orange experts discovered the flaws while investigating a server compromise. The two vulnerabilities, tracked as CVE-2025-32432 and CVE-2024-58136, are respectively a…