Tag: cve
-
Citrix NetScaler ADC and Gateway Hit by Ongoing Attacks Exploiting 0-Day RCE
Cloud Software Group has issued an emergency security bulletin warning of active exploitation targeting three critical vulnerabilities in NetScaler ADC and NetScaler Gateway products. The vulnerabilities, tracked asCVE-2025-7775,CVE-2025-7776, andCVE-2025-8424, present severe security risks including remote code execution and denial of service capabilities. Active Exploitation Confirmed The most severe vulnerability,CVE-2025-7775, carries aCVSS v4.0 score of 9.2and has been…
-
Citrix fixes critical NetScaler RCE flaw exploited in zero-day attacks
Citrix fixed three NetScaler ADC and NetScaler Gateway flaws today, including a critical remote code execution flaw tracked as CVE-2025-7775 that was actively exploited in attacks as a zero-day vulnerability. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/citrix-fixes-critical-netscaler-rce-flaw-exploited-in-zero-day-attacks/
-
Citrix NetScaler Devices Yet Again Under Attack
Citrix Publishes Patches After Attackers Exploit Memory Overflow Vulnerability. NetScaler customers of virtualization giant Citrix once again should patch immediately to stymie the hackers exploiting a zero-day. Citrix warned Tuesday that hackers are using a memory overflow vulnerability now tracked as CVE-2025-7775. The vulnerability carries a CVSS score of 9.2. First seen on govinfosecurity.com Jump…
-
Citrix fixed three NetScaler flaws, one of them actively exploited in the wild
Citrix addressed three vulnerabilities in NetScaler ADC and NetScaler Gateway, including one that has been actively exploited in the wild. Citrix addressed three security flaws (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424) in NetScaler ADC and NetScaler Gateway, including one (CVE-2025-7775) that it said has been actively exploited in the wild. >>Exploits of CVE-2025-7775 on unmitigated appliances have been observed.
-
Citrix Patches Three NetScaler Flaws, Confirms Active Exploitation of CVE-2025-7775
Citrix has released fixes to address three security flaws in NetScaler ADC and NetScaler Gateway, including one that it said has been actively exploited in the wild.The vulnerabilities in question are listed below -CVE-2025-7775 (CVSS score: 9.2) – Memory overflow vulnerability leading to Remote Code Execution and/or Denial-of-ServiceCVE-2025-7776 (CVSS score: 8.8) – Memory overflow First…
-
PoC Exploit Published for Chrome 0-Day Already Under Active Attack
A proof-of-concept exploit for a high-severity Google Chrome zero-day vulnerability has been published publicly, less than three months after the flaw was first disclosed, amid reports of active in-the-wild exploitation. The vulnerability, tracked as CVE-2025-5419, stems from out-of-bounds reads and writes in Chrome’s V8 JavaScript engine, affecting versions prior to 137.0.7151.68 and opening the door…
-
PoC Exploit Published for Chrome 0-Day Already Under Active Attack
A proof-of-concept exploit for a high-severity Google Chrome zero-day vulnerability has been published publicly, less than three months after the flaw was first disclosed, amid reports of active in-the-wild exploitation. The vulnerability, tracked as CVE-2025-5419, stems from out-of-bounds reads and writes in Chrome’s V8 JavaScript engine, affecting versions prior to 137.0.7151.68 and opening the door…
-
Git vulnerability leading to RCE is being exploited by attackers (CVE-2025-48384)
CVE-2025-48384, a recently patched vulnerability in the popular distributed revision control system Git, is being exploited by attackers. Details about the attacks are not … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/26/git-vulnerability-exploited-cve-2025-48384/
-
U.S. CISA adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, citrix, cve, cybersecurity, exploit, flaw, infrastructure, kev, remote-code-execution, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Citrix Session Recording, and Git flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2024-8069 is a limited remote code execution with privilege…
-
CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws impacting Citrix Session Recording and Git to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The list of vulnerabilities is as follows -CVE-2024-8068 (CVSS score: 5.1) – An improper privilege management vulnerability in Citrix Session Recording First seen…
-
Docker Fixes CVE-2025-9074, Critical Container Escape Vulnerability With CVSS Score 9.3
Docker has released fixes to address a critical security flaw affecting the Docker Desktop app for Windows and macOS that could potentially allow an attacker to break out of the confines of a container.The vulnerability, tracked as CVE-2025-9074, carries a CVSS score of 9.3 out of 10.0. It has been addressed in version 4.44.3.”A malicious…
-
Report Surfaces Increased Number of API Security Issues Involving AI
A report published today by Wallarm finds that of the 639 Common Vulnerabilities and Exposures (CVEs) pertaining to application programming interfaces (APIs) reported in Q2 2025, 34 involved issues relating to some type of use case tied to artificial intelligence (AI). Overall, two-thirds of the API CVEs represent either critical or high severity threats, according..…
-
BSidesSF 2025: The Growing Crisis In CVE Data Quality
Creator, Author and Presenter: Jerry Gamblin Our deep appreciation to Security BSides – San Francisco and the Creators, Authors and Presenters for publishing their BSidesSF 2025 video content on YouTube. Originating from the conference’s events held at the lauded CityView / AMC Metreon – certainly a venue like no other; and via the organization’s YouTube…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 59
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Hunt.io Exposes and Analyzes ERMAC V3.0 Banking Trojan Full Source Code Leak Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824 Supply Chain Risk in Python: Termncolor and Colorinal Explained Noodlophile […]…
-
Hackers Could Take Over Apple Devices Via Malicious Images Patch Now!
Apple fixes CVE-2025-43300, a flaw letting hackers hijack devices via malicious images. Users urged to update iPhone, iPad,… First seen on hackread.com Jump to article: hackread.com/hackers-take-over-apple-devices-malicious-images-patch/
-
GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional Botnets
Tags: attack, botnet, crypto, cve, cybercrime, cybersecurity, exploit, iot, malicious, vulnerabilityCybersecurity researchers are calling attention to multiple campaigns that leverage known security vulnerabilities and expose Redis servers to various malicious activities, including leveraging the compromised devices as IoT botnets, residential proxies, or cryptocurrency mining infrastructure.The first set of attacks entails the exploitation of CVE-2024-36401 (CVSS score: 9.8), a critical First seen on thehackernews.com Jump to…
-
Cybersecurity Snapshot: Industrial Systems in Crosshairs of Russian Hackers, FBI Warns, as MITRE Updates List of Top Hardware Weaknesses
Tags: access, ai, attack, automation, cisa, cisco, cloud, conference, control, credentials, cve, cyber, cybersecurity, data, data-breach, deep-fake, detection, docker, espionage, exploit, flaw, framework, fraud, google, government, group, guide, hacker, hacking, Hardware, identity, infrastructure, intelligence, Internet, iot, LLM, microsoft, mitigation, mitre, mobile, network, nist, risk, russia, scam, service, side-channel, software, strategy, switch, technology, threat, tool, update, vulnerability, vulnerability-management, windowsCheck out the FBI’s alert on Russia-backed hackers infiltrating critical infrastructure networks via an old Cisco bug. Plus, MITRE dropped a revamped list of the most important critical security flaws. Meanwhile, NIST rolled out a battle plan against face-morphing deepfakes. And get the latest on the CIS Benchmarks and on vulnerability prioritization strategies! Here are…
-
Apple veröffentlicht kritische Sicherheits-Updates (iOS, macOS)
Kleiner Nachtrag von dieser Woche. Von Apple gab es zum 20. August 2025 Updates für iOS und iPadOS, die kritische Schwachstellen in den Betriebssystemen schließen. Hier einige Informationen. Mit dem Update auf iOS 18.6.2 und iPadOS 18.6.2 wurde die Sicherheitslücke CVE-2025-43300 … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/08/22/apple-veroeffentlicht-kritische-sicherheits-updates-ios-macos/
-
Apple Patches Zero-Day Flaw Used in ‘Sophisticated’ Attack
CVE-2025-43300 is the latest zero-day bug used in cyberattacks against targeted individuals, which could signify spyware or nation-state hacking. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/apple-zero-day-flaw-sophisticated-attack
-
CISA warns of Apple zero-day used in targeted cyberattacks
The Cybersecurity and Infrastructure Security Agency (CISA) gave civilian federal agencies until September 11 to implement a fix for CVE-2025-43300, a vulnerability affecting popular brands of Apple phones, iPads and Macbooks. First seen on therecord.media Jump to article: therecord.media/cisa-warns-of-apple-zero-day
-
Insurers May Limit Payments in Cases of Unpatched CVEs
Some insurers look to limit payouts to companies that don’t remediate serious vulnerabilities in a timely manner. Unsurprisingly, most companies don’t like those restrictions. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cyber-insurers-may-limit-payments-breaches-unpatched-cve
-
CISA Warns of Actively Exploited 0-Day Vulnerability in Apple iOS, iPadOS, and macOS
Tags: apple, cisa, cve, cyber, cybersecurity, exploit, framework, infrastructure, macOS, risk, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical zero-day vulnerability affecting Apple iOS, iPadOS, and macOS systems that is being actively exploited in the wild. CVE-2025-43300, an out-of-bounds write vulnerability in Apple’s Image I/O framework, poses significant security risks to millions of users across Apple’s ecosystem. Critical Vulnerability…
-
AI Systems Capable of Generating Working Exploits for CVEs in Just 1015 Minutes
Cybersecurity researchers have developed an artificial intelligence system capable of automatically generating working exploits for published Common Vulnerabilities and Exposures (CVEs) in just 10-15 minutes at approximately $1 per exploit, fundamentally challenging the traditional security response timeline that defenders rely upon. The breakthrough system employs a sophisticated multi-stage pipeline that analyzes CVE advisories and code…
-
70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
A critical security vulnerability, officially tracked as CVE-2025-8592, has been identified in the popular Inspiro WordPress theme. The flaw, affecting over 70,000 active installations, enables unauthenticated attackers to exploit a Cross-Site Request Forgery (CSRF) vulnerability that could allow arbitrary plugin installations without user consent. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/csrf-flaw-cve-2025-8592/
-
Certificate Spoofing-Schwachstelle CVE-2025-55229; und MDT-Schwachstelle CVE-2025-55230 (21.8.2025)
In allen im Support befindlichen Windows-Versionen (Clients und Server) gibt es eine Certificate Spoofing-Schwachstelle (CVE-2025-55229). Eigentlich sollte es zum 21. August 2025 auch Updates für die betroffenen Produkte geben. Zumindest ich stoße momentan auf den Microsoft-Seiten aber nur auf gebrochene … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/08/22/windows-certificate-spoofing-schwachstelle-cve-2025-55229-21-8-2025/
-
U.S. CISA adds Apple iOS, iPadOS, and macOS flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple iOS, iPadOS, and macOS flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple iOS, iPadOS, and macOS flaw, tracked as CVE-2025-43300, to its Known Exploited Vulnerabilities (KEV) catalog. This week, Apple addressed the actively exploited zero-day CVE-2025-43300 in iOS, iPadOS, and…
-
Windows Docker Desktop Vulnerability Allows Full Host Compromise
A critical vulnerability in Docker Desktop for Windows has been discovered that allows any container to achieve full host system compromise through a simple Server-Side Request Forgery (SSRF) attack. The flaw, designated CVE-2025-9074, was patched in Docker Desktop version 4.44.3 released in August 2025. CVE Details CVE ID CVE-2025-9074 CVSS Score Critical (Estimated 9.0+) Affected…
-
Certificate Spoofing-Schwachstelle CVE-2025-55229 (21.8.2025)
In allen im Support befindlichen Windows-Versionen (Clients und Server) gibt es eine Certificate Spoofing-Schwachstelle (CVE-2025-55229). Eigentlich sollte es zum 21. August 2025 auch Updates für die betroffenen Produkte geben. Zumindest ich stoße momentan auf den Microsoft-Seite aber nur auf gebrochene … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/08/22/windows-certificate-spoofing-schwachstelle-cve-2025-55229-21-8-2025/
-
Threat Actors Exploiting Victims’ Machines for Bandwidth Monetization
Tags: cve, cvss, cyber, cybersecurity, exploit, flaw, programming, remote-code-execution, software, threat, vulnerabilityCybersecurity researchers have uncovered an ongoing campaign where threat actors exploit the critical CVE-2024-36401 vulnerability in GeoServer, a geospatial database, to remotely execute code and monetize victims’ bandwidth. This remote code execution flaw, rated at a CVSS score of 9.8, enables attackers to deploy legitimate software development kits (SDKs) or modified applications that generate passive…