Collecting Cyber-News from over 60 sources

Tag: cvss

Cl0p nutzt Schwachstelle bei Oracle aus

Oct 6, 2025 7:35 PM

Tags: authentication, breach, bug, business, cve, cvss, cyberattack, exploit, linkedin, mail, mandiant, oracle, update, vulnerability, zero-day

Die Cl0p-Bande nutzt Zero-Day-Schwachstelle bei Oracle für Cyberattacken aus.Oracle hat ein Notfall-Update veröffentlicht, um eine kritische Sicherheitslücke in seiner E-Business Suite (EBS) zu beheben. Das Leck mit Kennung CVE-2025-61882 hat einen CVSS-Score von 9,8 und wurde bereits bei der jüngsten Welle von Cl0p zum Diebstahl von Daten ausgenutzt.Die Sicherheitslücke betrifft einen nicht näher bezeichneten Fehler,…
Oracle patches critical E-Business Suite flaw exploited by Cl0p hackers

Oct 6, 2025 4:35 PM

Tags: business, cve, cvss, cybercrime, exploit, flaw, hacker, oracle, update, vulnerability

Oracle fixed a critical flaw (CVE-2025-61882, CVSS 9.8) in E-Business Suite that is actively exploited by Cl0p cybercrime group. Oracle released an emergency patch to address a critical vulnerability, tracked as CVE-2025-61882 (CVSS 9.8) in its E-Business Suite. >>Updated [10/04/2025]: Oracle has issued Oracle Security Alert Advisory CVE-2025-61882 to provide updates against additional potential exploitation that were discovered during our investigation.
Critical Zero-Day in Oracle E-Business Suite Prompts Urgent Security Updates

Oct 6, 2025 3:35 PM

Tags: business, cve, cvss, flaw, oracle, threat, update, vulnerability, zero-day

Oracle has issued a security alert warning users of a zero-day vulnerability in its widely used Oracle E-Business Suite. Tracked as CVE-2025-61882, this flaw allows unauthenticated, remote attackers to execute arbitrary code on affected systems. The vulnerability carries a CVSS v3.1 base score of 9.8, making it one of the most critical threats to the…
Critical Zero-Day in Oracle E-Business Suite Prompts Urgent Security Updates

Oct 6, 2025 3:35 PM

Tags: business, cve, cvss, flaw, oracle, threat, update, vulnerability, zero-day

Oracle has issued a security alert warning users of a zero-day vulnerability in its widely used Oracle E-Business Suite. Tracked as CVE-2025-61882, this flaw allows unauthenticated, remote attackers to execute arbitrary code on affected systems. The vulnerability carries a CVSS v3.1 base score of 9.8, making it one of the most critical threats to the…
Splunk Enterprise Flaws Allow Attackers to Run Unauthorized JavaScript Code

Oct 2, 2025 7:41 AM

Tags: access, cloud, control, cvss, cyber, flaw, unauthorized, vulnerability

Splunk released security advisories addressing multiple vulnerabilities affecting various versions of Splunk Enterprise and Splunk Cloud Platform. The flaws range from cross-site scripting (XSS) vulnerabilities to access control bypasses, with CVSS scores ranging from 4.6 to 7.5. Critical Vulnerabilities Identified The security advisories reveal six distinct vulnerabilities that primarily affect Splunk Web components. Two cross-site…
CVSS-Score 10.0 – Goanywhere-Schwachstelle entpuppt sich als Zero Day

Oct 2, 2025 7:41 AM

Tags: cvss, vulnerability, zero-day

First seen on security-insider.de Jump to article: www.security-insider.de/cyberangriffe-goanywhere-zero-day-schwachstelle-a-11f6cfd74454f5ebf50fb1350896889a/
Splunk Enterprise Flaws Allow Attackers to Run Unauthorized JavaScript Code

Oct 2, 2025 7:41 AM

Tags: access, cloud, control, cvss, cyber, flaw, unauthorized, vulnerability

Splunk released security advisories addressing multiple vulnerabilities affecting various versions of Splunk Enterprise and Splunk Cloud Platform. The flaws range from cross-site scripting (XSS) vulnerabilities to access control bypasses, with CVSS scores ranging from 4.6 to 7.5. Critical Vulnerabilities Identified The security advisories reveal six distinct vulnerabilities that primarily affect Splunk Web components. Two cross-site…
SUSE Rancher Flaws Allow Attackers to Lock Out Admin Accounts

Sep 29, 2025 10:08 AM

Tags: cvss, cyber, flaw, kubernetes, vulnerability

A critical security vulnerability in SUSE Rancher Manager has been discovered that enables attackers with elevated privileges to lock out administrative accounts, potentially disrupting entire Kubernetes cluster management operations. The flaw, tracked asCVE-2024-58260, carries a high severity rating with a CVSS score of 7.1. Vulnerability Overview The security issue stems from missing server-side validation on the username…
Attackers exploited critical Fortra GoAnywhere flaw in zero-day attacks (CVE-2025-10035)

Sep 26, 2025 5:08 PM

Tags: attack, cve, cvss, exploit, flaw, update, vulnerability, zero-day

CVE-2025-10035, a perfect CVSS 10.0 vulnerability in the Fortra GoAnywhere managed file transfer solution, has apparently been exploited in zero-day attacks before the patch … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/26/fortra-goanywhere-zero-day-cve-2025-10035/
Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure

Sep 26, 2025 12:09 PM

Tags: apt, cvss, cybersecurity, exploit, flaw, group, ransomware, software, zero-day

Cybersecurity company watchTowr Labs has disclosed that it has “credible evidence” of active exploitation of the recently disclosed security flaw in Fortra GoAnywhere Managed File Transfer (MFT) software as early as September 10, 2025, a whole week before it was publicly disclosed.”This is not ‘just’ a CVSS 10.0 flaw in a solution long favored by…
Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure

Sep 26, 2025 12:09 PM

Tags: apt, cvss, cybersecurity, exploit, flaw, group, ransomware, software, zero-day

Cybersecurity company watchTowr Labs has disclosed that it has “credible evidence” of active exploitation of the recently disclosed security flaw in Fortra GoAnywhere Managed File Transfer (MFT) software as early as September 10, 2025, a whole week before it was publicly disclosed.”This is not ‘just’ a CVSS 10.0 flaw in a solution long favored by…
Critical Cisco Flaw Lets Remote Attackers Execute Code on Firewalls and Routers

Sep 26, 2025 10:09 AM

Tags: advisory, cisco, cve, cvss, cyber, firewall, flaw, router, vpn, vulnerability

Cisco published Security Advisory cisco-sa-http-code-exec-WmfP3h3O revealing a severe flaw in multiple Cisco platforms that handle HTTP-based management. Tracked as CVE-2025-20363, this vulnerability stems from improper validation of user-supplied input in HTTP requests. CVE Affected Products Impact CVSS 3.1 Score CVE-2025-20363 Secure Firewall ASA & FTD with SSL VPN or MUS enabled; IOS/IOS XE with Remote…
Critical Cisco Flaw Lets Remote Attackers Execute Code on Firewalls and Routers

Sep 26, 2025 10:09 AM

Tags: advisory, cisco, cve, cvss, cyber, firewall, flaw, router, vpn, vulnerability

Cisco published Security Advisory cisco-sa-http-code-exec-WmfP3h3O revealing a severe flaw in multiple Cisco platforms that handle HTTP-based management. Tracked as CVE-2025-20363, this vulnerability stems from improper validation of user-supplied input in HTTP requests. CVE Affected Products Impact CVSS 3.1 Score CVE-2025-20363 Secure Firewall ASA & FTD with SSL VPN or MUS enabled; IOS/IOS XE with Remote…
Salesforce AI Agent Vulnerability Lets Attackers Steal Sensitive Data

Sep 26, 2025 9:09 AM

Tags: ai, attack, cvss, cyber, cybersecurity, data, exploit, injection, vulnerability

Cybersecurity researchers at Noma Labs have discovered a critical vulnerability in Salesforce’s Agentforce AI platform that could allow attackers to steal sensitive customer data through sophisticated prompt injection techniques. The vulnerability, dubbed >>ForcedLeak,
Critical CVSS 10 Flaw in GoAnywhere File Transfer Threatens 20,000 Systems

Sep 25, 2025 5:16 PM

Tags: cvss, flaw, update, vulnerability

Urgent warning for Fortra GoAnywhere MFT users. A CVSS 10.0 deserialization vulnerability (CVE-2025-10035) in the License Servlet allows command injection. Patch to v7.8.4 immediately to prevent system takeover. First seen on hackread.com Jump to article: hackread.com/critical-cvss-10-flaw-goanywhere-file-transfer/
Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts

Sep 24, 2025 1:16 PM

Tags: cvss, cyber, malicious, vulnerability

A severe Stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of the DNN Platform enables low-privilege attackers to inject and execute arbitrary scripts in the context of privileged users. Published as GHSA-2qxc-mf4x-wr29 by Daniel Valadas yesterday, this vulnerability affects all versions of the DotNetNuke.Core package prior to 10.1.0 and carries a CVSS v3.1 base…
State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability

Sep 24, 2025 9:16 AM

Tags: cve, cvss, email, exploit, flaw, hacker, injection, malicious, threat, update, vulnerability

Libraesva has released a security update to address a vulnerability in its Email Security Gateway (ESG) solution that it said has been exploited by state-sponsored threat actors.The vulnerability, tracked as CVE-2025-59689, carries a CVSS score of 6.1, indicating medium severity.”Libraesva ESG is affected by a command injection flaw that can be triggered by a malicious…
Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants

Sep 22, 2025 8:15 AM

Tags: cve, cvss, flaw, microsoft, vulnerability

A critical token validation failure in Microsoft Entra ID (previously Azure Active Directory) could have allowed attackers to impersonate any user, including Global Administrators, across any tenant.The vulnerability, tracked as CVE-2025-55241, has been assigned the maximum CVSS score of 10.0. It has been described by Microsoft as a privilege escalation flaw in Azure Entra. There…
Fortra Releases Critical Patch for CVSS 10.0 GoAnywhere MFT Vulnerability

Sep 19, 2025 5:16 PM

Tags: cve, cvss, flaw, software, update, vulnerability

Fortra has disclosed details of a critical security flaw in GoAnywhere Managed File Transfer (MFT) software that could result in the execution of arbitrary commands.The vulnerability, tracked as CVE-2025-10035, carries a CVSS score of 10.0, indicating maximum severity.”A deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT allows an actor with a validly forged…
HubSpot’s Jinjava Engine Flaw Exposes Thousands of Sites to RCE Attacks

Sep 19, 2025 3:15 PM

Tags: attack, cvss, cyber, exploit, flaw, rce, remote-code-execution, vulnerability

A critical security vulnerability has been discovered in HubSpot’s Jinjava template engine, potentially exposing thousands of websites and applications to remote code execution attacks. The flaw, tracked as CVE-2025-59340, carries the maximum CVSS score of 10.0, indicating the severity of the security risk. Sandbox Bypass Enables Dangerous Exploits The vulnerability stems from a sandbox bypass mechanism…
WatchGuard Patches Critical Firebox Firewall Flaw (CVE-2025-9242) With 9.3 CVSS Score

Sep 19, 2025 1:15 PM

Tags: cve, cvss, firewall, flaw, update, vulnerability

WatchGuard has issued security updates addressing a vulnerability, tracked as CVE-2025-9242, affecting its Firebox firewall devices. This flaw involves an out-of-bounds write weakness within the Fireware OS, potentially allowing remote attackers to execute arbitrary code on vulnerable devices configured with IKEv2 VPN. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2025-9242-vulnerability/
Nokia CBIS/NCS Manager API Vulnerability Allows Attackers to Bypass Authentication

Sep 19, 2025 1:15 PM

Tags: api, authentication, container, cvss, cyber, infrastructure, network, risk, vulnerability

On September 18, 2025, Orange Cert publicly disclosed a critical authentication bypass vulnerability affecting Nokia’s CBIS (CloudBand Infrastructure Software) and NCS (Nokia Container Service) Manager API (CVE-2023-49564). With a CVSS 3.1 score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the vulnerability poses a severe risk to organizations relying on these management platforms to orchestrate and secure their containerized network…
How Top CISOs Approach Exposure Management in the Context of Managing Cyber Risk

Sep 18, 2025 6:16 PM

Tags: ai, attack, best-practice, business, ciso, control, cvss, cyber, cybersecurity, data, framework, group, intelligence, leak, metric, monitoring, risk, software, strategy, threat, update, vulnerability, vulnerability-management

Wondering what your peers think of exposure management? New reports from the Exposure Management Leadership Council, a CISO working group sponsored by Tenable, offer insights. Key takeaways The CISOs who make up the Exposure Management Leadership Council see exposure management as a strategic and game-changing approach to unified proactive security. They believe exposure management can…
How Tenable Found a Way To Bypass a Patch for BentoML’s Server-Side Request Forgery Vulnerability CVE-2025-54381

Sep 17, 2025 8:16 PM

Tags: ai, api, cloud, control, cve, cvss, data, dns, endpoint, exploit, framework, monitoring, network, open-source, risk, service, tool, update, vulnerability

Tenable Research recently discovered that the original patch for a critical vulnerability affecting BentoML could be bypassed. In this blog, we explain in detail how we discovered this patch bypass in this widely used open source tool. The vulnerability is now fully patched. Key takeaways Tenable Research discovered that the initial patch for a high-severity…
Gefährliche Schwachstellen in Kubernetes-Testing-Plattform Chaos-Mesh

Sep 17, 2025 2:15 PM

Tags: access, cve, cvss, kubernetes, vulnerability

Das JFrog-Security-Research-Team hat mehrere kritische Schwachstellen in Chaos-Mesh, einer weit verbreiteten Testing-Plattform in Kubernetes-Umgebungen, entdeckt und offengelegt. Die Sicherheitslücken wurden unter dem Namen ‘Chaotic Deputy” (CVE-2025-59358, CVE-2025-59359, CVE-2025-59360 und CVE-2025-59361) zusammengefasst, wobei die letzten drei jeweils eine CVSS-Bewertung von 9.8 aufweisen. Sie ermöglichen es Angreifern mit Zugriff innerhalb des Clusters, vollständige Kontrolle über die Umgebung…
Chaos Mesh Critical Vulnerabilities Expose Kubernetes Clusters to Takeover

Sep 17, 2025 2:15 PM

Tags: cve, cvss, cyber, flaw, kubernetes, open-source, vulnerability

Security Research recently uncovered four new flaws, CVE-2025-59358, CVE-2025-59359, CVE-2025-59360, and CVE-2025-59361, in the default configuration of the Chaos Controller Manager GraphQL server, a popular open-source chaos engineering platform for Kubernetes. Three of these flaws carry a maximum CVSS 3.1 score of 9.8, enabling any pod in the cluster to run arbitrary commands or inject…
Phoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 Seconds

Sep 16, 2025 10:16 AM

Tags: attack, cvss, data, google

A team of academics from ETH Zürich and Google has discovered a new variant of a RowHammer attack targeting Double Data Rate 5 (DDR5) memory chips from South Korean semiconductor vendor SK Hynix.The RowHammer attack variant, codenamed Phoenix (CVE-2025-6202, CVSS score: 7.1), is capable of bypassing sophisticated protection mechanisms put in place to resist the…
FlowiseAI Password Reset Token Vulnerability Enables Account Takeover

Sep 15, 2025 8:16 AM

Tags: ai, automation, cloud, cve, cvss, cyber, flaw, password, risk, vulnerability

Acritical vulnerabilityin FlowiseAI has been discovered that allows attackers to take over user accounts with minimal effort. The flaw, tracked as CVE-2025-58434, affects both cloud-hosted and self-hosted FlowiseAI deployments, posing significant risks to organizations using this AI workflow automation platform. CVE Number Affected Product Vulnerability Type CVSS 3.1 Score CVE-2025-58434 FlowiseAI (npm package flowise) Unauthenticated Password…
Linux CUPS Flaw Allows Remote Denial of Service and Authentication Bypass

Sep 15, 2025 7:16 AM

Tags: attack, authentication, cve, cvss, cyber, flaw, linux, service, vulnerability

Two critical security vulnerabilities have been discovered in the Common Unix Printing System (CUPS), a widely used printing subsystem for Unix-like operating systems. The flaws, designated as CVE-2025-58364 and CVE-2025-58060, expose Linux systems to remote denial-of-service attacks and authentication bypass, potentially affecting millions of Linux machines worldwide. CVE Severity CVSS Score Impact Affected Versions CVE-2025-58364…
Critical CVE-2025-5086 in DELMIA Apriso Actively Exploited, CISA Issues Warning

Sep 12, 2025 3:16 PM

Tags: cisa, cve, cvss, cybersecurity, exploit, flaw, infrastructure, kev, software, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting Dassault SystÃ¨mes DELMIA Apriso Manufacturing Operations Management (MOM) software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerability, tracked as CVE-2025-5086, carries a CVSS score of 9.0 out of 10.0. According to First seen…