Collecting Cyber-News from over 60 sources

Tag: cvss

Breaking Down CVE-2025-31324 A Clear Threat to SAP Business Operations

Apr 28, 2025 3:58 PM

Tags: business, cve, cvss, flaw, sap, threat, vulnerability

When a vulnerability is rated 9.9 out of 10 on the CVSS scale, it deserves immediate attention. CVE-2025-31324 affects SAP NetWeaver AS Java, a platform many businesses rely on every… The post Breaking Down CVE-2025-31324 A Clear Threat to SAP Business Operations appeared first on Strobes Security. First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/04/breaking-down-cve-2025-31324-a-clear-threat-to-sap-business-operations/
Commvault warns of critical Command Center flaw

Apr 25, 2025 3:50 PM

Tags: access, authentication, ciso, cvss, data, exploit, flaw, infrastructure, network, ransomware, vulnerability

Pre-authentication increases exploitability: Heath Renfrow, CISO and co-founder at FEnix24, told CSO that the vulnerability is both “technically serious” and “operationally significant” for organizations, for a number of reasons.For starters, it enables pre-authentication exploitation, meaning that it can be triggered before any authentication is required, leading to high exploitability without the need for credentials. Additionally, the…
Critical Commvault SSRF could allow attackers to execute code remotely

Apr 25, 2025 2:50 PM

Tags: access, authentication, ciso, cvss, data, exploit, flaw, infrastructure, network, ransomware, vulnerability

Pre-authentication increases exploitability: Heath Renfrow, CISO and co-founder at FEnix24, told CSO that the vulnerability is both “technically serious” and “operationally significant” for organizations, for a number of reasons.For starters, it enables pre-authentication exploitation, meaning that it can be triggered before any authentication is required, leading to high exploitability without the need for credentials. Additionally, the…
Critical Commvault Command Center Flaw Enables Attackers to Execute Code Remotely

Apr 24, 2025 1:50 PM

Tags: cve, cvss, flaw, vulnerability

A critical security flaw has been disclosed in the Commvault Command Center that could allow arbitrary code execution on affected installations.The vulnerability, tracked as CVE-2025-34028, carries a CVSS score of 9.0 out of a maximum of 10.0.”A critical security vulnerability has been identified in the Command Center installation, allowing remote attackers to execute arbitrary code…
Critical Langflow Flaw Enables Malicious Code Injection Technical Breakdown Released

Apr 24, 2025 11:50 AM

Tags: ai, cve, cvss, cyber, endpoint, flaw, injection, malicious, open-source, remote-code-execution, risk, vulnerability

A critical remote code execution (RCE) vulnerability, identified as CVE-2025-3248 with a CVSS score of 9.8, has been uncovered in Langflow, an open-source platform widely used for visually designing AI-driven agents and workflows. This flaw, residing in the platform’s /api/v1/validate/code endpoint, poses a significant risk to organizations leveraging Langflow in their AI development ecosystems. The…
SonicWall SSLVPN Flaw Allows Hackers to Crash Firewalls Remotely

Apr 24, 2025 9:50 AM

Tags: advisory, cvss, cyber, firewall, flaw, hacker, network, office, vulnerability

SonicWall has issued an urgent advisory (SNWLID-2025-0009) warning of a high-severity vulnerability in its SSLVPN Virtual Office interface that enables unauthenticated attackers to remotely crash firewalls, causing widespread network disruptions. Tracked as CVE-2025-32818, this flaw carries a CVSS v3 score of 7.5 and affects dozens of firewall models across its Gen7 and TZ80 product lines. The…
PoC Released for Critical Erlang/OTP SSH RCE Vulnerability

Apr 18, 2025 11:28 AM

Tags: control, cvss, cyber, exploit, flaw, rce, remote-code-execution, update, vulnerability

Security teams across industries are urgently patching systems following the public release of a proof-of-concept (PoC) exploit for a newly disclosed critical remote code execution (RCE) vulnerability in Erlang/OTP’s SSH implementation. The flaw, tracked as CVE-2025-32433 and assigned a maximum CVSS score of 10.0, enables unauthenticated attackers to execute arbitrary code, potentially taking complete control of affected systems.…
Researchers Find CVSS 10.0 Severity RCE Vulnerability in Erlang/OTP SSH

Apr 17, 2025 8:29 PM

Tags: cve, cvss, rce, remote-code-execution, vulnerability

Security researchers report CVE-2025-32433, a CVSS 10.0 RCE vulnerability in Erlang/OTP SSH, allowing unauthenticated code execution on exposed… First seen on hackread.com Jump to article: hackread.com/researchers-cvss-severity-rce-vulnerability-erlang-otp-ssh/
Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution

Apr 17, 2025 12:28 PM

Tags: access, authentication, cve, cvss, network, sans, vulnerability

A critical security vulnerability has been disclosed in the Erlang/Open Telecom Platform (OTP) SSH implementation that could permit an attacker to execute arbitrary code sans any authentication under certain conditions.The vulnerability, tracked as CVE-2025-32433, has been given the maximum CVSS score of 10.0.”The vulnerability allows an attacker with network access to an Erlang/OTP SSH First…
MITRE CVE Program Funding Set To Expire

Apr 16, 2025 5:28 AM

Tags: cve, cvss, cybersecurity, data, github, identity, intelligence, mitre, monitoring, nist, technology, update, vulnerability, vulnerability-management

MITRE’s CVE program has been an important pillar in cybersecurity for over two decades. The lack of certainty surrounding the future of the CVE program creates great uncertainty about how newly discovered vulnerabilities will be cataloged. Background On April 15, reports circulated that the contract for funding the Common Vulnerabilities and Exposures (CVE) program along…
Critical Apache Roller flaw allows to retain unauthorized access even after a password change

Apr 15, 2025 5:28 PM

Tags: access, apache, cve, cvss, flaw, password, unauthorized, vulnerability

A critical flaw (CVE-2025-24859, CVSS 10) in Apache Roller lets attackers keep access even after password changes. All versions â‰¤6.1.4 are affected. A critical vulnerability, tracked as CVE-2025-24859 (CVSS score of 10.0), affects the Apache Roller open-source, Java-based blogging server software. The flaw is a session management issue that impacts in Apache Roller before version 6.1.5 where…
Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence

Apr 15, 2025 5:28 PM

Tags: access, apache, cve, cvss, flaw, malicious, open-source, password, software, unauthorized, vulnerability

A critical security vulnerability has been disclosed in the Apache Roller open-source, Java-based blogging server software that could allow malicious actors to retain unauthorized access even after a password change.The flaw, assigned the CVE identifier CVE-2025-24859, carries a CVSS score of 10.0, indicating maximum severity. It affects all versions of Roller up to and including…
Ransomware-Attacken stoßen in Windows-Lücke

Apr 10, 2025 3:06 PM

Tags: access, backdoor, bug, cve, cvss, cyberattack, exploit, kaspersky, malware, microsoft, ransomware, update, vulnerability, windows

Cyberkriminelle missbrauchen eine Sicherheitslücke in Windows, um eine Backdoor-Malware und Ransomware einzuschleusen.Sicherheitsforscher von Microsoft haben eine Schwachstelle im CLFS-Treiber (Common Log File System) von Windows entdeckt, die Angreifern Systemrechte verleiht. Sie wird als CVE-2025-29824 geführt, die mit einem CVSS-Wert von 7,8 über einen hohen Schweregrad verfügt.Laut einem Blogbeitrag der Forscher wurde die Lücke bereits für…
April Patch Tuesday news: Windows zero day being exploited, ‘big vulnerability’ in 2 SAP apps

Apr 9, 2025 5:55 PM

Tags: access, android, attack, authentication, breach, business, ciso, cve, cvss, data, email, exploit, finance, flaw, google, group, infrastructure, injection, malicious, metric, microsoft, network, office, phishing, remote-code-execution, reverse-engineering, risk, sap, service, threat, unauthorized, update, vulnerability, windows, zero-day

Hot News Notes and five High Priority Notes.”This is huge,” Paul Laudanski, director of security research at Onapsis, said in urging CISOs to act fast on applying the SAP patch. “It’s a pretty big vulnerability.”He doesn’t believe the patch requires either SAP application to be rebooted.More on SAP patches later. Applying the patch for Windows Common Log File…
Windows Active Directory Vulnerability Enables Unauthorized Privilege Escalation

Apr 9, 2025 5:55 PM

Tags: cve, cvss, cyber, flaw, microsoft, network, risk, service, unauthorized, vulnerability, windows

Microsoft has urgently patched a high-risk security vulnerability (CVE-2025-29810) in Windows Active Directory Domain Services (AD DS), which could allow attackers to escalate privileges and compromise entire network domains. Rated7.5 (Important)on the CVSS v3.1 scale, this flaw impacts organizations using Windows Server 2016 through 2025 editions. CVE-2025-29810 Overview Key Detail Description CVE ID CVE-2025-29810 Published…
Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw

Apr 8, 2025 9:43 PM

Tags: cve, cvss, flaw, fortinet, password, unauthorized, update, vulnerability

Fortinet has released security updates to address a critical security flaw impacting FortiSwitch that could permit an attacker to make unauthorized password changes.The vulnerability, tracked as CVE-2024-48887, carries a CVSS score of 9.3 out of a maximum of 10.0.”An unverified password change vulnerability [CWE-620] in FortiSwitch GUI may allow a remote unauthenticated attacker to modify…
Zoom Workplace Apps Vulnerability Enables Malicious Script Injection Through XSS Flaws

Apr 8, 2025 6:42 PM

Tags: cve, cvss, cyber, flaw, injection, malicious, network, risk, vulnerability, xss

A newly disclosed vulnerability in Zoom Workplace Apps (tracked as CVE-2025-27441 and CVE-2025-27442) allows attackers to inject malicious scripts via cross-site scripting (XSS) flaws, posing risks to millions of users globally. The medium-severity vulnerability, with a CVSS score of 4.6, enables unauthenticated attackers on adjacent networks to compromise meeting integrity by executing arbitrary code. Zoom…
Apollo Router Vulnerability Enables Resource Exhaustion via Optimization Bypass

Apr 8, 2025 8:42 AM

Tags: cvss, cyber, flaw, router, service, tool, vulnerability

A critical vulnerability (CVE-2025-32032) has been identified in Apollo Router, a widely used GraphQL federation tool, allowing attackers to trigger resource exhaustion and denial-of-service (DoS) conditions. Rated7.5 (High)on the CVSS v3.1 scale, the flaw impacts users running unpatched versions of the software. Technical Overview The vulnerability resides in Apollo Router’s query planner, which failed to…
Bitdefender GravityZone Console PHP Vulnerability Lets Hackers Execute Arbitrary Commands

Apr 7, 2025 8:42 AM

Tags: cve, cvss, cyber, cybersecurity, flaw, hacker, risk, vulnerability

Cybersecurity firm Bitdefender has patched a severe flaw (CVE-2025-2244) in its GravityZone Console, which could allow unauthenticated attackers to execute arbitrary commands on vulnerable systems. The vulnerability, discovered by researcher Nicolas Verdier (@n1nj4sec), has a near-maximum CVSSv4 score of 9.5, highlighting its critical risk profile. CVE-2025-2244: Key Details CVE ID CVE-2025-2244 CVSS Score 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) Affected…
Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Apr 4, 2025 11:42 PM

Tags: advisory, cve, cvss, cyber, exploit, ivanti, rce, remote-code-execution, risk, vulnerability

April 5, 2025 Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways. Rated at a CVSS score of 9.0, this stack-based buffer overflow has been actively exploited since mid-March 2025, posing a severe risk to organizations using these […]…
Critical Apache Parquet Vulnerability Allows Remote Code Execution

Apr 4, 2025 12:42 PM

Tags: apache, cvss, cyber, data, flaw, remote-code-execution, vulnerability

A severe vulnerability has been identified in the Apache Parquet Java library, specifically within itsparquet-avromodule. This flaw, tracked as CVE-2025-30065, exposes systems to potential Remote Code Execution (RCE) attacks. It has been ratedCriticalwith a CVSS score of 10.0, indicating the highest level of severity. The root cause is categorized asDeserialization of Untrusted Data (CWE-502). The vulnerability impacts systems…
Next.js Vulnerability Exposes Middleware Security Gaps

Apr 1, 2025 11:58 AM

Tags: access, authentication, cve, cvss, exploit, flaw, framework, unauthorized, vulnerability

On March 21, 2025, a critical authorization bypass vulnerability in Next.js, identified as CVE-2025-29927, was disclosed with a CVSS score of 9.1. This framework’s middleware handling flaw enables attackers to bypass authentication and authorization, exposing sensitive routes to unauthorized access. Exploiting this vulnerability does not require authentication, providing attackers with direct access to protected routes….…
CVE-2025-29927: Next.js Middleware Authorization Bypass Flaw

Mar 27, 2025 7:34 PM

Tags: access, api, attack, control, cve, cvss, data, exploit, flaw, malicious, risk, router, theft, unauthorized, update, vulnerability

IntroductionOn March 21, 2025, a critical vulnerability, CVE-2025-29927, was publicly disclosed with a CVSS score of 9.1, signifying high severity. Discovered by security researcher Rachid Allam, the flaw enables attackers to bypass authorization checks in Next.js Middleware, potentially granting unauthorized access to protected resources. This poses a risk to applications that rely on Middleware to…
SnapCenter Security Flaw Rated Critical”, NetApp Urges Immediate Patch

Mar 27, 2025 11:34 AM

Tags: access, cve, cvss, data, flaw, software, unauthorized, update, vulnerability

A serious security vulnerability has recently been identified in NetApp’s SnapCenter software, a widely used enterprise solution for managing data protection. This flaw, tracked as CVE-2025-26512, could allow attackers to escalate privileges and gain unauthorized administrative access to systems. The flaw, which affects SnapCenter versions prior to 6.0.1P1 and 6.1P1, has been rated as critical,…
Exploited! Kentico Xperience Staging Service Authentication Bypass Vulnerabilities (CVE-2025-2746 CVE-2025-2747)

Mar 26, 2025 8:35 PM

Tags: authentication, control, cve, cvss, exploit, flaw, service, vulnerability

Recently, two critical security flaws were discovered in Kentico Xperience 13, a popular digital experience platform (CMS). Tracked as CVE-2025-2746 and CVE-2025-2747, these vulnerabilities allow unauthenticated attackers to bypass the Staging Sync Server’s authentication, potentially gaining administrative control over the CMS. Both issues carry a CVSS score of 9.8 (Critical) (Warning: Multiple Critical & High……
Critical NetApp SnapCenter Server Vulnerability Allows Attackers to Gain Admin Access

Mar 26, 2025 11:13 AM

Tags: access, cve, cvss, cyber, flaw, vulnerability

A critical vulnerability has been identified in NetApp’s SnapCenter Server, affecting versions before 6.0.1P1 and 6.1P1. This flaw allows an authenticated SnapCenter Server user to potentially escalate their privileges to admin on remote systems where SnapCenter plug-ins are installed. The vulnerability has been designated as CVE-2025-26512 and carries a Critical severity rating with a CVSS…
Introducing Agentic Risk Scoring – Impart Security

Mar 26, 2025 12:14 AM

Tags: ai, application-security, control, cvss, detection, framework, mitre, nist, risk, risk-assessment, tool, vulnerability

Reimagining Risk Scoring: A Breakthrough in Security Risk Management For years, AppSec and product security teams have been locked in endless debates about the most effective security frameworks and risk scoring methodologies. From CVSS and MITRE ATT&CK to NIST frameworks, these tools promise to quantify and manage security risks”, but how truly helpful are they?…
VMware Patches Authentication Bypass Flaw in Windows Tools Suite

Mar 25, 2025 5:13 PM

Tags: authentication, cve, cvss, flaw, tool, vmware, vulnerability, windows

The authentication bypass vulnerability, tagged as CVE-2025-22230, carries a CVSS severity score of 7.8/10. The post VMware Patches Authentication Bypass Flaw in Windows Tools Suite appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/vmware-patches-authentication-bypass-flaw-in-windows-tools-suite/
CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, CVE-2025-24514: Frequently Asked Questions About IngressNightmare

Mar 25, 2025 5:13 AM

Tags: access, advisory, attack, cve, cvss, exploit, flaw, hacker, injection, kubernetes, mitigation, network, open-source, vulnerability, zero-day

Frequently asked questions about five vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively known as IngressNightmare. Background The Tenable Security Response Team (SRT) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding IngressNightmare. FAQ What is IngressNightmare? IngressNightmare is the name given to a series of vulnerabilities in the Ingress NGINX Controller…
Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication

Mar 24, 2025 9:13 PM

Tags: authentication, cve, cvss, kubernetes, rce, remote-code-execution, risk, vulnerability

A set of five critical security shortcomings have been disclosed in the Ingress NGINX Controller for Kubernetes that could result in unauthenticated remote code execution, putting over 6,500 clusters at immediate risk by exposing the component to the public internet.The vulnerabilities (CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974 ), assigned a CVSS score of First seen…