Tag: vulnerability
-
Fortinet FortiWeb Schwachstelle (CVE-2025-58034)
Administratoren von Fortinet FortiWeb-Instanzen sehen sich erneut binnen weniger Tage mit einer Schwachstelle konfrontiert. Der Hersteller hat zum 18. November 2025 einen Sicherheitshinweis zur Schwachstelle CVE-2025-58034 veröffentlicht und in seine FortiWeb Produkte gepatcht. FortiWeb Schwachstelle (CVE-2025-58034) Der Sicherheitshinweis zur Schwachstelle … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/11/24/fortinet-fortiweb-schwachstelle-cve-2025-58034/
-
‘Critical’ Flaw In Oracle Fusion Middleware Exploited In Attacks
Tags: attack, cisa, cyberattack, cybersecurity, exploit, flaw, identity, infrastructure, oracle, tool, vulnerabilityA critical-severity vulnerability that impacts the Identity Manager tool within Oracle’s Fusion Middleware platform has seen exploitation in cyberattacks, according to the U.S. Cybersecurity and Infrastructure Security Agency. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-critical-flaw-in-oracle-fusion-middleware-exploited-in-attacks
-
‘Critical’ Flaw In Oracle Fusion Middleware Exploited In Attacks
Tags: attack, cisa, cyberattack, cybersecurity, exploit, flaw, identity, infrastructure, oracle, tool, vulnerabilityA critical-severity vulnerability that impacts the Identity Manager tool within Oracle’s Fusion Middleware platform has seen exploitation in cyberattacks, according to the U.S. Cybersecurity and Infrastructure Security Agency. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-critical-flaw-in-oracle-fusion-middleware-exploited-in-attacks
-
New Fluent Bit Flaws Expose Cloud to RCE and Stealthy Infrastructure Intrusions
Cybersecurity researchers have discovered five vulnerabilities in Fluent Bit, an open-source and lightweight telemetry agent, that could be chained to compromise and take over cloud infrastructures.The security defects “allow attackers to bypass authentication, perform path traversal, achieve remote code execution, cause denial-of-service conditions, and manipulate tags,” Oligo Security said in First seen on thehackernews.com Jump…
-
JPMorgan, Citi, Morgan Stanley assess fallout from SitusAMC data breach
Tags: advisory, breach, cyberattack, cybersecurity, data, data-breach, email, finance, incident response, microsoft, regulation, risk, risk-management, service, technology, threat, tool, update, vulnerabilityThird-party breaches accelerating: The SitusAMC incident is part of a broader trend of increasing cyberattacks targeting third-party vendors in the financial services sector. Third parties accounted for 30% of data breaches in 2024, a 15% increase from 2023, according to Venminder’s State of Third-Party Risk Management 2025 survey. The survey found 49% of organizations experienced…
-
JPMorgan, Citi, Morgan Stanley assess fallout from SitusAMC data breach
Tags: advisory, breach, cyberattack, cybersecurity, data, data-breach, email, finance, incident response, microsoft, regulation, risk, risk-management, service, technology, threat, tool, update, vulnerabilityThird-party breaches accelerating: The SitusAMC incident is part of a broader trend of increasing cyberattacks targeting third-party vendors in the financial services sector. Third parties accounted for 30% of data breaches in 2024, a 15% increase from 2023, according to Venminder’s State of Third-Party Risk Management 2025 survey. The survey found 49% of organizations experienced…
-
Oracle OIM zero”‘day: Pre”‘auth RCE forces rapid patching across enterprises
Tags: advisory, authentication, cyber, exploit, flaw, oracle, rce, remote-code-execution, sans, technology, update, vulnerabilityThe patching urgency: In its CPU advisory, Oracle addressed this flaw along with hundreds of others across its portfolio. Researchers call it a common Java filter flaw, which makes it a known territory for attackers.”The vulnerability our team discovered follows a familiar pattern in Java: filters designed to restrict authentication often contain easy-to-exploit authentication bypass…
-
Oracle OIM zero”‘day: Pre”‘auth RCE forces rapid patching across enterprises
Tags: advisory, authentication, cyber, exploit, flaw, oracle, rce, remote-code-execution, sans, technology, update, vulnerabilityThe patching urgency: In its CPU advisory, Oracle addressed this flaw along with hundreds of others across its portfolio. Researchers call it a common Java filter flaw, which makes it a known territory for attackers.”The vulnerability our team discovered follows a familiar pattern in Java: filters designed to restrict authentication often contain easy-to-exploit authentication bypass…
-
Oracle OIM zero”‘day: Pre”‘auth RCE forces rapid patching across enterprises
Tags: advisory, authentication, cyber, exploit, flaw, oracle, rce, remote-code-execution, sans, technology, update, vulnerabilityThe patching urgency: In its CPU advisory, Oracle addressed this flaw along with hundreds of others across its portfolio. Researchers call it a common Java filter flaw, which makes it a known territory for attackers.”The vulnerability our team discovered follows a familiar pattern in Java: filters designed to restrict authentication often contain easy-to-exploit authentication bypass…
-
Oracle OIM zero”‘day: Pre”‘auth RCE forces rapid patching across enterprises
Tags: advisory, authentication, cyber, exploit, flaw, oracle, rce, remote-code-execution, sans, technology, update, vulnerabilityThe patching urgency: In its CPU advisory, Oracle addressed this flaw along with hundreds of others across its portfolio. Researchers call it a common Java filter flaw, which makes it a known territory for attackers.”The vulnerability our team discovered follows a familiar pattern in Java: filters designed to restrict authentication often contain easy-to-exploit authentication bypass…
-
The slow rise of SBOMs meets the rapid advance of AI
Despite years of effort to make software safer and more transparent with SBOMs, the rise of AI coding assistants is fueling optimism”, and, some experts argue, “kind of insane””, claims about a future with vulnerability-free software. First seen on cyberscoop.com Jump to article: cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/
-
Grafana Flags Maximum-Severity SCIM Vulnerability Enabling Privilege Escalation
Grafana Labs has issued a warning regarding a maximum-severity security flaw, identified as CVE-2025-41115, affecting its Enterprise product. The vulnerability can allow attackers to impersonate administrators or escalate privileges if certain SCIM (System for Cross-domain Identity Management) settings are enabled. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/grafana-scim-vulnerability-cve-2025-41115/
-
The slow rise of SBOMs meets the rapid advance of AI
Despite years of effort to make software safer and more transparent with SBOMs, the rise of AI coding assistants is fueling optimism”, and, some experts argue, “kind of insane””, claims about a future with vulnerability-free software. First seen on cyberscoop.com Jump to article: cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/
-
PoC Published for W3 Total Cache Flaw Exposing 1M+ Sites to RCE
Security researchers have published a proof-of-concept exploit for a critical remote code execution vulnerability in W3 Total Cache, one of WordPress’s most popular caching plugins with over one million active installations. The flaw, tracked as CVE-2025-9501, allows attackers to execute arbitrary code on vulnerable websites under specific conditions. Field Details CVE ID CVE-2025-9501 Affected Product…
-
PoC Published for W3 Total Cache Flaw Exposing 1M+ Sites to RCE
Security researchers have published a proof-of-concept exploit for a critical remote code execution vulnerability in W3 Total Cache, one of WordPress’s most popular caching plugins with over one million active installations. The flaw, tracked as CVE-2025-9501, allows attackers to execute arbitrary code on vulnerable websites under specific conditions. Field Details CVE ID CVE-2025-9501 Affected Product…
-
Tenda N300 Flaws Allow Attackers to Run Commands as Root
High command injection vulnerabilities have been discovered in Tenda’s N300 Wi-Fi 4G LTE Router and the 4G03 Pro model, allowing authenticated attackers to execute arbitrary commands with root privileges on affected devices. With no patches currently available from the manufacturer, security experts are urging users to consider alternative solutions to protect their networks from potential…
-
vLLM Flaw Allows Remote Code Execution Through Malicious Payloads
A high security vulnerability has been discovered in vLLM, a widely used high-throughput inference and serving engine for Large Language Models. The flaw, identified as CVE-2025-62164, enables attackers to execute arbitrary code remotely through maliciously crafted payloads sent to the Completions API endpoint. Attribute Details CVE ID CVE-2025-62164 Severity High CVSS Score 8.8/10 Affected Product vLLM…
-
Tenda N300 Flaws Allow Attackers to Run Commands as Root
High command injection vulnerabilities have been discovered in Tenda’s N300 Wi-Fi 4G LTE Router and the 4G03 Pro model, allowing authenticated attackers to execute arbitrary commands with root privileges on affected devices. With no patches currently available from the manufacturer, security experts are urging users to consider alternative solutions to protect their networks from potential…
-
vLLM Flaw Allows Remote Code Execution Through Malicious Payloads
A high security vulnerability has been discovered in vLLM, a widely used high-throughput inference and serving engine for Large Language Models. The flaw, identified as CVE-2025-62164, enables attackers to execute arbitrary code remotely through maliciously crafted payloads sent to the Completions API endpoint. Attribute Details CVE ID CVE-2025-62164 Severity High CVSS Score 8.8/10 Affected Product vLLM…
-
Tenda N300 Flaws Allow Attackers to Run Commands as Root
High command injection vulnerabilities have been discovered in Tenda’s N300 Wi-Fi 4G LTE Router and the 4G03 Pro model, allowing authenticated attackers to execute arbitrary commands with root privileges on affected devices. With no patches currently available from the manufacturer, security experts are urging users to consider alternative solutions to protect their networks from potential…
-
Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs
New research from CrowdStrike has revealed that DeepSeek’s artificial intelligence (AI) reasoning model DeepSeek-R1 produces more security vulnerabilities in response to prompts that contain topics deemed politically sensitive by China.”We found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it First seen on thehackernews.com…
-
vLLM Flaw Allows Remote Code Execution Through Malicious Payloads
A high security vulnerability has been discovered in vLLM, a widely used high-throughput inference and serving engine for Large Language Models. The flaw, identified as CVE-2025-62164, enables attackers to execute arbitrary code remotely through maliciously crafted payloads sent to the Completions API endpoint. Attribute Details CVE ID CVE-2025-62164 Severity High CVSS Score 8.8/10 Affected Product vLLM…
-
Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs
New research from CrowdStrike has revealed that DeepSeek’s artificial intelligence (AI) reasoning model DeepSeek-R1 produces more security vulnerabilities in response to prompts that contain topics deemed politically sensitive by China.”We found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it First seen on thehackernews.com…
-
CISA Urges Patch of Actively Exploited Flaw in Oracle Identity Manager
The US cybersecurity agency has added the critical flaw to its Known Exploited Vulnerabilities list First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-kev-oracle-identity-manager/
-
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Tags: access, cve, exploit, flaw, intelligence, malware, microsoft, open-source, service, threat, update, vulnerability, windowsA recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad.”The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access,” AhnLab Security Intelligence Center (ASEC) said in a report published last week. “They then used PowerCat, an open-source First…
-
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Tags: access, cve, exploit, flaw, intelligence, malware, microsoft, open-source, service, threat, update, vulnerability, windowsA recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad.”The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access,” AhnLab Security Intelligence Center (ASEC) said in a report published last week. “They then used PowerCat, an open-source First…
-
What happens when vulnerability scores fall apart?
Security leaders depend on vulnerability data to guide decisions, but the system supplying that data is struggling. An analysis from Sonatype shows that core vulnerability … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/24/sonatype-vulnerability-scoring-gaps-report/
-
What happens when vulnerability scores fall apart?
Security leaders depend on vulnerability data to guide decisions, but the system supplying that data is struggling. An analysis from Sonatype shows that core vulnerability … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/24/sonatype-vulnerability-scoring-gaps-report/
-
Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
A critical security flaw (CVE-2025-11001) in 7-Zip has a public exploit. Learn why this high-risk vulnerability is dangerous and how to manually update to version 25.01 now. First seen on hackread.com Jump to article: hackread.com/7-zip-vulnerability-public-exploit-manual-update/
-
Week in review: Stealth-patched FortiWeb vulnerability under active exploitation, Logitech data breach
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The tech that turns supply chains from brittle to unbreakable In this Help … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/23/week-in-review-stealth-patched-fortiweb-vulnerability-under-active-exploitation-logitech-data-breach/