Tag: vulnerability
-
CISA Urges Patch of Actively Exploited Flaw in Oracle Identity Manager
The US cybersecurity agency has added the critical flaw to its Known Exploited Vulnerabilities list First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-kev-oracle-identity-manager/
-
The slow rise of SBOMs meets the rapid advance of AI
Despite years of effort to make software safer and more transparent with SBOMs, the rise of AI coding assistants is fueling optimism”, and, some experts argue, “kind of insane””, claims about a future with vulnerability-free software. First seen on cyberscoop.com Jump to article: cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/
-
Grafana Flags Maximum-Severity SCIM Vulnerability Enabling Privilege Escalation
Grafana Labs has issued a warning regarding a maximum-severity security flaw, identified as CVE-2025-41115, affecting its Enterprise product. The vulnerability can allow attackers to impersonate administrators or escalate privileges if certain SCIM (System for Cross-domain Identity Management) settings are enabled. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/grafana-scim-vulnerability-cve-2025-41115/
-
The slow rise of SBOMs meets the rapid advance of AI
Despite years of effort to make software safer and more transparent with SBOMs, the rise of AI coding assistants is fueling optimism”, and, some experts argue, “kind of insane””, claims about a future with vulnerability-free software. First seen on cyberscoop.com Jump to article: cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/
-
PoC Published for W3 Total Cache Flaw Exposing 1M+ Sites to RCE
Security researchers have published a proof-of-concept exploit for a critical remote code execution vulnerability in W3 Total Cache, one of WordPress’s most popular caching plugins with over one million active installations. The flaw, tracked as CVE-2025-9501, allows attackers to execute arbitrary code on vulnerable websites under specific conditions. Field Details CVE ID CVE-2025-9501 Affected Product…
-
PoC Published for W3 Total Cache Flaw Exposing 1M+ Sites to RCE
Security researchers have published a proof-of-concept exploit for a critical remote code execution vulnerability in W3 Total Cache, one of WordPress’s most popular caching plugins with over one million active installations. The flaw, tracked as CVE-2025-9501, allows attackers to execute arbitrary code on vulnerable websites under specific conditions. Field Details CVE ID CVE-2025-9501 Affected Product…
-
Tenda N300 Flaws Allow Attackers to Run Commands as Root
High command injection vulnerabilities have been discovered in Tenda’s N300 Wi-Fi 4G LTE Router and the 4G03 Pro model, allowing authenticated attackers to execute arbitrary commands with root privileges on affected devices. With no patches currently available from the manufacturer, security experts are urging users to consider alternative solutions to protect their networks from potential…
-
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Tags: access, cve, exploit, flaw, intelligence, malware, microsoft, open-source, service, threat, update, vulnerability, windowsA recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad.”The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access,” AhnLab Security Intelligence Center (ASEC) said in a report published last week. “They then used PowerCat, an open-source First…
-
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Tags: access, cve, exploit, flaw, intelligence, malware, microsoft, open-source, service, threat, update, vulnerability, windowsA recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute malware known as ShadowPad.”The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access,” AhnLab Security Intelligence Center (ASEC) said in a report published last week. “They then used PowerCat, an open-source First…
-
What happens when vulnerability scores fall apart?
Security leaders depend on vulnerability data to guide decisions, but the system supplying that data is struggling. An analysis from Sonatype shows that core vulnerability … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/24/sonatype-vulnerability-scoring-gaps-report/
-
What happens when vulnerability scores fall apart?
Security leaders depend on vulnerability data to guide decisions, but the system supplying that data is struggling. An analysis from Sonatype shows that core vulnerability … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/24/sonatype-vulnerability-scoring-gaps-report/
-
Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
A critical security flaw (CVE-2025-11001) in 7-Zip has a public exploit. Learn why this high-risk vulnerability is dangerous and how to manually update to version 25.01 now. First seen on hackread.com Jump to article: hackread.com/7-zip-vulnerability-public-exploit-manual-update/
-
Week in review: Stealth-patched FortiWeb vulnerability under active exploitation, Logitech data breach
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The tech that turns supply chains from brittle to unbreakable In this Help … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/23/week-in-review-stealth-patched-fortiweb-vulnerability-under-active-exploitation-logitech-data-breach/
-
Windows 11 24H2/Windows Server 2025: ZScaler über kritischen Grafik-Bug CVE-2025-50165
In Windows 11 24H2 sowie in Windows Server 2025 gab es eine kritische Schwachstelle CVE-2025-50165 in den Windows Grafik-Komponenten. Die im August 2025 geschlossene Schwachstelle ist mit einem CVSS 3.1-Score von 9,8 bewertet worden und ermöglichte eine Remote Code Execution … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/11/23/windows-11-24h2-windows-server-2025-zscaler-ueber-kritischen-grafik-bug-cve-2025-50165/
-
Saturday Security: Zero-Day Logitech Breach Exposes 1.8TB of Data
Logitech, a prominent PC accessories brand, has recently confirmed a major data breach after cybercriminals exploited a zero-day vulnerability in a third-party platform. While Logitech assures that exposed data was limited and credit card numbers, as well as national IDs, were not stored on the impacted systems, the situation remains concerning. The notorious Clop ransomware……
-
Saturday Security: Zero-Day Logitech Breach Exposes 1.8TB of Data
Logitech, a prominent PC accessories brand, has recently confirmed a major data breach after cybercriminals exploited a zero-day vulnerability in a third-party platform. While Logitech assures that exposed data was limited and credit card numbers, as well as national IDs, were not stored on the impacted systems, the situation remains concerning. The notorious Clop ransomware……
-
Metasploit Releases New Exploit for Fresh FortiWeb 0-Day Vulnerabilities
Tags: authentication, cve, cyber, exploit, firewall, flaw, fortinet, injection, remote-code-execution, vulnerability, waf, zero-dayRapid7’s Metasploit team has released a new exploit module targeting critical zero-day vulnerabilities in Fortinet’s FortiWeb web application firewall, chaining two security flaws to achieve unauthenticated remote code execution with root privileges.”‹ CVE ID Vulnerability Type Affected Product Impact CVE-2025-64446 Authentication Bypass Fortinet FortiWeb Administrative account creation, privilege escalation CVE-2025-58034 Command Injection Fortinet FortiWeb Remote…
-
CISA Issues Warning as Hackers Target Oracle Identity Manager RCE Flaw
Tags: authentication, cisa, cve, cyber, cybersecurity, exploit, flaw, hacker, identity, infrastructure, kev, oracle, rce, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a new Oracle vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that attackers are already exploiting it in real-world attacks. The bug, tracked as CVE-2025-61757, affects Oracle Identity Manager, part of Oracle Fusion Middleware. The flaw is rated as a “missing authentication for critical…
-
U.S. CISA adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalog
Tags: authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, oracle, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a an Oracle Fusion Middleware flaw, tracked as CVE-2025-61757 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is a missing authentication for a critical function that…
-
7-ZIP-Schwachstelle CVE-2025-11001: Exploits und Angriffe, AMD-Nutzer müssen handeln
In der Packer-Software 7-ZIP gibt es (vor Version 25.x) die Schwachstelle CVE-2025-11001 (hatte ich bisher nicht thematisiert). Seit einigen Tagen sind Exploits bekannt und die Schwachstelle wird angegriffen. Nutzer sollten 7-ZIP also unverzüglich patchen. Problem sind aber Anwendungen, in denen … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/11/22/7-zip-schwachstelle-cve-2025-11001-exploits-und-angriffe-amd-nutzer-muessen-handeln/
-
CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability
Tags: authentication, cisa, cve, cybersecurity, exploit, flaw, identity, infrastructure, kev, oracle, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability in question is CVE-2025-61757 (CVSS score: 9.8), a case of missing authentication for a critical function that can result in pre-authenticated First seen…
-
Critical Azure Bastion Vulnerability Lets Attackers Bypass Login and Escalate Privileges
A critical authentication bypass vulnerability in Azure Bastion, its managed remote access service, enables attackers to escalate privileges to administrative levels with a single network request. The vulnerability, designated CVE-2025-49752, affects all Azure Bastion deployments and received an emergency security patch on November 20, 2025. Attribute Details CVE ID CVE-2025-49752 Vulnerability Type Authentication Bypass /…
-
Hardware Hackers Urge Vendor Engagement for Security Success
Experts Detail Upsides of Bug Bounties and Getting Devices Into Researchers’ Hands. As fresh vulnerabilities in hardware keep coming to light, one question remains: What vendors can do to better prevent, identify and eradiate flaws? One shortlist offered by veteran hardware hackers centered on the upsides of engagement, including bug bounty programs. First seen on…
-
Hardware Hackers Urge Vendor Engagement for Security Success
Experts Detail Upsides of Bug Bounties and Getting Devices Into Researchers’ Hands. As fresh vulnerabilities in hardware keep coming to light, one question remains: What vendors can do to better prevent, identify and eradiate flaws? One shortlist offered by veteran hardware hackers centered on the upsides of engagement, including bug bounty programs. First seen on…
-
Critical SonicOS SSLVPN Vulnerability Allows Remote Firewall Crashes
A critical SonicOS SSLVPN flaw lets remote attackers crash SonicWall firewalls without authentication. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/critical-sonicos-sslvpn-vulnerability-allows-remote-firewall-crashes/
-
LLM09: Misinformation FireTail Blog
Tags: ai, api, awareness, breach, cybersecurity, data, defense, healthcare, intelligence, LLM, mitigation, risk, training, vulnerabilityNov 21, 2025 – Lina Romero – In 2025, Artificial Intelligence is everywhere, and so are AI vulnerabilities. In fact, according to our research, these vulnerabilities are up across the board. The OWASP Top 10 list of Risks to LLMs can help teams track the biggest challenges facing AI security in our current landscape. Misinformation…
-
Cybersecurity Snapshot: Global Agencies Target Criminal “Bulletproof” Hosts, as CSA Unveils Agentic AI Risk Framework
Tags: access, advisory, ai, android, apple, attack, banking, breach, browser, chrome, cisa, ciso, cloud, compliance, control, credentials, credit-card, crypto, cve, cyber, cybercrime, cybersecurity, data, defense, detection, endpoint, extortion, finance, firewall, firmware, flaw, framework, google, governance, government, group, guide, Hardware, ibm, identity, infection, infrastructure, international, Internet, law, linux, malicious, malware, microsoft, mobile, monitoring, network, open-source, oracle, password, phishing, radius, ransomware, rat, resilience, risk, risk-assessment, risk-management, russia, scam, service, software, switch, technology, threat, tool, update, vulnerability, windowsCyber agencies call on ISPs to help combat “bulletproof” internet hosts that shield cybercriminals. Meanwhile, the CSA introduced a new methodology to assess the risks of autonomous AI. Plus, get the latest on the CIS Benchmarks, drone-detection systems, and malware infections. Key takeaways Crackdown on “bulletproof” hosting: International cyber agencies are urging ISPs and network…
-
Critical Grafana Flaw Lets Attackers Escalate Privileges
Grafana Labs has released critical security patches addressing a severe vulnerability in its SCIM provisioning feature that could allow attackers to escalate privileges or impersonate users. The flaw, tracked as CVE-2025-41115 with a CVSS score of 10.0 (Critical), affects Grafana Enterprise versions 12.0.0 through 12.2.1 under specific configurations. Organizations using affected versions should update immediately…
-
From code to boardroom: A GenAI GRC approach to supply chain risk
Tags: ai, blockchain, business, ciso, compliance, dark-web, data, defense, finance, framework, gartner, grc, intelligence, LLM, metric, open-source, regulation, resilience, risk, strategy, supply-chain, threat, vulnerabilityThe GenAI GRC mandate: From reporting to prediction: To counter a threat that moves at the speed of computation, our GRC must also become generative and predictive. The GenAI GRC mandate is to shift the focus from documenting compliance to predicting systemic failure.Current GRC methods are designed for documentation. They verify that a policy exists.…
-
Clop Ransomware Claims Broadcom Breach Through E-Business Suite 0-Day
Tags: access, breach, business, cyber, exploit, infrastructure, intelligence, oracle, ransomware, software, threat, vulnerability, zero-dayThe notorious Cl0p ransomware gang has publicly claimed responsibility for breaching Broadcom, a leading semiconductor and infrastructure software company. According to threat intelligence sources, the attackers exploited an unpatched zero-day vulnerability in Oracle E-Business Suite to gain initial access to the company’s systems. Security researchers have not independently verified the claim, though Broadcom has not…