Data breachcritical
⚡ THN Weekly Recap: From $1.5B Crypto Heist to AI Misuse & Apple’s Data Dilemma
- CVEs
- CVE-2018-0171CVE-2025-24989CVE-2025-23209CVE-2024-12284CVE-2025-26465CVE-2025-26466CVE-2025-21589CVE-2024-12510CVE-2024-12511CVE-2025-0366CVE-2024-50379CVE-2024-56337CVE-2024-52316CVE-2024-53900CVE-2025-23061CVE-2025-26776CVE-2025-26763CVE-2024-54756CVE-2024-57401CVE-2025-20059CVE-2025-0868CVE-2025-1023CVE-2025-1132CVE-2025-1133CVE-2025-1134CVE-2025-1135CVE-2024-57045CVE-2024-57050CVE-2024-57049CVE-2025-26794CVE-2024-50608CVE-2024-50609CVE-2024-54961CVE-2025-23115CVE-2025-23116
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0171 | Unauthenticated RCE/DoS in Cisco IOS & IOS XE Smart Install | 9.8 | 99% | KEV | KEV |
| CVE-2024-12284 | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows | 8.8 | 13% | ||
| CVE-2024-12510 | If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials | 6.7 | <1% | ||
| CVE-2024-12511 | With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials | 7.6 | <1% | ||
| CVE-2024-50379 | TOCTOU Race Condition in Apache Tomcat JSP Compilation Enables RCE | 9.8 | 44% | ||
CVE-2024-50608+1 related CVE | An issue was discovered in Fluent Bit 3.1.9 | 7.5 | 1% | PoC | |
| CVE-2024-52316 | Unchecked Error Condition vulnerability in Apache Tomcat | 9.8 | 6% | ||
| CVE-2024-53900 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection | 9.1 | 4% | ||
| CVE-2024-54756 | A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a… | 9.8 | 3% | ||
| CVE-2024-54961 | Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and… | 6.5 | 2% | ||
| CVE-2024-56337 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat | 9.8 | 9% | ||
| CVE-2024-57045 | Authentication Bypass in D-Link DIR-859 Firmware Leaks Admin Credentials | 9.8 | 32% | PoC | |
| CVE-2024-57049 | Rejected reason: DO NOT USE THIS CVE RECORD | — | — | ||
| CVE-2024-57050 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER | — | — | ||
| CVE-2024-57401 | SQL Injection vulnerability in Uniclare Student portal v.2 and before allows a remote attacker to execute arbitrary code via the Forgot Password function | 9.8 | <1% | ||
| CVE-2025-0366 | The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the… | 8.8 | 2% | ||
| CVE-2025-0868 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT | 9.3 | 17% | ||
| CVE-2025-1023 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection… | 9.3 | 2% | PoC | |
CVE-2025-1134+3 related CVEs | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based… | 9.3 | <1% | PoC | |
| CVE-2025-20059 | Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent | 9.2 | <1% | ||
| CVE-2025-21589 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to… | 9.3 | 1% | ||
| CVE-2025-23061 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection | 9.8 | 7% | ||
| CVE-2025-23115 | A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras… | 9.0 | <1% | ||
| CVE-2025-23116 | An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi… | 9.6 | <1% | ||
| CVE-2025-23209 | Code Injection via Database Backup Path in Craft CMS Enables RCE | 8.1 | 22% | KEV | KEV |
| CVE-2025-24989 | Access Control Bypass Enables Privilege Escalation in Microsoft Power Pages | 9.8 | 2% | KEV | KEV |
| CVE-2025-26465 | OpenSSH when the VerifyHostKeyDNS option is enabled: A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how… | 6.8 | 8% | ||
| CVE-2025-26466 | Unauthenticated Memory-Exhaustion DoS in OpenSSH | 5.9 | 40% | ||
| CVE-2025-26763 | Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive… | 9.8 | <1% | ||
| CVE-2025-26776 | Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server | 10.0 | <1% | ||
| CVE-2025-26794 | Critical Unauthenticated SQL Injection in Exim 4.98 | 9.8 | 77% |
From the original article
12 min read at thehackernews.com
Welcome to your weekly roundup of cyber news, where every headline gives you a peek into the world of online battles. This week, we look at a huge crypto theft, reveal some sneaky AI scam tricks, and discuss big changes in data protection. Let these stories spark your interest and help you understand the changing threats in our digital world.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.