⚡ Weekly Recap — SharePoint Breach, Spyware, IoT Hijacks, DPRK Fraud, Crypto Drains and More
- CVEs
- CVE-2025-49706CVE-2025-49704CVE-2025-20281CVE-2025-20337CVE-2025-20282CVE-2025-54068CVE-2025-34300CVE-2025-6704CVE-2025-7624CVE-2025-40599CVE-2025-49656CVE-2025-50151CVE-2025-22230CVE-2025-22247CVE-2025-7783CVE-2025-34140CVE-2025-34141CVE-2025-34142CVE-2025-34143CVE-2025-8069CVE-2025-7723CVE-2025-7724CVE-2025-7742CVE-2025-24000CVE-2025-52449CVE-2025-52452CVE-2025-52453CVE-2025-52454CVE-2025-52455CVE-2025-6241
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-20281+1 related CVE | Unauthenticated Root RCE via API Injection in Cisco ISE and ISE-PIC | 10.0 | 98% | KEVPoC | KEV |
| CVE-2025-20337 | Unauthenticated Injection Flaw Allows Root RCE in Cisco ISE and ISE-PIC | 10.0 | 74% | KEV | KEV |
| CVE-2025-22230 | VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control | 7.8 | <1% | ||
| CVE-2025-22247 | VMware Tools contains an insecure file handling vulnerability | 6.1 | <1% | ||
| CVE-2025-24000 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post… | 8.8 | <1% | ||
| CVE-2025-34140 | An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms) | 8.7 | <1% | ||
| CVE-2025-34141 | A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component | 5.1 | 2% | ||
| CVE-2025-34142 | An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint | 6.9 | <1% | ||
| CVE-2025-34143 | Authentication Bypass Leading to RCE in ETQ Reliance Legacy CG Platform | 9.3 | 32% | ||
| CVE-2025-34300 | Template Injection Yields Unauthenticated RCE in Sawtooth Lighthouse Studio | 10.0 | 78% | ||
| CVE-2025-40599 | An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface | 9.1 | 13% | ||
CVE-2025-50151+1 related CVE | File access paths in configuration files uploaded by users with administrator access are not validated | 8.8 group max | <1% | ||
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
CVE-2025-52452+4 related CVEs | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api -… | 8.5 group max | <1% | ||
| CVE-2025-54068 | Unauthenticated Code Injection RCE in Laravel Livewire v3 | 9.2 | 96% | KEVPoC | KEV |
| CVE-2025-6241 | LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation | 4.4 | <1% | ||
CVE-2025-6704+1 related CVE | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth… | 9.8 | 9% | ||
| CVE-2025-7723 | A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI… | 8.5 | <1% | ||
| CVE-2025-7724 | An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1 | 8.7 | <1% | ||
| CVE-2025-7742 | An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the… | 8.3 | <1% | ||
| CVE-2025-7783 | Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP) | 9.4 | 2% | ||
| CVE-2025-8069 | During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl… | 7.3 | <1% |
From the original article
13 min read at thehackernews.com
Some risks don’t breach the perimeter—they arrive through signed software, clean resumes, or sanctioned vendors still hiding in plain sight. This week, the clearest threats weren’t the loudest—they were the most legitimate-looking. In an environment where identity, trust, and tooling are all interlinked, the strongest attack path is often the one that looks like it belongs.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.