⚡ Weekly Recap: NFC Fraud, Curly COMrades, N
- CVEs
- CVE-2025-8875CVE-2025-8876CVE-2025-26633CVE-2025-20265CVE-2025-8671CVE-2025-25256CVE-2025-53779CVE-2025-49457CVE-2025-8355CVE-2025-8356CVE-2024-42512CVE-2024-42513CVE-2025-1468CVE-2025-42950CVE-2025-42957CVE-2025-54472CVE-2025-5456CVE-2025-5462CVE-2025-53652CVE-2025-49090CVE-2025-54315CVE-2025-52970CVE-2025-7384CVE-2025-53773CVE-2025-6186CVE-2025-7739CVE-2025-7734CVE-2025-8341CVE-2025-47227CVE-2025-47228CVE-2025-30404CVE-2025-30405CVE-2025-54949CVE-2025-54950CVE-2025-54951CVE-2025-54952CVE-2025-55154CVE-2025-55004CVE-2025-54982
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-42512+1 related CVE | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated… | 8.6 group max | <1% | ||
| CVE-2025-1468 | An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the… | 7.5 | <1% | ||
| CVE-2025-20265 | A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote… | 10.0 | 15% | ||
| CVE-2025-25256 | Unauthenticated OS command injection in Fortinet FortiSIEM (CVE-2025-25256) | 9.8 | 60% | ||
| CVE-2025-26633 | Local Security Feature Bypass in Microsoft Windows Management Console (MMC) | 7.0 | 30% | KEVRansomwarePoC ×2 | KEV |
| CVE-2025-30404 | An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other… | 9.8 | <1% | ||
| CVE-2025-30405 | An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting… | 9.8 | <1% | ||
| CVE-2025-42950 | SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC | 9.9 | <1% | ||
| CVE-2025-42957 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC | 9.9 | 2% | ||
| CVE-2025-47227 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled | 7.5 | 2% | ||
| CVE-2025-47228 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated… | 6.7 | 17% | ||
| CVE-2025-49090 | The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution | 7.1 | <1% | ||
| CVE-2025-49457 | Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access | 8.8 | <1% | ||
| CVE-2025-52970 | A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may… | 8.1 | 10% | PoC | |
| CVE-2025-53652 | Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered… | 8.2 | <1% | ||
| CVE-2025-53773 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to… | 7.8 | 3% | PoC | |
| CVE-2025-53779 | Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network | 7.2 | 3% | ||
| CVE-2025-54315 | The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness | 7.1 | <1% | ||
| CVE-2025-54472 | Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network | 7.5 | 1% | ||
CVE-2025-5462+1 related CVE | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723… | 7.5 | 1% | ||
| CVE-2025-54949 | A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects | 9.8 | <1% | ||
| CVE-2025-54950 | An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other… | 9.8 | <1% | ||
| CVE-2025-54951 | A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution… | 9.8 | <1% | ||
| CVE-2025-54952 | An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in… | 9.8 | <1% | ||
| CVE-2025-54982 | An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse | 9.6 | <1% | ||
CVE-2025-55154+1 related CVE | ImageMagick is free and open-source software used for editing and manipulating digital images | 7.8 group max | <1% | PoC | |
CVE-2025-7739+2 related CVEs | An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated… | 5.4 | <1% | ||
| CVE-2025-7384 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… | 9.8 | 1% | ||
| CVE-2025-8341 | Grafana: The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML… | 5.0 | <1% | ||
CVE-2025-8356+1 related CVE | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server | 9.8 group max | 15% | ||
| CVE-2025-8671 | A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may… | 7.5 | 4% | ||
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
From the original article
13 min read at thehackernews.com
Power doesn’t just disappear in one big breach. It slips away in the small stuff—a patch that’s missed, a setting that’s wrong, a system no one is watching. Security usually doesn’t fail all at once; it breaks slowly, then suddenly.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.