⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
- CVEs
- CVE-2025-64446CVE-2025-64740CVE-2025-64741CVE-2025-64738CVE-2025-64739CVE-2025-12485CVE-2025-59396CVE-2025-42890CVE-2025-42887CVE-2025-12686CVE-2025-10918CVE-2025-12120CVE-2025-12121CVE-2025-11919CVE-2025-46608CVE-2025-64401CVE-2025-64403CVE-2025-64404CVE-2025-64405CVE-2025-62449CVE-2025-62453CVE-2025-37734CVE-2025-4619CVE-2025-11224CVE-2025-52970CVE-2025-59367CVE-2025-43515
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10918 | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files… | 7.1 | <1% | ||
| CVE-2025-11224 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have… | 5.4 | <1% | ||
| CVE-2025-11919 | The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance… | 9.6 | <1% | ||
CVE-2025-12121+1 related CVE | Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell… | 7.3 | <1% | PoC | |
| CVE-2025-12485 | Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by… | 8.8 | <1% | ||
| CVE-2025-12686 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote… | 9.8 | 3% | ||
| CVE-2025-37734 | Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant | 4.3 | <1% | ||
| CVE-2025-42887 | Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module | 9.9 | <1% | ||
| CVE-2025-42890 | SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the… | 10.0 | <1% | ||
| CVE-2025-43515 | The issue was addressed by refusing external connections by default | 8.8 | <1% | ||
| CVE-2025-4619 | A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to reboot a firewall by sending a specially… | 6.6 | <1% | ||
| CVE-2025-46608 | Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability | 7.2 | <1% | ||
| CVE-2025-52970 | A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may… | 8.1 | 10% | PoC | |
| CVE-2025-59367 | certain DSL series routers: Refer to the 'Security Update for DSL Series Router' section on the ASUS Security Advisory for more information | 9.3 | <1% | ||
| CVE-2025-59396 | Rejected reason: Not a security vulnerability | — | — | ||
| CVE-2025-62449 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to… | 6.8 | <1% | ||
| CVE-2025-62453 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally | 5.0 | <1% | ||
CVE-2025-64403+3 related CVEs | Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources" | 8.1 group max | 1% | ||
| CVE-2025-64446 | Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution | 9.8 | 91% | KEVPoC | KEV |
CVE-2025-64741+2 related CVEs | Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via… | 9.8 group max | <1% | ||
| CVE-2025-64740 | Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an… | 7.8 | <1% |
From the original article
13 min read at thehackernews.com
This week showed just how fast things can go wrong when no one’s watching. Some attacks were silent and sneaky. Others used tools we trust every day — like AI, VPNs, or app stores — to cause damage without setting off alarms.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.