⚡ Weekly Recap: iPhone Spyware, Microsoft 0-Day, TokenBreak Hack, AI Data Leaks and More
- CVEs
- CVE-2025-43200CVE-2025-32711CVE-2025-33053CVE-2025-47110CVE-2025-43697CVE-2025-43698CVE-2025-43699CVE-2025-43700CVE-2025-43701CVE-2025-24016CVE-2025-5484CVE-2025-5485CVE-2025-31022CVE-2025-3835CVE-2025-42989CVE-2025-5353CVE-2025-22463CVE-2025-22455CVE-2025-5958CVE-2025-3052CVE-2025-2884CVE-2025-26521CVE-2025-47950CVE-2025-4230CVE-2025-4232CVE-2025-4278CVE-2025-2254
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-22455+2 related CVEs | A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials | 7.8 group max | <1% | ||
CVE-2025-4278+1 related CVE | An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2 | 8.7 group max | 9% | ||
| CVE-2025-24016 | Deserialization RCE in Wazuh Server (CVE-2025-24016) | 9.9 | 94% | KEVPoC | KEV |
| CVE-2025-26521 | When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the… | 8.1 | <1% | ||
| CVE-2025-2884 | TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with… | 6.6 | <1% | ||
| CVE-2025-3052 | An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software | 8.2 | <1% | ||
| CVE-2025-31022 | Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU… | 9.8 | <1% | ||
| CVE-2025-32711 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network | 7.5 | 7% | ||
| CVE-2025-33053 | Remote Code Execution in Microsoft Windows Internet Shortcut Files (CVE-2025-33053) | 8.8 | 87% | KEVPoC ×3 | KEV |
| CVE-2025-3835 | Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module | 9.6 | 2% | ||
| CVE-2025-4230 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | 8.4 | <1% | ||
| CVE-2025-4232 | An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non… | 8.5 | <1% | ||
| CVE-2025-42989 | RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges | 9.6 | <1% | ||
| CVE-2025-43200 | Apple iCloud Link media-processing logic flaw exploited in targeted attacks | 4.2 | 1% | KEV | KEV |
| CVE-2025-43697 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data | 7.5 | <1% | ||
| CVE-2025-43698 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects | 9.1 | <1% | ||
| CVE-2025-43699 | Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check | 5.3 | <1% | ||
| CVE-2025-43700 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data | 7.5 | <1% | ||
| CVE-2025-43701 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data | 7.5 | <1% | ||
| CVE-2025-47110 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that… | 8.4 | <1% | ||
| CVE-2025-47950 | CoreDNS: A Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously… | 7.5 | 1% | ||
| CVE-2025-5484 | A username and password are required to authenticate to the central SinoTrack device management interface | 7.6 | <1% | ||
| CVE-2025-5485 | User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits | 8.8 | <1% | ||
| CVE-2025-5958 | Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page | 8.8 | <1% |
From the original article
13 min read at thehackernews.com
Some of the biggest security problems start quietly. No alerts. No warnings.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.