Ransomwarecritical
⚡ Weekly Recap: Scattered Spider Arrests, Car Exploits, macOS Malware, Fortinet RCE and More
- CVEs
- CVE-2025-25257CVE-2025-25251CVE-2025-31365CVE-2025-22855CVE-2025-22859CVE-2025-31366CVE-2025-47227CVE-2025-47228CVE-2025-24269CVE-2025-24235CVE-2025-30012CVE-2025-42963CVE-2025-42964CVE-2025-42966CVE-2025-42980CVE-2025-52488CVE-2025-44954CVE-2025-44955CVE-2025-44957CVE-2025-44958CVE-2025-44960CVE-2025-44961CVE-2025-44962CVE-2025-44963CVE-2025-6243CVE-2025-52434CVE-2025-52520CVE-2025-53506CVE-2025-6948CVE-2025-0141CVE-2025-6691CVE-2025-7206CVE-2025-32353CVE-2025-32874CVE-2025-7026CVE-2025-7027CVE-2025-7028CVE-2025-7029CVE-2025-1727
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-0141 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to… | 8.4 | <1% | ||
| CVE-2025-1727 | The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation | 7.2 | <1% | ||
| CVE-2025-22855 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow… | 4.8 | <1% | ||
| CVE-2025-22859 | A Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may allow a remote… | 5.3 | <1% | ||
CVE-2025-24269+1 related CVE | The issue was addressed with improved memory handling | 9.8 group max | <1% | ||
| CVE-2025-25251 | An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker… | 7.8 | <1% | ||
| CVE-2025-25257 | Critical Unauthenticated SQL Injection in Fortinet FortiWeb (CVE-2025-25257) | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2025-30012 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to… | 9.8 | <1% | ||
| CVE-2025-31365 | An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an… | 7.1 | <1% | ||
| CVE-2025-31366 | An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0… | 6.1 | <1% | ||
| CVE-2025-32353 | Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file | 8.2 | <1% | ||
| CVE-2025-32874 | An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0 | 7.5 | <1% | ||
| CVE-2025-42963 | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object… | 9.1 | <1% | ||
| CVE-2025-42964 | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could… | 9.1 | <1% | ||
| CVE-2025-42966 | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization… | 9.1 | <1% | ||
| CVE-2025-42980 | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when… | 9.1 | <1% | ||
CVE-2025-44954+4 related CVEs | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account | 9.8 group max | <1% | ||
CVE-2025-44955+2 related CVEs | RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password | 8.8 group max | <1% | ||
| CVE-2025-47227 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled | 7.5 | 2% | ||
| CVE-2025-47228 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated… | 6.7 | 17% | ||
CVE-2025-52520+2 related CVEs | For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits | 7.5 | 2% | ||
| CVE-2025-52488 | Unauthenticated NTLM Hash Leak to Attacker-Controlled SMB Server in DNN Platform | 8.6 | 35% | ||
| CVE-2025-6691 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… | 8.1 | 1% | ||
| CVE-2025-6948 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain… | 8.0 | <1% | ||
| CVE-2025-7026 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer… | 8.2 | <1% | ||
| CVE-2025-7027 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1… | 8.2 | <1% | ||
| CVE-2025-7028 | A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register… | 7.8 | <1% | ||
| CVE-2025-7029 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers… | 8.2 | <1% | ||
| CVE-2025-7206 | Stack buffer overflow in D-Link DIR-825 switch_language.cgi | 8.9 | 22% | PoC |
From the original article
13 min read at thehackernews.com
In cybersecurity, precision matters—and there’s little room for error. A small mistake, missed setting, or quiet misconfiguration can quickly lead to much bigger problems. The signs we’re seeing this week highlight deeper issues behind what might look like routine incidents: outdated tools, slow response to risks, and the ongoing gap between compliance and real security.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.