The UK’s deeptech ecosystem is positioning itself as Europe’s infrastructural base for AI, with the compute sector emerging as a…

…the average American, I think, has fewer than three friends. And the average person has demand for meaningfully more, I…

Dali Clock is a digital clock. When a digit changes, it “melts” into its new shape. The date is displayed…

BeyondTrust PRA connection takeover – CVE-2025-0217

Full Disclosure
mailing list archives
BeyondTrust PRA connection takeover – CVE-2025-0217
From: Paul Szabo via Fulldisclosure
Date: Wed, 7 May 2025 07:01:12 +1000
=== …
Read more

Published Date:
May 06, 2025 (5 hours, 29 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-0217

CVE-2023-23632

Critical AWS Amplify Studio Flaw Allows Code Execution – Update Now!

A critical-severity security flaw has been identified in AWS Amplify Studio, specifically within the amplify-codegen-ui package. This vulnerability, tracked as CVE-2025-4318 and with a critical CVSSv4 …
Read more

Published Date:
May 07, 2025 (3 hours, 45 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-4318

CVE-2025-24977: Critical RCE Flaw in OpenCTI Platform Exposes Infrastructure to Root-Level Attacks

A critical security vulnerability has been identified in the OpenCTI Platform, an open-source solution used by organizations to manage cyber threat intelligence. The vulnerability, tracked as CVE-2025 …
Read more

Published Date:
May 07, 2025 (3 hours, 36 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-24977

CoGUI Phishing Kit: Advanced Evasion Tactics Target Japan

Threat actors using a sophisticated phishing kit called CoGUI have launched a torrent of Japanese-language credential theft campaigns, flooding inboxes with millions of phishing emails each month, acc …
Read more

Published Date:
May 07, 2025 (3 hours, 33 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-24977

CVE-2025-47241

CVE-2024-25608

CVE-2025-47241: Critical Whitelist Bypass in Browser Use Exposes Internal Services

Security researchers from ARIMLABS.AI have disclosed a serious vulnerability in the Browser Use project—a tool that provides browser automation capabilities for AI agents. Tracked as CVE-2025-47241, t …
Read more

Published Date:
May 07, 2025 (3 hours, 25 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-46728

CVE-2025-47241

CVE-2025-46728: cpp-httplib Vulnerability Exposes Servers to Denial of Service

The cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library known for its ease of setup, is facing a serious security vulnerability. A recently identified flaw, tracked as CVE-2 …
Read more

Published Date:
May 07, 2025 (3 hours, 20 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-46728

CVE-2025-47241

CVE-2024-12254

CVE-2024-11120

CVE-2024-6047

Botnet Exploits Old GeoVision IoT Devices via CVE-2024-6047 & CVE-2024-11120

The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of two command injection vulnerabilities — CVE-2024-6047 and CVE-2024-11120 — in discontinued GeoVision IoT …
Read more

Published Date:
May 07, 2025 (3 hours, 14 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-25014

CVE-2025-46728

CVE-2024-11120

CVE-2024-41710

CVE-2024-6047

CVE-2018-10561

CVE-2025-25014 (CVSS 9.1): Prototype Pollution in Kibana Opens Door to Code Execution

Elastic has issued a critical security advisory for Kibana, warning users of a vulnerability tracked as CVE-2025-25014. Scoring a CVSS of 9.1, this flaw stems from a prototype pollution vulnerability …
Read more

Published Date:
May 07, 2025 (3 hours, 11 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-25014

CVE-2024-12556

CVE-2025-25015

CVE-2024-43707

CVE-2024-11120

CVE-2024-37285

CVE-2024-37288

CVE-2024-37287

CVE-2024-6047

CISA Adds CVE-2025-27363 to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-27363, a critical out-of-bounds write vulnerability in FreeType, to its Known Exploited Vulnerabilities (KEV) Catalog due …
Read more

Published Date:
May 07, 2025 (1 hour, 39 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-27363

CVE ID : CVE-2025-3218

Published : May 7, 2025, 2:15 a.m. | 1 hour, 20 minutes ago

Description : IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to authentication and authorization attacks due to incorrect validation processing in IBM i Netserver. A malicious actor could use the weaknesses, in conjunction with brute force authentication attacks or to bypass authority restrictions, to access the server.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-2821

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest_permission function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to modify plugin settings, excluding content from search results.

Severity: 5.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-3844

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2. This is due to handel_ajax_req() function not having proper restrictions on the change_user_meta functionality that makes it possible to set a OTP code and subsequently log in with that OTP code. This makes it possible for unauthenticated attackers to login as other users on the site, including administrators.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-3851

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user’s data like email address, name, and notes.

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-3852

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user’s identity prior to updating their details like email & password through the update() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user’s passwords, including administrators, and leverage that to gain access to their account.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-3853

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.

Severity: 6.5 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-3860

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The CarDealerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘saleclass’ parameter in all versions up to, and including, 6.7.2504.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-3921

Published : May 7, 2025, 3:15 a.m. | 20 minutes ago

Description : The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user’s metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.

Severity: 8.2 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…