Snapshot
Feb. 8, 2025 - Feb. 14, 2025
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2024-57727 | SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords. | HIGH | SimpleHelp | Feb. 13, 2025 |
| CVE-2024-41710 | Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system. | HIGH | Mitel | Feb. 12, 2025 |
| CVE-2025-24200 | Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. | MEDIUM | Apple | Feb. 12, 2025 |
| CVE-2024-40891 | Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. | HIGH | Zyxel | Feb. 11, 2025 |
| CVE-2024-40890 | Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. | HIGH | Zyxel | Feb. 11, 2025 |
| CVE-2025-21418 | Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. | HIGH | Microsoft | Feb. 11, 2025 |
| CVE-2025-21391 | Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. | HIGH | Microsoft | Feb. 11, 2025 |
Newswires |
||||
|
U.S. CISA Catalogs SimpleHelp Vulnerability as Known Exploited Threat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has incorporated a SimpleHelp flaw, labeled as CVE-2024-57727, into its Known Exploited Vulnerabilities (KEV) catalog. |
Feb. 14, 2025 |
|||
|
RansomHub Emerges as Leading Ransomware Group in 2024, Impacting Over 600 Global Entities
RansomHub, a ransomware-as-a-service operation, has risen to prominence in 2024, affecting over 600 organizations around the globe. |
Feb. 14, 2025 |
|||
|
Targeted Attacks Exploit PostgreSQL Flaw Alongside BeyondTrust Zero-Day Vulnerability
Rapid7's research into a zero-day vulnerability in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) products, identified in December 2024, has led to the discovery of a previously unknown SQL injection flaw in PostgreSQL. |
Feb. 14, 2025 |
|||
|
Critical Remote Code Execution Vulnerability Identified in WinZip: CVE-2025-1240
A critical vulnerability, designated as CVE-2025-1240, has been unearthed in the popular file compression software, WinZip. |
Feb. 14, 2025 |
|||
|
Palo Alto Networks Addresses High-Severity Firewall Vulnerability Amid Active Exploits
Palo Alto Networks has resolved a critical authentication bypass vulnerability (CVE-2025-0108) in the management web interface of its next-generation firewalls. |
Feb. 14, 2025 |
|||
|
Russian Sandworm APT's Subgroup, BadPilot, Exploits Edge Bugs on a Global Scale
Sandworm, also known as Seashell Blizzard or Military Unit 74455 within Russia's military intelligence (GRU), is a renowned advanced persistent threat (APT) group. |
Feb. 12, 2025 |
|||
|
PandasAI Vulnerability Allows Full System Compromise Through Prompt Injection
A recently identified security flaw in the open-source AI-based data analysis library, PandasAI, developed by SinaptikAI, has been found to expose users to potential remote code execution (RCE) through prompt injection attacks. |
Feb. 12, 2025 |
|||
|
Fortinet Firewalls Compromised by New Zero-Day Exploit
Fortinet has issued a warning about threat actors exploiting a new zero-day vulnerability, tracked as CVE-2025-24472 (with a CVSS score of 8.1), in its FortiOS and FortiProxy products to hijack firewalls. |
Feb. 11, 2025 |
|||
|
SonicWall Firewall Vulnerability Allows VPN Session Hijacking: Urgent Patch Required
Bishop Fox security researchers have released a comprehensive report detailing the exploitation of a vulnerability, CVE-2024-53704, in certain versions of SonicWall's SonicOS SSLVPN application. |
Feb. 11, 2025 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2024-1709 (6) | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vuln... | CRITICAL | Connectwise |
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
| CVE-2024-0012 (7) | An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the... | CRITICAL | Paloaltonetworks, Palo Alto Networks |
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
| CVE-2024-55591 (5) | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7... | CRITICAL | Fortinet |
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
| CVE-2024-53704 (5) | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. | CRITICAL | Sonicwall |
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
| CVE-2023-48788 (5) | A improper neutralization of special elements used in an sql command in Fortinet FortiClientEMS version 7.2.0 through 7.2.2,... | CRITICAL | Fortinet |
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
| CVE-2025-21418 (12) | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | HIGH | Microsoft |
CISA Known Exploited |
| CVE-2025-21391 (12) | Windows Storage Elevation of Privilege Vulnerability | HIGH | Microsoft |
CISA Known Exploited |
| CVE-2025-21194 (5) | Microsoft Surface Security Feature Bypass Vulnerability | HIGH | Risk Context N/A | |
| CVE-2025-21377 (7) | NTLM Hash Disclosure Spoofing Vulnerability | MEDIUM | Microsoft | Risk Context N/A |
| CVE-2025-24200 (8) | An authorization issue was addressed with improved state management. | MEDIUM | Apple |
CISA Known Exploited Remote Code Execution Public Exploits Available |
CISA Known Exploited Vulnerabilities
CISA added seven vulnerabilities to the known exploited vulnerabilities list.
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2024-1709 |
|
CRITICAL CVSS 10.00 EPSS Score 95.72 EPSS Percentile 99.59 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
|
Published: Feb. 21, 2024 |
|
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. |
|
Vendor Impacted: Connectwise |
|
Product Impacted: Screenconnect |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-0012 |
|
CRITICAL CVSS 9.80 EPSS Score 97.03 EPSS Percentile 99.86 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
|
Published: Nov. 18, 2024 |
|
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability. |
|
Vendors Impacted: Paloaltonetworks, Palo Alto Networks |
|
Product Impacted: Pan-Os |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-55591 |
|
CRITICAL CVSS 9.80 EPSS Score 2.63 EPSS Percentile 90.30 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: Jan. 14, 2025 |
|
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. |
|
Vendor Impacted: Fortinet |
|
Products Impacted: Fortios, Fortios And Fortiproxy, Fortiproxy |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-53704 |
|
CRITICAL CVSS 9.80 EPSS Score 96.07 EPSS Percentile 99.65 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
|
Published: Jan. 9, 2025 |
|
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. |
|
Vendor Impacted: Sonicwall |
|
Products Impacted: Nsa 5700, Nsa 2700, Tz570w, Tz670, Nssp 11700, Nssp 15700, Nsv 470, Sonicos, Tz370, Tz470w, Nssp 10700, Nsa 3700, Tz570, Nssp 13700, Tz470, Tz370w, Nsv 270, Tz270w, Nsv 870, Nsa 6700, Tz570p, Tz80, Nsa 4700, Tz270 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-48788 |
|
CRITICAL CVSS 9.80 EPSS Score 96.82 EPSS Percentile 99.81 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
|
Published: March 12, 2024 |
|
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets. |
|
Vendor Impacted: Fortinet |
|
Products Impacted: Forticlient Ems, Forticlient Enterprise Management Server |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-21418 |
|
HIGH CVSS 7.80 EPSS Score 0.05 EPSS Percentile 22.91 |
|
CISA Known Exploited |
|
Published: Feb. 11, 2025 |
|
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows Server 2022, Windows, Windows 11 23h2, Windows 10 22h2, Windows 11 24h2, Windows Server 2016, Windows 10 1809, Windows Server 2022 23h2, Windows 10 1607, Windows Server 2012, Windows 10 21h2, Windows Server 2019, Windows 11 22h2, Windows Server 2008, Windows Server 2025 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-21391 |
|
HIGH CVSS 7.10 EPSS Score 0.09 EPSS Percentile 39.71 |
|
CISA Known Exploited |
|
Published: Feb. 11, 2025 |
|
Windows Storage Elevation of Privilege Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows Server 2022, Windows, Windows 11 23h2, Windows 10 22h2, Windows 11 24h2, Windows Server 2016, Windows 10 1809, Windows Server 2022 23h2, Windows 10 1607, Windows 10 21h2, Windows Server 2019, Windows 11 22h2, Windows 10 1507, Windows Server 2025 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-21194 |
|
HIGH CVSS 7.10 EPSS Score 0.05 EPSS Percentile 24.42 |
|
Risk Context N/A |
|
Published: Feb. 11, 2025 |
|
Microsoft Surface Security Feature Bypass Vulnerability |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-21377 |
|
MEDIUM CVSS 6.50 EPSS Score 0.09 EPSS Percentile 41.14 |
|
Risk Context N/A |
|
Published: Feb. 11, 2025 |
|
NTLM Hash Disclosure Spoofing Vulnerability |
|
Vendor Impacted: Microsoft |
|
Products Impacted: Windows Server 2022, Windows 11 23h2, Windows 10 22h2, Windows 11 24h2, Windows Server 2016, Windows 10 1809, Windows Server 2022 23h2, Windows 10 1607, Windows Server 2012, Windows 10 21h2, Windows Server 2019, Windows 11 22h2, Windows Server 2008, Windows 10 1507, Windows Server 2025 |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-24200 |
|
MEDIUM CVSS 6.10 EPSS Score 1.04 EPSS Percentile 84.08 |
|
CISA Known Exploited Remote Code Execution Public Exploits Available |
|
Published: Feb. 10, 2025 |
|
An authorization issue was addressed with improved state management. This issue is fixed in iPadOS 17.7.5, iOS 18.3.1 and iPadOS 18.3.1. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. |
|
Vendor Impacted: Apple |
|
Products Impacted: Ipados, Iphone Os, Ios And Ipados |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
