Snapshot
Feb. 1, 2025 - Feb. 7, 2025
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2020-15069 | Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature. | CRITICAL | Sophos | Feb. 6, 2025 |
| CVE-2020-29574 | CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. | CRITICAL | Sophos | Feb. 6, 2025 |
| CVE-2024-21413 | Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. | CRITICAL | Microsoft | Feb. 6, 2025 |
| CVE-2022-23748 | Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code. | HIGH | Audinate | Feb. 6, 2025 |
| CVE-2025-0411 | 7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user. | HIGH | 7-Zip | Feb. 6, 2025 |
| CVE-2024-53104 | Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege. | HIGH | Linux | Feb. 5, 2025 |
| CVE-2018-19410 | Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator). | CRITICAL | Paessler | Feb. 4, 2025 |
| CVE-2024-29059 | Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. | HIGH | Microsoft | Feb. 4, 2025 |
| CVE-2024-45195 | Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access. | HIGH | Apache | Feb. 4, 2025 |
| CVE-2018-9276 | Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console. | HIGH | Paessler | Feb. 4, 2025 |
Newswires |
||||
|
Urgent Call to Secure Systems Against Ongoing Attacks Exploiting Microsoft Outlook RCE Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to federal agencies to fortify their systems against ongoing attacks that are exploiting a critical remote code execution (RCE) vulnerability in Microsoft Outlook. |
Feb. 6, 2025 |
|||
|
SimpleHelp RMM Vulnerabilities Exploited to Deploy Sliver Malware
Cybercriminals are exploiting vulnerabilities in SimpleHelp RMM clients to create admin accounts, drop backdoors, and potentially prepare for ransomware attacks. |
Feb. 6, 2025 |
|||
|
Critical Vulnerabilities in Cisco's Identity Services Engine: A Detailed Analysis
Cisco has issued fixes for two critical vulnerabilities in its Identity Services Engine (ISE), a platform used by businesses for identity and access management. |
Feb. 6, 2025 |
|||
|
CISA Mandates Federal Agencies to Address Linux Kernel Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has instructed federal agencies to fortify their systems against a high-risk Linux kernel flaw, known as CVE-2024-53104, within a three-week timeframe. |
Feb. 5, 2025 |
|||
|
CISA Highlights Exploited Flaws in Microsoft .NET and Apache OFBiz
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has identified four new vulnerabilities that have been exploited in recent attacks. |
Feb. 5, 2025 |
|||
|
Zyxel Refuses to Patch Actively Exploited Flaws in Discontinued Routers
Zyxel, a network hardware manufacturer, has released a security advisory warning about actively exploited vulnerabilities in its CPE Series devices. |
Feb. 4, 2025 |
|||
|
Zero-Day Attacks Exploit 7-Zip Vulnerability to Target Ukrainian Entities
A vulnerability in the 7-Zip file archiver program has been exploited by Russian hackers to bypass the Windows security feature known as Mark of the Web (MotW). |
Feb. 4, 2025 |
|||
|
Google Patches Android Kernel Zero-Day Exploited in Attacks and Other Vulnerabilities in January 2025 Security Updates
In the January 2025 security updates, Google has patched 48 vulnerabilities, among which is a zero-day kernel vulnerability (CVE-2024-53104) that has been exploited in the wild. |
Feb. 3, 2025 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2024-45569 (5) | Memory corruption while parsing the ML IE due to invalid frame content. | CRITICAL | Qualcomm | Risk Context N/A |
| CVE-2018-19410 (3) | PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges . | CRITICAL | Paessler |
CISA Known Exploited Public Exploits Available |
| CVE-2024-40891 (5) | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy ... | HIGH | Risk Context N/A | |
| CVE-2024-53104 (8) | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDE... | HIGH | Linux |
CISA Known Exploited Actively Exploited |
| CVE-2025-0626 (3) | Contec Health CMS8000 Patient Monitor sends out remote access requests to a hard-coded IP address, bypassing existing device ... | HIGH | Risk Context N/A | |
| CVE-2024-56161 (5) | Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privileg... | HIGH |
Actively Exploited Remote Code Execution |
|
| CVE-2018-9276 (3) | An issue was discovered in PRTG Network Monitor before 18.2.39. | HIGH | Paessler |
CISA Known Exploited Public Exploits Available |
| CVE-2025-0411 (4) | 7-Zip Mark-of-the-Web Bypass Vulnerability. | HIGH | 7-Zip |
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
| CVE-2025-0683 (3) | In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public... | MEDIUM | Risk Context N/A | |
CISA Known Exploited Vulnerabilities
CISA added 10 vulnerabilities to the known exploited vulnerabilities list.
Sophos — XG Firewall |
|
CVE-2020-15069 / Added: Feb. 6, 2025 |
|
CRITICAL CVSS 9.80 EPSS Score 1.00 EPSS Percentile 83.67 |
|
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature. |
|
Headlines |
Sophos — CyberoamOS |
|
CVE-2020-29574 / Added: Feb. 6, 2025 |
|
CRITICAL CVSS 9.80 EPSS Score 0.21 EPSS Percentile 58.75 |
|
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. |
|
Headlines |
Audinate — Dante Discovery |
|
CVE-2022-23748 / Added: Feb. 6, 2025 |
|
HIGH CVSS 7.80 EPSS Score 0.07 EPSS Percentile 32.41 |
|
Dante Discovery contains a process control vulnerability in mDNSResponder.exe that all allows for a DLL sideloading attack. A local attacker can leverage this vulnerability in the Dante Application Library to execute arbitrary code. |
|
Headlines
|
7-Zip — 7-Zip |
|
CVE-2025-0411 / Added: Feb. 6, 2025 |
|
HIGH CVSS 7.00 EPSS Score 0.04 EPSS Percentile 11.48 |
|
7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user. |
|
Headlines
|
Paessler — PTRG Network Monitor |
|
CVE-2018-19410 / Added: Feb. 4, 2025 |
|
CRITICAL CVSS 9.80 EPSS Score 4.91 EPSS Percentile 92.77 |
|
Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator). |
|
Headlines
|
Microsoft — .NET Framework |
|
CVE-2024-29059 / Added: Feb. 4, 2025 |
|
HIGH CVSS 7.50 EPSS Score 69.86 EPSS Percentile 98.24 |
|
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. |
|
Headlines
|
Paessler — PRTG Network Monitor |
|
CVE-2018-9276 / Added: Feb. 4, 2025 |
|
HIGH CVSS 7.20 EPSS Score 81.10 EPSS Percentile 98.61 |
|
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console. |
|
Headlines
|
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2024-45569 |
|
CRITICAL CVSS 9.80 EPSS Score 0.08 EPSS Percentile 35.96 |
|
Risk Context N/A |
|
Published: Feb. 3, 2025 |
|
Memory corruption while parsing the ML IE due to invalid frame content. |
|
Vendor Impacted: Qualcomm |
|
Products Impacted: Qcn6112, Wcn7880 Firmware, Sa8770p, Snapdragon X75 5g Modem-Rf, Srv1h Firmware, Fastconnect 6700, Immersive Home 216 Firmware, Ipq8070a Firmware, Qca4024 Firmware, Sm8635p, Ipq8173, Qcn6402 Firmware, Sa8775p, Ipq6028 Firmware, Sm8635 Firmware, Qca9888, Wcn7880, Wsa8845h Firmware, Wcd9380, Qcn5022, Sm8635, Immersive Home 214 Firmware, Sa6155p, Immersive Home 326, Wcd9340 Firmware, Qcn5152, Sa8650p Firmware, Qca6696 Firmware, Wsa8835, Qca6595, Qcn9160, Qcn6023 Firmware, Ipq8078a Firmware, Qca0000, Qca8386 Firmware, Qam8255p Firmware, Ipq8071a, Sdx65m Firmware, Qca6574a, Video Collaboration Vc3 Platform, Qcm5430 Firmware, Qca6574au Firmware, Ipq9048 Firmware, Ipq9570, Qcm6490 Firmware, Qcs8300 Firmware, Wcn7860 Firmware, Qca8386, Qca6678aq Firmware, Immersive Home 3210 Firmware, Qcm8550 Firmware, Qcs9100, Srv1m, Sdx55 Firmware, Qcn9072 Firmware, Snapdragon 8\+ Gen 2 Mobile, Srv1h, Qcn9160 Firmware, Qcn5122 Firmware, Qcn9100 Firmware, Wcd9395 Firmware, Qca4024, Qcn6224 Firmware, Ipq8078 Firmware, Srv1l,... |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2018-19410 |
|
CRITICAL CVSS 9.80 EPSS Score 4.91 EPSS Percentile 92.77 |
|
CISA Known Exploited Public Exploits Available |
|
Published: Nov. 21, 2018 |
|
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator). |
|
Vendor Impacted: Paessler |
|
Products Impacted: Prtg Network Monitor, Ptrg Network Monitor |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-40891 |
|
HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 23.20 |
|
Risk Context N/A |
|
Published: Feb. 4, 2025 |
|
**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2024-53104 |
|
HIGH CVSS 7.80 EPSS Score 0.14 EPSS Percentile 49.81 |
|
CISA Known Exploited Actively Exploited |
|
Published: Dec. 2, 2024 |
|
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. |
|
Vendor Impacted: Linux |
|
Products Impacted: Linux Kernel, Kernel |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-0626 |
|
HIGH CVSS 7.50 EPSS Score 0.04 EPSS Percentile 11.48 |
|
Risk Context N/A |
|
Published: Jan. 30, 2025 |
|
Contec Health CMS8000 Patient Monitor sends out remote access requests to a hard-coded IP address, bypassing existing device network settings to do so. This could serve as a backdoor and lead to a malicious actor being able to upload and overwrite files on the device. |
|
Quotes
|
|
Headlines |
| Back to top ↑ |
CVE-2024-56161 |
|
HIGH CVSS 7.20 EPSS Score 0.04 EPSS Percentile 11.48 |
|
Actively Exploited Remote Code Execution |
|
Published: Feb. 3, 2025 |
|
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2018-9276 |
|
HIGH CVSS 7.20 EPSS Score 81.10 EPSS Percentile 98.61 |
|
CISA Known Exploited Public Exploits Available |
|
Published: July 2, 2018 |
|
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios. |
|
Vendor Impacted: Paessler |
|
Product Impacted: Prtg Network Monitor |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-0411 |
|
HIGH CVSS 7.00 EPSS Score 0.04 EPSS Percentile 11.48 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: Jan. 25, 2025 |
|
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456. |
|
Vendor Impacted: 7-Zip |
|
Product Impacted: 7-Zip |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2025-0683 |
|
MEDIUM CVSS 5.90 EPSS Score 0.04 EPSS Percentile 11.48 |
|
Risk Context N/A |
|
Published: Jan. 30, 2025 |
|
In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a machine-in-the-middle scenario. |
|
Quotes
|
|
Headlines |
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
