Skip to main content
Customer Support Customer Support

Vulnerability Vault

Learn about new vulnerabilities in software, systems, devices, and share new patches, workarounds, and mitigation strategies.

  • 228 Topics
  • 139 Replies
Blog

Fast Flux: The Evasive DNS Tactic Now Considered a National Security Th...

  • 5
  • 5

Vulnerable Moxa devices expose industrial networks to attacks

  • 5
  • 0

Chipmaker Patch Tuesday: Intel, AMD Address New Microarchitectural Vuln...

  • 3
  • 0
228 Topics
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date April 07, 2025

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-31161 CrushFTP Authentication Bypass Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remedia

60
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Vulnerability Summary for the Week of March 31, 2025 Released Apr 07, 2025

Document ID SB25-097 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is

50
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
WinRAR flaw bypasses Windows Mark of the Web security alerts

April 5, 2025 By Ionut Ilascu A vulnerability in the WinRAR file archiver solution could be exploited to bypass the Mark of the Web (MotW) security warning and execute arbitrary code on a Windows machine. The security issue is tracked as CVE-2025-31334 and affects all WinRAR versions except the most recent release, which is currently 7.11. Mark of the Web is a security function in Windows in the form of a metadata value (an alternate data stream named ‘zone-identifier’) to tag as potentially unsafe files downloaded from the internet. When opening an executable with the MotW tag, Windows warns the user that it was downloaded from the internet and could be harmful and offers the option to continue execution or terminate it. >>Full Article<<

151
TripleHelix
Moderator
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Vulnerability Vault
Fast Flux: The Evasive DNS Tactic Now Considered a National Security ThreatBlog

In April 2025, a joint advisory from the NSA, CISA, FBI, and allied international agencies elevated a longstanding cyber evasion technique fast flux to the status of a national security threat. While fast flux isn’t new, its persistent use in high-impact attacks and the defensive blind spots it exposes have prompted this global call to action. What is Fast Flux? At its core, fast flux is a method attackers use to stay one step ahead of defenders. It works by rapidly rotating the IP addresses associated with a single domain, often every few minutes. This dynamic resolution makes malicious infrastructure, such as phishing sites or command-and-control (C2) servers, extremely hard to locate and shut down. There are two variants: single flux, which changes the IPs behind a domain, and double flux, which also rotates the DNS name servers. Both approaches rely on networks of compromised devices, often forming large botnets that serve as proxies for malicious activity. Why Fast Flux is Back in

1855
Ssherjj
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457) Release Date April 04, 2025

Ivanti released security updates to address vulnerabilities (CVE-2025-22457) in Ivanti Connect Secure, Policy Secure & ZTA Gateways. A cyber threat actor could exploit CVE-2025-22457 to take control of an affected system. CISA has added CVE-2025-22457 to its Known Exploited Vulnerabilities Catalog . See the following resources for more guidance: April Security Update | Ivanti April Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-22457) Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) | Google Cloud Blog For any instances of Ivanti Connect Secure that were not updated by Feb. 28, 2025, to the latest Ivanti patch (22.7R2.6) and all instances of Pulse Connect Secure (EoS), Policy Secure, and ZTA Gateways, CISA urges users and administrators to implement the following actions: Conduct threat hunting actions: Run an external Integrity Checker Tool (ICT). For more guidance, see Ivanti’s instru

50
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Adds One Vulnerability to the KEV Catalog Release Date April 04, 2025

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog , based on evidence of active exploitation. CVE-2025-22457 Ivanti Connect Secure, Policy Secure and ZTA Gateways Stack-Based Buffer Overflow Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. CISA urges organizations to apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service. Security Update: Pulse Connect Secure, Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateway CISA Mitigation Instructions for CVE-2025-22457 Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the following information regarding the incident: date, time, and l

50
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Critical flaw in Apache Parquet’s Java Library allows remote code execution

April 4, 2025 By Pierluigi Paganini Experts warn of a critical vulnerability impacting Apache Parquet’s Java Library that could allow remote code execution. Apache Parquet’s Java Library is a software library for reading and writing Parquet files in the Java programming language. Parquet is a columnar storage file format that is optimized for use with large-scale data processing frameworks, such as Apache Hadoop, Apache Spark, and Apache Drill. Experts disclosed a critical vulnerability, tracked as CVE-2025-30065 (CVSS score of 10.0), impacting Apache Parquet’s Java Library that could allow remote code execution “Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code” reads the advisory. >>Full Article<<

30
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Flaw in Verizon call record requests put millions of Americans at risk

April 4, 2025 By Pieter Arntz Security researcher Evan Connelly discovered an enormous flaw affecting one of the largest telecommunications companies in the world that could allow any single person to view the recent incoming call log for potentially any Verizon phone number. “In short, anyone could lookup data for anyone,” Connelly said. A vulnerability in the Verizon Call Filter iOS app allowed anyone to request the call logs of millions of US Verizon customers. The Verizon Call Filter app for iOS allows customers to view a log of their recent calls. This log will show them the phone numbers and an associated timestamp. To request such a log the app sends a request to a server to fetch the data belonging to the phone number in question. The network request to the server contains various details such as your phone number and the requested time period for call records. The server then responds with a list of calls and timestamps. >>Full Article<<

50
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Multiple deserialization vulnerabilities in PyTorch Lightning 2.4.0 and earlier versions

Vulnerability Note VU#252619 Original Release Date: 2025-04-03 | Last Revised: 2025-04-03 Overview PyTorch Lightning versions 2.4.0 and earlier do not use any verification mechanisms to ensure that model files are safe to load before loading them. Users of PyTorch Lightning should use caution when loading models from unknown or unmanaged sources. Description PyTorch Lightning, a high-level framework built on top of PyTorch, is designed to streamline deep learning model training, scaling, and deployment. PyTorch Lightning is widely used in AI research and production environments, often integrating with various cloud and distributed computing platforms to manage large-scale machine learning workloads. PyTorch Lightning contains multiple vulnerabilities related to the deserialization of untrusted data (CWE-502). These vulnerabilities arise from the unsafe use of torch.load(), which is used to deserialize model checkpoints, configurations, and sometimes metadata. While torch.load() provide

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Ivanti patches Connect Secure zero-day exploited since mid-March

April 3, 2025 By Sergiu Gatlan Ivanti has released security updates to patch a critical Connect Secure remote code execution vulnerability exploited by a China-linked espionage actor to deploy malware since at least mid-March 2025. Tracked as CVE-2025-22457, this critical security flaw is due to a stack-based buffer overflow weakness. It impacts Pulse Connect Secure 9.1x (which reached end-of-support in December), Ivanti Connect Secure 22.7R2.5 and earlier, Policy Secure, and Neurons for ZTA gateways. According to Ivanti's advisory, remote threat actors can exploit it in high-complexity attacks that don't require authentication or user interaction. The company patched the vulnerability on February 11, 2025, with the release of Ivanti Connect Secure 22.7R2.6 after initially tagging it as a product bug. >>Full Article<<

30
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Releases Five Industrial Control Systems Advisories Release Date April 03, 2025

CISA released five Industrial Control Systems (ICS) advisories on April 3, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-093-01 Hitachi Energy RTU500 Series ICSA-25-093-02 Hitachi Energy TRMTracker ICSA-25-093-03 ABB ACS880 Drives Containing CODESYS RTS ICSA-25-093-04 ABB Low Voltage DC Drives and Power Controllers CODESYS RTS ICSA-25-093-05 B&R APROL CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations. This product is provided subject to this Notification and this Privacy & Use policy. Vendor Hitachi Energy ABB B&R https://www.cisa.gov/news-events/alerts/2025/04/03/cisa-releases-five-industrial-control-systems-advisories

70
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Cybersecurity Advisory Fast Flux: A National Security Threat Release Date April 03, 2025

Alert Code AA25-093A Related topics: Cybersecurity Best Practices, Critical Infrastructure Security and Resilience Executive summary Many networks have a gap in their defenses for detecting and blocking a malicious technique known as “fast flux.” This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection. Malicious cyber actors, including cybercriminals and nation-state actors, use fast flux to obfuscate the locations of malicious servers by rapidly changing Domain Name System (DNS) records. Additionally, they can create resilient, highly available command and control (C2) infrastructure, concealing their subsequent malicious operations. This resilient and fast changing infrastructure makes tracking and blocking malicious activities that use fast flux more difficult. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Australian Signals Di

80
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert NSA, CISA, FBI, and International Partners Release Cybersecurity Advisory on “Fast Flux,” a National Security Threat Release Date April 03, 2025

Today, CISA—in partnership with the National Security Agency (NSA), Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security (CCCS), and New Zealand’s National Cyber Security Centre (NCSC-NZ)—released joint Cybersecurity Advisory Fast Flux: A National Security Threat (PDF, 841 KB). This advisory warns organizations, internet service providers (ISPs), and cybersecurity service providers of the ongoing threat of fast flux enabled malicious activities and provides guidance on detection and mitigations to safeguard critical infrastructure and national security. “Fast flux” is a technique used to obfuscate the locations of malicious servers through rapidly changing Domain Name System (DNS) records associated with a single domain name. This threat exploits a gap commonly found in network defenses, making the tracking and blocking of malicious fast flux activities difficult. The authoring agencies

60
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Vulnerabilities Expose Jan AI Systems to Remote Manipulation

Vulnerabilities in open source ChatGPT alternative Jan AI expose systems to remote, unauthenticated manipulation. April 2, 2025 By Ionut Arghire Multiple vulnerabilities in Jan AI, which is advertised as an open source ChatGPT alternative, could be exploited by remote, unauthenticated attackers to manipulate systems, developer security platform Snyk warns. Developed by Menlo Research, Jan AI is a personal assistant that runs offline on desktops and mobile devices, featuring a model library with popular LLMs, and support for extensions for customization purposes. Jan, which has over one million downloads on GitHub, allows users to download and run LLMs locally, without depending on cloud hosting services and benefiting from full control over the AI. >>Full Article<<

70
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
ImageRunner Flaw Exposed Sensitive Information in Google Cloud

Google has patched a Cloud Run vulnerability dubbed ImageRunner that could have been exploited to gain access to sensitive data. April 2, 2025 By Eduard Kovacs Google Cloud recently patched a privilege escalation vulnerability that could have allowed threat actors to gain access to sensitive information. The vulnerability, discovered by researchers at Tenable, has been named ImageRunner because it impacts Cloud Run, a fully managed serverless platform that allows developers to deploy and run containerized applications directly on Google’s infrastructure. Google Cloud told SecurityWeek that it notified Cloud Run customers about the vulnerability in November 2024, and fully deployed a security enhancement to address the issue on January 28, 2025. According to Tenable, the ImageRunner vulnerability could have been exploited by an attacker who had certain permissions on the targeted user’s project to modify a Cloud Run service, which could enable them to access sensitive or proprietary ima

40
Jasper_The_Rasper
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Verizon Call Filter API flaw exposed customers' incoming call history

April 2, 2025 By Bill Toulas A vulnerability in Verizon's Call Filter feature allowed customers to access the incoming call logs for another Verizon Wireless number through an unsecured API request. The flaw was discovered by security researcher Evan Connelly on February 22, 2025, and was fixed by Verizon sometime in the following month. However, the total period of exposure is unknown. Verizon's Call Filter app is a free utility that offers users spam detection and automatic call blocking. A paid version (Plus) adds a spam lookup and risk meter, the ability to apply blocks by type of caller, and receive caller ID on unknown numbers. The free version of the app comes pre-installed and enabled by default on eligible Android and iOS devices bought directly from Verizon, and is believed to be used on millions of devices. Connelly told BleepingComputer that he only tested the iOS app. However, he noted that the Android app was also very likely impacted by the same bug, as the issue was wit

50
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date April 01, 2025

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24813 Apache Tomcat Path Equivalence Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remedia

60
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Releases Two Industrial Control Systems Advisories Release Date April 01, 2025

CISA released two Industrial Control Systems (ICS) advisories on April 1, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-091-01 Rockwell Automation Lifecycle Services with Veeam Backup and Replication ICSA-24-331-04 Hitachi Energy MicroSCADA Pro/X SYS600 (Update A) CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations. This product is provided subject to this Notification and this Privacy & Use policy. Vendor Rockwell Automation Hitachi Energy https://www.cisa.gov/news-events/alerts/2025/04/01/cisa-releases-two-industrial-control-systems-advisories

60
TripleHelix
Moderator
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Vulnerability Vault
Microsoft warns of critical flaw in Canon printer drivers

April 1, 2025 By Pierluigi Paganini Microsoft’s offensive security team discovered a critical code execution vulnerability impacting Canon printer drivers. Researchers at Microsoft’s Offensive Research and Security Engineering (MORSE) team have discovered a critical code execution vulnerability, tracked as CVE-2025-1268 (CVSS score of 9.4), impacting Canon printer drivers. The vulnerability is an out-of-bounds issue that resides in certain printer drivers for production printers, office/small office multifunction printers and laser printers. The flaw impacts the EMF recode processing of Generic Plus PCL6, UFR II, LIPS4, LIPSXL, and PS printer drivers. An attacker can exploit the flaw to prevent printing and/or potentially execute arbitrary code under certain conditions. “Out-of-bounds vulnerability was found in certain printer drivers for production printers, office/small office multifunction printers and laser printers that may prevent printing and/or potentially be able to execute ar

50
Jasper_The_Rasper
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Microsoft March 2025 Security Updates

March 2025 Security UpdatesThis release consists of the following 57 Microsoft CVEs: Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations? Windows exFAT File System CVE-2025-21180 Azure Agent Installer CVE-2025-21199 Windows MapUrlToZone CVE-2025-21247 Windows Remote Desktop Services CVE-2025-24035 .NET CVE-2025-24043 Windows Win32 Kernel Subsystem CVE-2025-24044 Windows Remote Desktop Services CVE-2025-24045 Microsoft Streaming Service CVE-2025-24046 Role: Windows Hyper-V CVE-2025-24048 Azure CLI CVE-2025-24049 Role: Windows Hyper-V CVE-2025-24050 Windows Routing and Remote Access Service (RRAS) CVE-2025-24051 Windows NTLM CVE-2025-24054 Windows USB Video Driver CVE-2025-24055 Windows Telephony Server CVE-2025-24056 Microsoft Office CVE-2025-24057 Windows Common Log File System Driver CVE-2025-24059 Windows Mark of the Web (MOTW) CVE-2025-24061 Role: DNS Server CVE-2025-24064 Windows Kernel-Mode Drivers CVE-2025-24066 Microsoft Streaming Service CVE-2025-24067

508
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date March 31, 2025

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-20439 Cisco Smart Licensing Utility Static Credential Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizi

50
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Vulnerability Summary for the Week of March 24, 2025 Released Mar 31, 2025

Document ID SB25-090 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is

40
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Releases Malware Analysis Report on RESURGE Malware Associated with Ivanti Connect Secure Release Date March 28, 2025

CISA has published a Malware Analysis Report (MAR) with analysis and associated detection signatures on a new malware variant CISA has identified as RESURGE. RESURGE contains capabilities of the SPAWNCHIMERA[ 1 ] malware variant, including surviving reboots; however, RESURGE contains distinctive commands that alter its behavior. These commands: Create a web shell, manipulate integrity checks, and modify files. Enable the use of web shells for credential harvesting, account creation, password resets, and escalating permissions. Copy the web shell to the Ivanti running boot disk and manipulate the running coreboot image. RESURGE is associated with the exploitation of CVE-2025-0282 in Ivanti Connect Secure appliances. CVE-2025-0282 is a stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. CISA added CVE-2025-0282 to its Known Exploited Vulnerabilities Catalog on January 8, 2025. For more information on the abovementioned malware variants and

50
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Analysis Report MAR-25993211-r1.v1 Ivanti Connect Secure (RESURGE) Release Date March 28, 2025

Alert Code AR25-087A Notification This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise. This document is marked TLP:CLEAR--Recipients may share this information without restriction. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp. Summary Description CISA analyzed three files obtained from a critical infrastructure’s Ivanti Connect Secure device after threat actors exploited Ivanti CVE-2025-0282 for initial access. One file—that CISA is calling RESURGE—has f

40
TripleHelix
Moderator
TripleHelix
Moderator
TripleHelixModerator
posted in Vulnerability Vault
Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date March 27, 2025

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely rem

40
TripleHelix
Moderator

Latest solutions

Leaderboard

Badges

  • Most Wanted
    Tarnakhas earned the badge Most Wanted
  • Beta To The Max
    Tarnakhas earned the badge Beta To The Max
  • Most Wanted
    Muddy7has earned the badge Most Wanted
  • Beta To The Max
    Muddy7has earned the badge Beta To The Max
  • Beta To The Max
    pierrequiroulehas earned the badge Beta To The Max
Show all badges

Popular Tags

Join the Conversation

Terms & Conditions