Pawb.Social Reports @transparency

12 posts6 participants0 posts today

Rachel RawlingsOver thirty years ago i discovered a <a href="https://mastodon.social/tags/curl" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#curl</a> <a href="https://mastodon.social/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> but never disclosed it outside academia (Temple University, where I was a double major in computer science and journalism). I suspect that the problem has never been fixed and never can be.But now I'm telling the world: I looked terrible with a perm.

Xavier «X» Santolaria :verified_paw: :donor:Updates from the <a href="https://infosec.exchange/tags/CVEFoundation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVEFoundation</a><blockquote>Representatives from the CVE Foundation met with representatives from CISA on 4/24/2025. The talks were positive and encouraging. All parties wish to keep the conversation and progress moving forward.</blockquote><a href="https://www.thecvefoundation.org/news" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.thecvefoundation.org/news</a><a href="https://infosec.exchange/tags/cve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve</a> <a href="https://infosec.exchange/tags/mitre" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mitre</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a>

BeyondMachines :verified:Remote Code Execution flaw reported in Viasat Satellite ModemsA stack buffer overflow vulnerability (CVE-2024-6198) in Viasat satellite modems' "SNORE" web interface allows attackers to send specially crafted HTTP requests that can lead to arbitrary code execution through return-oriented programming techniques, affecting multiple modem models. Bug is patched by firmware updates 3.8.0.4+ or 4.3.0.2+ depending on the device model.**If you are using Viasat sattelite modems, check if they are auto-updated. If not, update them ASAP. Should be fairly easy fix.** <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/advisory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advisory</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://beyondmachines.net/event_details/critical-remote-code-execution-flaw-reported-in-viasat-satellite-modems-9-c-l-d-p/gD2P6Ple2L" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://beyondmachines.net/event_details/critical-remote-code-execution-flaw-reported-in-viasat-satellite-modems-9-c-l-d-p/gD2P6Ple2L</a>

BillThis is a real concern. Older android versions don't support current tls. Do you support old phones, or check that box? It's tough. Been there, no good answer.<a href="https://www.infosecurity-magazine.com/news/50-mobile-devices-run-outdated/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.infosecurity-magazine.com/news/50-mobile-devices-run-outdated/</a><a href="https://infosec.exchange/tags/ios" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ios</a> <a href="https://infosec.exchange/tags/android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#android</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a>

BeyondMachines :verified:Azure SQL server vulnerability allowed creation of malicious destructive Firewall rulesVaronis Threat Labs discovered a critical "Destructive Stored URL Parameter Injection" vulnerability in Azure SQL Server where attackers with privileged access or scammed victim users could create malicious firewall rules containing directory traversal sequences (like "../"). When such a rule is deleted by administrators through the Azure Portal, it would append the traversal path sequence, causing deletion of arbitrary Azure resources.**You can't do much about this flaw, it's fixed by Microsoft. But take into account for your evaluation of the vendor.** <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/advisory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advisory</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://beyondmachines.net/event_details/azure-sql-server-vulnerability-allowed-creation-of-malicious-destructive-firewall-rules-q-1-p-b-h/gD2P6Ple2L" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://beyondmachines.net/event_details/azure-sql-server-vulnerability-allowed-creation-of-malicious-destructive-firewall-rules-q-1-p-b-h/gD2P6Ple2L</a>

BillIf this checks out, Rails never fixed the CSRF bug and I have a few messages to send in the morning. "Remember Finding 3? Yeaaaah bout dat."<a href="https://seclists.org/fulldisclosure/2025/Apr/29" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://seclists.org/fulldisclosure/2025/Apr/29</a><a href="https://infosec.exchange/tags/rails" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rails</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a>

BeyondMachines :verified:AMD releases patches for critical Zen 5 microcode flawAMD has released patches for the EntrySign vulnerability (CVE-2024-36347, CVSS 6.4-9.8) affecting Zen 5 processors, which allows attackers with kernel-level privileges to execute unsigned microcode by exploiting weaknesses in AMD's signature verification process.**If you are running Zen 5-based microprocessors in your systems, check for firmware update from your vendor, and apply it. It's not a panic mode patch since exploit requires physical access to the system, but it's still smart to patch it. Because everyone leaves their equipment somewhere.** <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/advisory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advisory</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://beyondmachines.net/event_details/amd-releases-patches-for-critical-zen-5-microcode-flaw-j-r-n-g-f/gD2P6Ple2L" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://beyondmachines.net/event_details/amd-releases-patches-for-critical-zen-5-microcode-flaw-j-r-n-g-f/gD2P6Ple2L</a>

BillHuh, a prompts-as-policy attack on GenAI. So boring I bet it works well. The best exploits are always boring.<a href="https://www.securityweek.com/all-major-gen-ai-models-vulnerable-to-policy-puppetry-prompt-injection-attack/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.securityweek.com/all-major-gen-ai-models-vulnerable-to-policy-puppetry-prompt-injection-attack/</a><a href="https://infosec.exchange/tags/genai" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#genai</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a>

BeyondMachines :verified:Multiple critical security vulnerabilities in Schneider Electric Modicon ControllersMultiple critical security vulnerabilities have been identified in Schneider Electric's Modicon PLC series allowing remote code execution, denial-of-service, or complete system compromise through various attack vectors including uncaught exceptions and improper access controls. While Schneider has released patches for some product lines, many vulnerabilities affecting end-of-life Modicon Quantum and Premium controllers have no fixes available.**This advisory impacts a lot of products. If you are using Schneider Electric Modicon controllers, review the advisory in detail. As usual, your first action is to make sure the devices are isolated from the internet and accessible only from trusted networks. Then, if patches are available, plan a patch cycle. Otherwise if no patches are available, do a proper risk assessment whether you'll keep the devices with incurred risk or will you phase them out and replace them.** <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/advisory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advisory</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://beyondmachines.net/event_details/multiple-critical-security-vulnerabilities-in-schneider-electric-modicon-controllers-l-m-i-u-q/gD2P6Ple2L" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://beyondmachines.net/event_details/multiple-critical-security-vulnerabilities-in-schneider-electric-modicon-controllers-l-m-i-u-q/gD2P6Ple2L</a>

BeyondMachines :verified:GitLab releases security patches for multiple VulnerabilitiesGitLab has released security updates addressing five vulnerabilities in its Community and Enterprise Editions, including three high-severity cross-site scripting and header injection flaws in the Maven Dependency Proxy (CVE-2025-1763, CVE-2025-2443, CVE-2025-1908), a denial of service vulnerability in issue preview functionality (CVE-2025-0639), and an information disclosure issue allowing unauthorized access to branch names (CVE-2024-12244). Patched versions are 17.11.1, 17.10.5, and 17.9.7.**If you are running self-hosted GitLab Community Edition (CE) or Enterprise Edition (EE) plan a quick patch cycle. While none of the flaws are scored as critical, the nature of GitLab server is to be visible to many users, probably on the internet. So someone will probably find an exploit scenario given enough time and an unpatched server.** <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/advisory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advisory</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://beyondmachines.net/event_details/gitlab-releases-security-patches-for-multiple-vulnerabilities-9-a-u-d-v/gD2P6Ple2L" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://beyondmachines.net/event_details/gitlab-releases-security-patches-for-multiple-vulnerabilities-9-a-u-d-v/gD2P6Ple2L</a>

AI6YR BenInteresting, Debian detected two required firmware patches for my (prior) Win10 machine, with critical CVEs... Windows 10 never prompted or attempted an upgrade 🤨 <a href="https://m.ai6yr.org/tags/firmware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firmware</a> <a href="https://m.ai6yr.org/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://m.ai6yr.org/tags/cve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve</a>

Marcus "MajorLinux" SummersLinux folks, update yo shit!NVIDIA disclose new security flaw in their Linux GPU drivers <a href="https://www.gamingonlinux.com/2025/04/nvidia-disclose-new-security-flaw-in-their-linux-gpu-drivers/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.gamingonlinux.com/2025/04/nvidia-disclose-new-security-flaw-in-their-linux-gpu-drivers/</a><a href="https://toot.majorshouse.com/tags/Nvidia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nvidia</a> <a href="https://toot.majorshouse.com/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://toot.majorshouse.com/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Vulnerability</a> <a href="https://toot.majorshouse.com/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://toot.majorshouse.com/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://toot.majorshouse.com/tags/GPU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GPU</a> <a href="https://toot.majorshouse.com/tags/Drivers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Drivers</a> <a href="https://toot.majorshouse.com/tags/Tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tech</a> <a href="https://toot.majorshouse.com/tags/Hardware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hardware</a> <a href="https://toot.majorshouse.com/tags/Gaming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gaming</a>

BeyondMachines :verified:Massive number of SQL Injection Vulnerabilities reported Siemens TeleControl Server BasicSiemens has disclosed 67 SQL injection vulnerabilities in their TeleControl Server Basic product affecting critical infrastructure sectors including Energy, Water, and Transportation Systems. Three of the flaws are critical and allowi unauthenticated attackers to bypass authorization controls and 64 high-severity issues that could enable database manipulation, denial-of-service conditions, and code execution with system permissions.**If you are using TeleControl Server Basic, make sure it's isolated from the internet and accessible only from trusted networks. Restrict access to port 8000 only to trusted IP addresses, and plan a quick patch cycle. The list of vulnerabilities is huge, and any isolation will eventually be compromised through phishing, malware or a disgruntled employee. So patch your TeleControl.** <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/advisory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#advisory</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://beyondmachines.net/event_details/massive-number-of-sql-injection-vulnerabilities-reported-siemens-telecontrol-server-basic-h-1-y-e-y/gD2P6Ple2L" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://beyondmachines.net/event_details/massive-number-of-sql-injection-vulnerabilities-reported-siemens-telecontrol-server-basic-h-1-y-e-y/gD2P6Ple2L</a>

💧🌏 Greg CocksPopulation Vulnerability Of Residents, Employees, And Cruise-Ship Passengers To Tsunami Hazards Of Islands In Complex Seismic Regions - A Case Study Of The U.S. Virgin Islands -- <a href="https://doi.org/10.1016/j.ijdrr.2025.105289" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://doi.org/10.1016/j.ijdrr.2025.105289</a> <-- shared paper -- <a href="https://techhub.social/tags/GIS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GIS</a> <a href="https://techhub.social/tags/spatial" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spatial</a> <a href="https://techhub.social/tags/mapping" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mapping</a> <a href="https://techhub.social/tags/Tsunami" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tsunami</a> <a href="https://techhub.social/tags/Evacuation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Evacuation</a> <a href="https://techhub.social/tags/Mitigation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mitigation</a> <a href="https://techhub.social/tags/Risk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Risk</a> <a href="https://techhub.social/tags/Hazard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hazard</a> <a href="https://techhub.social/tags/Modeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Modeling</a> <a href="https://techhub.social/tags/Island" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Island</a> <a href="https://techhub.social/tags/publicsafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#publicsafety</a> <a href="https://techhub.social/tags/USVI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USVI</a> <a href="https://techhub.social/tags/VirginIslands" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VirginIslands</a> <a href="https://techhub.social/tags/damage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#damage</a> <a href="https://techhub.social/tags/loss" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#loss</a> <a href="https://techhub.social/tags/infrastructure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infrastructure</a> <a href="https://techhub.social/tags/cost" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cost</a> <a href="https://techhub.social/tags/economics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#economics</a> <a href="https://techhub.social/tags/humanimpacts" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#humanimpacts</a> <a href="https://techhub.social/tags/publicsafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#publicsafety</a> <a href="https://techhub.social/tags/lossoflife" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lossoflife</a> <a href="https://techhub.social/tags/death" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#death</a> <a href="https://techhub.social/tags/earthquake" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#earthquake</a> <a href="https://techhub.social/tags/fault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fault</a> <a href="https://techhub.social/tags/mitigation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mitigation</a> <a href="https://techhub.social/tags/monitoring" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#monitoring</a> <a href="https://techhub.social/tags/warning" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#warning</a> <a href="https://techhub.social/tags/response" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#response</a> <a href="https://techhub.social/tags/tourists" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tourists</a> <a href="https://techhub.social/tags/locals" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#locals</a> <a href="https://techhub.social/tags/employees" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#employees</a> <a href="https://techhub.social/tags/cruiseships" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cruiseships</a> <a href="https://techhub.social/tags/population" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#population</a> <a href="https://techhub.social/tags/community" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#community</a> <a href="https://techhub.social/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://techhub.social/tags/USVirginIslands" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USVirginIslands</a> <a href="https://techhub.social/tags/ships" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ships</a> <a href="https://techhub.social/tags/vessels" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vessels</a> <a href="https://techhub.social/tags/docks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#docks</a> <a href="https://techhub.social/tags/inundation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#inundation</a> <a href="https://techhub.social/tags/flood" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#flood</a> <a href="https://techhub.social/tags/flooding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#flooding</a> <a href="https://techhub.social/tags/waves" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#waves</a> <a href="https://techhub.social/tags/maritime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#maritime</a> <a href="https://techhub.social/tags/port" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#port</a> <a href="https://techhub.social/tags/scenario" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#scenario</a> <a href="https://techhub.social/tags/riskassessment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#riskassessment</a> <a href="https://techhub.social/tags/model" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#model</a> <a href="https://techhub.social/tags/modeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#modeling</a> <a href="https://techhub.social/tags/spatialanalysis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spatialanalysis</a> <a href="https://techhub.social/tags/spatiotemporal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spatiotemporal</a>

Tod Beardsley<a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a> Foundation just dropped a FAQ.<a href="https://www.thecvefoundation.org/frequently-asked-questions" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.thecvefoundation.org/frequently-asked-questions</a>Also, just FYI, I’ve been helping with the Foundation setup and goals articulation and logistics for the last few weeks. I didn’t expect we’d pull the trigger on being public this week, precisely, but here we are!I’m not employed there or anything (I work at <a href="https://infosec.exchange/@runZeroInc" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@runZeroInc</a>) but since I care about CVE, I want to do what I can to make sure it thrives and we don’t wind up back again with 15 competing standards for <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> tracking if USG funding goes 💨 poof! 💨 one day (or other single-source-funding style disasters).Anyway, back to my ill-timed family vacation. I’ll be more online next week. :)

OTX BotCVE-2025-24054, NTLM Exploit in the WildA critical vulnerability, CVE-2025-24054, related to NTLM hash disclosure via spoofing, has been actively exploited since March 19, 2025. The flaw allows attackers to leak NTLM hashes or user passwords using a maliciously crafted .library-ms file, potentially compromising systems. A campaign targeting government and private institutions in Poland and Romania used malspam to distribute Dropbox links containing archives exploiting this vulnerability. The exploit can be triggered with minimal user interaction, such as right-clicking or navigating to the folder containing the malicious file. This vulnerability appears to be a variant of the previously patched CVE-2024-43451, sharing several similarities.Pulse ID: 680034fc84efc0751b3bc07d Pulse Link: <a href="https://otx.alienvault.com/pulse/680034fc84efc0751b3bc07d" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/680034fc84efc0751b3bc07d</a> Pulse Author: AlienVault Created: 2025-04-16 22:53:48Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/Dropbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Dropbox</a> <a href="https://social.raytec.co/tags/Government" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Government</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/MalSpam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MalSpam</a> <a href="https://social.raytec.co/tags/Nim" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nim</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/Password" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Password</a> <a href="https://social.raytec.co/tags/Passwords" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwords</a> <a href="https://social.raytec.co/tags/Poland" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Poland</a> <a href="https://social.raytec.co/tags/Spam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Spam</a> <a href="https://social.raytec.co/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Vulnerability</a> <a href="https://social.raytec.co/tags/Word" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Word</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

cyberveganYou know when you see news articles about hacks of password databases or critical vulnerabilities in popular software, they usually quote a "CVE" number that officially identified the issue and allowed it to be defined precisely, and tracked? Well that's gone as of today. Looks like the trump regime has cancelled one off the foundational authorities on cybersecurity, the CVE or Common Vulnerabilities and Exposures program, without explanation. Basically the whole of "tech" relies on this, but I guess it's just America supporting the rest of the world, so it has to go. <a href="https://autistics.life/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://autistics.life/tags/cybersec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersec</a> <a href="https://autistics.life/tags/cve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve</a> <a href="https://autistics.life/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://autistics.life/tags/VulnerabilityDatabase" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VulnerabilityDatabase</a>Edits: typos/autocorrupt

Xavier «X» Santolaria :verified_paw: :donor:<a href="https://infosec.exchange/@adamshostack" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@adamshostack</a> 's thoughts on the cancellation of CVE funding.<a href="https://shostack.org/blog/thoughts-on-cve/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shostack.org/blog/thoughts-on-cve/</a><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/cve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cve</a>

thereisnoandersonNEW - 💾🖥️🔩⚙️ DCG real-ucode 🦜Actually provides the latest CPU microcode for AMD and Intel Version: 2025-04-14 Release: 1updated ucode for amd and intel with that one !<a href="https://github.com/divestedcg/real-ucode/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/divestedcg/real-ucode/</a>🐻 <a href="https://infosec.exchange/tags/divested" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#divested</a> <a href="https://infosec.exchange/tags/DivestedComputingGroup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DivestedComputingGroup</a> 🦜<a href="https://infosec.exchange/tags/fsf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fsf</a> <a href="https://infosec.exchange/tags/FUTO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FUTO</a> <a href="https://infosec.exchange/tags/Fedora" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fedora</a> <a href="https://infosec.exchange/tags/alpinelinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#alpinelinux</a> <a href="https://infosec.exchange/tags/hardening" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hardening</a> <a href="https://infosec.exchange/tags/linuxtech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linuxtech</a> <a href="https://infosec.exchange/tags/cybersec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/foss" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#foss</a> <a href="https://infosec.exchange/tags/hackernews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hackernews</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#android</a> <a href="https://infosec.exchange/tags/skynet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#skynet</a> <a href="https://infosec.exchange/tags/linuxsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linuxsecurity</a> <a href="https://infosec.exchange/tags/ucode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ucode</a> <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerabilities</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/freeyourmind" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freeyourmind</a>

Xavier Ashe :donor:Everyone in <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> gets to add this bullet to their resume tomorrow: - Matured the Security Program to ensure no new CVEs were introduced into the environment since April 16th, 2025. <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CVE</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a>

Recent searches

Search options

Administered by:

Server stats:

#vulnerability