AutomationDirect CLICK PLUS 安全漏洞

The AutomationDirect CLICK PLUS is a small programmable logic controller from AutomationDirect, Inc. A security vulnerability exists in AutomationDirect CLICK PLUS version 3.60, which stems from the use of a hard-coded AES key in the firmware to protect the initial message of a KOPS session, whic...

CVE-2025-10815

creationtimestamp| type| source ---|---|--- 2025-09-22 21:13:21+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115250010527648121...

CVE-2025-10814

creationtimestamp| type| source ---|---|--- 2025-09-22 21:03:23+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115249971352567440...

GHSA-W5FX-FH39-J5RW

creationtimestamp| type| source ---|---|--- 2025-09-22 21:01:56+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115249965654751816...

GHSA-HR92-4Q35-4J3M

creationtimestamp| type| source ---|---|--- 2025-09-22 19:54:24+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115249700094592753...

GHSA-9GGR-2464-2J32

creationtimestamp| type| source ---|---|--- 2025-09-22 17:43:07+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115249183875342859...

CVE-2025-57434

creationtimestamp| type| source ---|---|--- 2025-09-22 17:08:59+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115249049643957725...

CVE-2025-9983

creationtimestamp| type| source ---|---|--- 2025-09-22 14:10:50+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115248349124892707 2025-09-22 15:26:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lzgpsapzwh2f 2025-10-25 20:22:36+00:00| seen|...

The vulnerability in the implementation of the Diffie-Hellman Key Agreement Protocol, a protocol used by the OpenSSL library, allows a attacker to cause a service failure.

The vulnerability of the Diffie-Hellman Key Agreement Protocol implementation in the OpenSSL library is related to errors in the authentication process. Exploiting this vulnerability can allow a malicious actor to cause service failures...

OESA-2025-2301 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...

CVE-2025-10035

creationtimestamp| type| source ---|---|--- 2025-09-18 23:50:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115227978540947435 2025-09-19 00:01:52+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lz5kqnimx52q 2025-09-19 12:12:00+00:00| seen|...

CVE-2025-59220

creationtimestamp| type| source ---|---|--- 2025-09-18 21:49:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115227503962306130 2025-09-19 01:23:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz5pc7l22a2m...

dnsdist -- Denial of service via crafted DoH exchange

[email protected] reports: In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an...

CVE-2025-9242

CVE-2025-9242: WatchGuard Fireware OS contains an out-of-bounds write in the iked process that may allow remote unauthenticated code execution on affected VPN configurations (Mobile User VPN with IKEv2 and Branch Office VPN with dynamic gateway peer). AffectedFireware OS versions include 11.10.2–...

Erlang/OTP (Erlang OTP) Adaptive Chosen Ciphertext Vulnerability (GHSA-mhm2-354q-3277) - Linux

Erlang/OTP Erlang OTP is prone to an adaptive chosen ciphertext vulnerability in the ssl component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Erlang/OTP (Erlang OTP) Adaptive Chosen Ciphertext Vulnerability (GHSA-mhm2-354q-3277) - Windows

Erlang/OTP Erlang OTP is prone to an adaptive chosen ciphertext vulnerability in the ssl component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PrivExchange

This is a proof-of-concept PoC tool for abusing Microsoft Exchange to obtain Domain Admin privileges. The tool, named PrivExchange, requires the Impacket library and can be used to subscribe to push notifications on Exchange Web Services, which will make Exchange connect back to the attacker and...

Malicious Key Exchange Messages may Lead to Excessive Resource Consumption

...

Finding SSH Strict Key Exchange Violations by State Learning

SSH is an important protocol for secure remote shell access to servers on the Internet. At USENIX 2024, B�umer et al. presented the Terrapin attack on SSH, which relies on the attacker injecting optional messages during the key exchange. To mitigate this attack, SSH vendors adopted an extension...

The vulnerability of the Internet Key Exchange Version 2 (IKEv2) function in Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows a attacker to cause service interruptions.

The vulnerability of the Internet Key Exchange Version 2 IKEv2 function in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to the absence of memory release after the effective lifespan. Exploitation of this vulnerability can allow a malicious actor ...