Storm-0249 Escalates Ransomware Attacks with ClickFix, Fileless PowerShell, and DLL Sideloading

The threat actor known as Storm-0249 is likely shifting from its role as an initial access broker to adopt a combination of more advanced tactics like domain spoofing, DLL side-loading, and fileless PowerShell execution to facilitate ransomware attacks. "These methods allow them to bypass defense...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Indicator Scanner This repository provides a...

Insufficient Session Expiration in SSLVPN

...

EUVD-2025-201738

In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...

EUVD-2025-201748

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

EUVD-2025-201750

In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48632

In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...

CVE-2025-48620

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2025-48615

In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48620

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2025-48632

In setDisplayName of AssociationRequest.java, there is a potential vulnerability where CDM associations can persist after user disassociation due to improper input validation. This could enable local privilege escalation with no additional privileges and without user interaction. The CVE-2025-486...

CVE-2025-48632

In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...

CVE-2025-48620

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2025-48620

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2025-48620

CVE-2025-48620 affects Android's VoiceInteractionManagerService.java (onSomePackagesChanged). Description indicates a logic error could allow a third-party component name to persist after uninstall, enabling local privilege escalation with no extra privileges and no user interaction required. Con...

CVE-2025-48615

In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

MAL-2025-192373 Malicious code in @notrainers/nobtrainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f897e383035341f83bc0c7357ec775c42dcf5f88689994882325daf4c5c6730 The package @notrainers/nobtrainer-sdk was found to contain malicious code. Source: ghsa-malware...

CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday released details of a backdoor named BRICKSTORM that has been put to use by state-sponsored threat actors from the People's Republic of China PRC to maintain long-term persistence on compromised systems. "BRICKSTORM is a...

Malicious code in chai-as-deployed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebc44576073489ddc650d352e43bee3aa036bcdc2914887eb9c36be2780e09b The package chai-as-deployed was found to contain malicious code. Source: ghsa-malware 117c632d121fc31a4f589c4d76730535c6d5b576ae6e3addab756be448c13b...

MAL-2025-192309 Malicious code in node-dpapi1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a892f37c5be6dceac9cda541ce52d7dc4456d98acbfaa7d2a1e530d181567e29 The package node-dpapi1 was found to contain malicious code. Source: ghsa-malware 96a0f4f04fbe21b39cfa4fe8473fc5394bcecce0f814fcba5f89d6f6217e523d An...