2902 matches found
Efficiency? Security? When the quest for one grants neither.
Welcome to this week's edition of the Threat Source newsletter. Benjamin Franklin once said, "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." In much the same way, those who rush for efficiency without taking into account...
2025 State of Code Security: Key Trends and Risks
Explore the key insights on code and cloud security risks shaping 2025...
Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now
For decades, Microsoft Exchange has been the backbone of business communications, powering emailing, scheduling and collaboration for organizations worldwide. Whether deployed on-premises or in hybrid environments, companies of all sizes rely on Exchange for seamless internal and external...
CVE-2025-0112 Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activit...
CVE-2025-24806 Regulation applies separately to Username-based logins to Email-based logins in authelia
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to t...
PT-2025-7372 · WordPress · Team Builder For Wpbakery Page Builder
Name of the Vulnerable Software and Affected Versions: Team Builder For WPBakery Page Builder plugin for WordPress versions up to, and including, 1.0 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server...
SUSE: Security Advisory (SUSE-SU-2025:0577-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-7270-1: OpenSSH vulnerabilities
It was discovered that the OpenSSH client incorrectly handled the non-default VerifyHostKeyDNS option. If that option were enabled, an attacker could possibly impersonate a server by completely bypassing the server identity check. CVE-2025-26465 It was discovered that OpenSSH incorrectly handled...
CVE-2025-1390
The PAM module pamcap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to...
CVE-2025-1390 pam_cap: Fix potential configuration parsing error
The PAM module pamcap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to...
Hemi VDP: VSCode launch.json file exposed on hemi.xyz
A .vscode/launch.json file was published publicly on https://hemi.xyz/...
MAL-2025-3016 Malicious code in web3node (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9f226e2391e0717c113d67f398aae7c36705ffbef3310caebd76a1b8b11f0811 web3socket: In the class there is a hidden code that loads a binary Python code from a remote location impersonating PyPI Github account web3node: The package ...
PT-2025-7238 · Strongkey · Strongkey Fido Server
Name of the Vulnerable Software and Affected Versions: StrongKey FIDO Server versions prior to 4.15.1 Description: The issue arises when the StrongKey FIDO Server treats a non-discoverable namedcredential flow as a discoverable transaction. This can potentially lead to security risks. However,...
MAL-2025-1371 Malicious code in orange-meets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37037d337633f63999cc9026f347d4542faaf8a86bc78184e98a7031c17cfbe3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-21397
Microsoft Office Remote Code Execution Vulnerability...
MAL-2025-3004 Malicious code in systoring (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5be790277882f23120bae2ed3979650349878074f8d3d10f869d726fa106160f Infostealer with multiple possibilities, but not auto-activating on installation. There are already multiple attempts to publish it, with different...
CVE-2024-53651
A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions, SIPROTEC 5 6MD89 CP300 All versions, SIPROTEC 5 6MU85 CP300 All versions,...
KLA80105 Multiple vulnerabilities in Microsoft Windows
Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [10 February]
In cybersecurity, the smallest crack can lead to the biggest breaches. A leaked encryption key, an unpatched software bug, or an abandoned cloud storage bucket—each one seems minor until it becomes the entry point for an attack. This week, we've seen cybercriminals turn overlooked weaknesses into...