PT-2025-20828

Name of the Vulnerable Software and Affected Versions Samsung MagicINFO 9 versions prior to 21.1052 Description An improper limitation of a pathname to a restricted directory issue exists in Samsung MagicINFO 9 Server. This allows attackers to write arbitrary files with system authority. The...

CVE-2025-1908 Business Logic Errors in GitLab

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

CVE-2025-1908 Business Logic Errors in GitLab

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1...

Russian Host Proton66 Tied to SuperBlack and WeaXor Ransomware

Threat actors are exploiting bulletproof hosting service Proton66 for malicious activities, including campaigns from SuperBlack ransomware operators, Android…...

CVE-2025-32947

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

CVE-2025-0757 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x...

CVE-2025-32947

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

CVE-2025-32948

PeerTube (inbox via ActivityPub) is affected by CVE-2025-32948, where mishandling of Create Activity can be abused to crash the server or trigger blind SSRF by sending crafted ActivityPub activities to the inbox. The vulnerability arises from handling ActivityPub activities in playlists, enabling...

CVE-2025-32947 PeerTube ActivityPub Crawl Infinite Loop DoS

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

PT-2025-16344 · Peertube · Peertube

Name of the Vulnerable Software and Affected Versions: PeerTube affected versions not specified Description: This vulnerability allows an attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the inbox endpoint when receiving crafted ActivityPub activitie...

CERTFR-2025-ALE-004

creationtimestamp| type| source ---|---|--- 2025-04-11 13:39:40+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114319607597170080 2025-04-11 13:44:19+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3lmk5n3wxhc2p 2025-04-15 07:59:58+00:00| seen|...

CVE-2025-3442

creationtimestamp| type| source ---|---|--- 2025-04-09 10:04:54+00:00| seen| https://t.me/cvedetector/22539 2025-04-09 18:48:01+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11130 2025-04-09 21:43:21+00:00| seen|...

Microsoft Credits EncryptHub, Hacker Behind 618+ Breaches, for Disclosing Windows Flaws

A likely lone wolf actor behind the EncryptHub persona was acknowledged by Microsoft for discovering and reporting two security flaws in Windows last month, painting a picture of a "conflicted" individual straddling a legitimate career in cybersecurity and pursuing cybercrime. In a new extensive...

OPSEC Failure Exposes Coquettte's Malware Campaigns on Bulletproof Hosting Servers

A novice cybercrime actor has been observed leveraging the services of a Russian bulletproof hosting BPH provider called Proton66 to facilitate their operations. The findings come from DomainTools, which detected the activity after it discovered a phony website named cybersecureprotect.com hosted...

CERTFR-2025-DUR-001

creationtimestamp| type| source ---|---|--- 2025-04-03 14:00:21+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3llw2sgb23i2s 2025-04-03 14:00:22+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114274390555274356 2025-04-03 14:00:22+00:00| seen|...

ASB-A-317203980

In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CERTFR-2025-ACT-013

creationtimestamp| type| source ---|---|--- 2025-03-31 14:27:34+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3llokwdevlm2w 2025-03-31 14:27:35+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114257510601340238 2025-03-31 14:27:35+00:00| seen|...

CVE-2025-31125

creationtimestamp| type| source ---|---|--- 2025-03-31 10:12:27+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8 2025-03-31 17:30:49+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9702 2025-03-31 21:43:14+00:00|...

MAL-2025-2604 Malicious code in tree-sitter-erlang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 712279ef7d69026b60fa7e5d9007249ac05502576b2a1164da1dbafca2be44f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Rapid7 MDR Supports AWS GuardDuty's New Attack Sequence Alerts

Co-authored by Yaron Kaplan and Gil Shamgar. AWS GuardDuty has introduced two powerful new alerts that enhance its threat detection capabilities: "Potential Credential Compromise" and "Potential S3 Data Compromise." These alerts go beyond traditional threat detection by focusing on attack...