⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More

If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready. Below, we list the urgent...

CVE-2025-34394

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution...

SOAPwn: Pwning .NET Framework Applications through HTTP Client Proxies and WSDL

This is a whitepaper which supplements the BlackHat Europe 2025 presentation called "SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies and WSDL". In this whitepaper, the author presents new exploitation sinks in .NET Framework, which may allow an attacker to achieve either...

CVE-2025-34395

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attacker can invoke a method vulnerable to path traversal to read arbitrary files. This vulnerability can be escalated to remote code execution ...

CVE-2025-34395 Barracuda RMM < 2025.1.1 Service Center .NET Remoting Path Traversal RCE

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attacker can invoke a method vulnerable to path traversal to read arbitrary files. This vulnerability can be escalated to remote code execution ...

Barracuda Service Center 代码问题漏洞

Barracuda Service Center is a service center software from Barracuda USA. A code issue vulnerability exists in Barracuda Service Center versions prior to 2025.1.1, which stems from insufficient protection of the .NET Remoting service and could lead to remote code execution...

CVE-2025-34414 Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE

Entrust Instant Financial Issuance IFI On Premise software formerly referred to as CardWizard versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel with...

CVE-2025-34414 Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE

Entrust Instant Financial Issuance IFI On Premise software formerly referred to as CardWizard versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel with...

PT-2025-50149

Name of the Vulnerable Software and Affected Versions Entrust Instant Financial Issuance IFI On Premise software formerly referred to as CardWizard versions 5.x through 6.10.5 and versions prior to 6.11.1 Description The software has an insecure .NET Remoting exposure in the Legacy Remoting...

.NET 10.0 Update - December 9, 2025 (KB5072928)

None None...

Malicious code in solananet (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-191605 Malicious code in bitcoincore (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Fedora: Security Advisory (FEDORA-2025-969f0c8c1e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-aaa5764dc9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-41518fc0fd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-198880

Malicious code in @asyncapi/dotnet-rabbitmq-template npm...

Malicious code in @asyncapi/dotnet-rabbitmq-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfe9dec1956338f8f71d62c068f6d7ce424424780d8775218b884d49b8ac838 The package @asyncapi/dotnet-rabbitmq-template was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190797 Malicious code in @asyncapi/dotnet-rabbitmq-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfe9dec1956338f8f71d62c068f6d7ce424424780d8775218b884d49b8ac838 The package @asyncapi/dotnet-rabbitmq-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in dotnet-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b8736e74e763b930253cc92ff8ee4e0b0c323b712ea201cd40c8590f618b72 The package dotnet-template was found to contain malicious code. Source: ghsa-malware 01d263352d7df50818b3c0bfb8c2c2b4c30e78dcf1feadeb4b808c2636b9c6a...