CVE-2025-4295

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025...

CVE-2025-4295

HotelRunner B2B is affected by CVE-2025-4295 due to improper validation of TLS certificates with host mismatches, enabling HTTP response splitting. The issue impacts HotelRunner B2B versions prior to 04.06.2025. Root cause and affected component: certificate host name validation flaw in the B2B p...

Disrupting active exploitation of on-premises SharePoint vulnerabilities

July 23, 2025 update – Expanded analysis and threat intelligence from our continued monitoring of exploitation activity by Storm-2603 leading to the deployment of Warlock ransomware. Based on new information, we have updated the Attribution, Indicators of compromise, extended and clarified...

CVE-2025-7886

A vulnerability, which was classified as critical, was found in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. This affects the function getUserLanguage of the file classes/class.database.php. The manipulation of the argument userid leads to sql injection. It...

Malicious code in mydealer-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54d329ce146d06334e3713a20760ac8315306e6cde78b8ebb0394b443ea83a60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the graphical interface of the Fortinet FortiSOAR software for coordinating the operation of cybersecurity systems and for managing real-time incident responses allows attackers to gain unauthorized access to protected information.

The vulnerability of the graphical interface of the software platform for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can...

HotelRunner B2B 安全漏洞

HotelRunner B2B is a software tool for business management and collaboration for the hotel industry from HotelRunner Turkey. A security vulnerability exists in HotelRunner B2B versions prior to 04.06.2025, which stems from improper validation of a certificate host mismatch and could lead to HTTP...

PT-2025-30417 · Unknown · Hotelrunner B2B

Name of the Vulnerable Software and Affected Versions: HotelRunner B2B versions prior to 04.06.2025 Description: This issue involves improper validation of certificates with host mismatches, leading to HTTP Response Splitting in HotelRunner B2B. Recommendations: Update HotelRunner B2B to version...

CVE-2025-54129

HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be...

CVE-2025-54129 HAXiam allows for User Enumeration

HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be...

Improper Handling Of HTTP Headers

on-headers is vulnerable to Improper Handling of HTTP Headers. The vulnerability is due to unexpected header modification caused by incorrect processing when an array is passed to response.writeHead, potentially altering response headers unintentionally...

avahi: Avahi Wide-Area DNS Uses Constant Source Port

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected...

PT-2025-30267 · Recursor +1 · Recursor +1

Name of the Vulnerable Software and Affected Versions: versions prior to the updated version Description: An attacker spoofing responses to ECS-enabled requests sent by the Recursor may succeed. The updated version includes mitigations against spoofing attempts of ECS-enabled queries by chaining...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo

CVE-2025-32463 Detection Framework A comprehensive security m...

CVE-2025-7894

A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1. This issue affects the function generatesimplesql of the file backend/onyx/agents/agentsearch/kbsearch/nodes/a3generatesimplesql.py of the component Chat Interface. The manipulation leads to sql injection. The...

CVE-2025-7882 Mercusys MW301R Login excessive authentication

A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the component Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack can only be initiated...

PT-2025-30186 · Eluktronics · Eluktronics Control Center

Name of the Vulnerable Software and Affected Versions: Eluktronics Control Center version 5.23.51.41 Description: A problematic issue exists within the REG File Handler component of the software due to insufficient verification of data authenticity. This can be exploited on the local host. The...

Azure Linux 3.0 Security Update: httpd (CVE-2024-42516)

The version of httpd installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42516 advisory. - HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the...

CBL Mariner 2.0 Security Update: httpd (CVE-2024-42516)

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42516 advisory. - HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the...

Microsoft at Black Hat USA 2025: A unified approach to modern cyber defense

Microsoft will be at Black Hat USA 2025, August 5–7 in Las Vegas, and we’re bringing you a unified, practitioner-driven experience built around real-world insights, threat intelligence, incident response, and hands-on AI expertise. We believe security teams are strongest when intelligence, tools,...