Fortinet Warns Attackers Retain FortiGate Access Post-Patching via SSL-VPN Symlink Exploit

Fortinet has revealed that threat actors have found a way to maintain read-only access to vulnerable FortiGate devices even after the initial access vector used to breach the devices was patched. The attackers are believed to have leveraged known and now-patched security flaws, including, but not...

CGA-V87M-6FR7-9QJC

Bulletin has no description...

CVE-2023-42969

An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, macOS Monterey 12.7. The issue was addressed with improved handling of caches...

CVE-2023-42961

CVE-2023-42961 describes a path-handling issue in Apple OS components that could allow a sandboxed process to circumvent sandbox restrictions. The flaw is mitigated by updated validations and is fixed in iOS 17/iPadOS 17, iOS 16.7/iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, and macOS Monter...

CVE-2023-42969

CVE-2023-42969 describes a sandbox escape whereby an app may break out of its sandbox due to improper handling of caches. Affected platforms include iOS and iPadOS prior to 17, and macOS prior to the listed versions ( Sonoma 14, Ventura 13.6, Monterey 12.7). Apple fixed the issue in iOS 17/iPadOS...

CVE-2025-32537

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows Reflected XSS.This issue affects Lock Your Updates: from n/a through = 1.1...

CVE-2025-32537

CVE-2025-32537 corresponds to a Reflected XSS in the WordPress plugin “Lock Your Updates” (versions up to 1.1). The vulnerability is described as Improper Neutralization of Input During Web Page Generation. The connected Wordfence data confirms the entry exists and links it to the Lock Your Updat...

CVE-2025-32537 WordPress Lock Your Updates Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows Reflected XSS.This issue affects Lock Your Updates: from n/a through = 1.1...

CVE-2025-32537 WordPress Lock Your Updates Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rachel Cherry Lock Your Updates allows Reflected XSS. This issue affects Lock Your Updates: from n/a through 1.1...

Security Updates for Microsoft Visual Studio 2022 17.8 / 17.10 / 17.12 Products (April 2025)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including: - Improper access control in Visual Studio allows an authorized attacker to eleveate priveleges locally CVE-2025-29802 - Improper access control in Visual Studi...

Security Updates for Microsoft Visual Studio 2022 17.13 Products (April 2025)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by a Improper access control vulnerabilitiy in Visual Studio allows an authorized attacker to eleveate priveleges locally CVE-2025-29804 Note that Nessus has not tested for these issues but has instea...

Security Updates for Microsoft Office Products C2R (April 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-27745, CVE-2025-27746,...

Microsoft Security Update Validation Report April 2025

Microsoft’s April 2025 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing software...

Security Updates for Microsoft Dynamics 365 Business Central (April 2025)

The Microsoft Dynamics 365 Business Central install is missing security updates. It is, therefore, affected by a information disclosure vulnerability. Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally. Note that Nessus has not...

openSUSE Security Advisory (SUSE-SU-2025:1180-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Updates for Microsoft OneNote C2R (April 2025)

The Microsoft OneNote Products are missing a security update. It is, therefore, affected by a security feature bypass vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. Th...

Security Updates for Microsoft Word Products C2R (April 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-27747, CVE-2025-29820 Note that...

OPENSUSE-SU-2025:14987-1 python311-PyJWT-2.10.1-2.1 on GA media

These are all security issues fixed in the python311-PyJWT-2.10.1-2.1 package on the GA media of openSUSE Tumbleweed...

CGA-HFG3-P5HV-FP8W

Bulletin has no description...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the /api/v4/audits endpoint. An attacker can retrieve User Activity Logs by exploiting insufficient access controls, despite not having the required permissions for Compliance Monitoring. Remediation...