GHSA-4H9W-7VFP-PX8M Shopware default newsletter opt-in settings allow for mass sign-up abuse

Impact Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are: Newsletter: Double Opt-in - active Newsletter: Double opt-in for registered customers - disabled Log-in & sign-up: Double opt-in on sign-up - disabled...

GHSA-9R25-RP3P-H2W4 crud-query-parser SQL Injection vulnerability

Impact Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter. Versions 0.0.1, 0.0.2 and 0.0.3 are affected b...

Vulnerability fixed in FortiSwitch

Fortinet has fixed a vulnerability in the FortiSwitch GUI. The vulnerability with reference CVE-2024-48887, is located in the FortiSwitch GUI, which allows a remote, unauthenticated malicious person to change admin passwords via specially crafted requests. This security issue can lead to...

CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

BELL-CVE-2025-22014

Bulletin has no description...

Patch Tuesday, April 2025 Edition

Microsoft today released updates to plug at least 121 security holes in its Windows operating systems and software, including one vulnerability that is already being exploited in the wild. Eleven of those flaws earned Microsoft's most-dire "critical" rating, meaning malware or malcontents could...

PT-2025-15859 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.2R3-S9 Junos OS versions from 21.4 before 21.4R3-S10 Junos OS versions from 22.2 before 22.2R3-S6 Junos OS versions from 22.4 before 22.4R3-S6 Junos OS versions from 23.2 before 23.2R2-S3 Junos OS versions from...

PT-2025-15845 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions 21.2 through 21.2R3-S8 Junos OS versions 21.4 through 21.4R3-S7 Junos OS versions 22.1 through 22.1R3-S6 Junos OS versions 22.2 through 22.2R3-S4 Junos OS versions 22.3 through 22.3R3-S3 Junos OS versions 22.4 through...

PT-2025-15860 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 22.2R3-S4 Junos OS versions 22.4 prior to 22.4R3-S2 Junos OS versions 23.2 prior to 23.2R2 Junos OS versions 23.4 prior to 23.4R2 Junos OS Evolved versions prior to 22.2R3-S4-EVO Junos OS Evolved versions 22.4-EVO...

Citrix Endpoint Management (aka XenMobile Server) 10.16.0 Rolling Patch 5

Package name: xms10.16.0.10551.bin For: XenMobile Server 10.16.0 Deployment type: On-premises only Replaces: xms10.16.0.10427.bin, xms10.16.0.10318.bin, xms10.16.0.10205.bin, xms10.16.0.10108.bin Date: April 2025 Languages supported: English US Important notes about this update As a best practice...

PT-2025-15758 · Unknown · Blueinstyle Advanced Tag Lists

Name of the Vulnerable Software and Affected Versions: blueinstyle Advanced Tag Lists versions 1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

KB5055664: Servicing stack update for Windows 10: April 9, 2025

None None...

Microsoft and Adobe Patch Tuesday, April 2025 Security Update Review

Microsoft's April 2025 Patch Tuesday has arrived, delivering critical security updates and fixes across the various products, features, and roles. Here's a quick breakdown of what you need to know. Microsoft Patch Tuesday for April 2025 In this month's Patch Tuesday, April 2025 edition, Microsoft...

Vulnerability fixed in Microsoft Dynamics

Microsoft has fixed a vulnerability in Dynamics. A vulnerability marked CVE-2025-29821, from incorrect input validation in Dynamics Business Central, allowed a malicious party to gain access to sensitive data. If successfully exploited, the malicious party can recover passwords in unencrypted tex...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft fixed vulnerabilities in Visual Studio and .NET A malicious party could exploit the vulnerabilities to cause a denial-of-service, grant themselves elevated privileges and/or execute arbitrary code with developer privileges. Because developers tend to work under elevated privileges, it...

Exploitation of CLFS zero-day leads to ransomware activity

Microsoft Threat Intelligence Center MSTIC and Microsoft Security Response Center MSRC have discovered post-compromise exploitation of a zero-day elevation of privilege vulnerability in the Windows Common Log File System CLFS against a small number of targets. The targets include organizations in...

CVE-2024-55354

creationtimestamp| type| source ---|---|--- 2025-04-08 17:21:22+00:00| seen| https://bsky.app/profile/zackster.bsky.social/post/3lmcyfg77yk2k 2025-04-09 01:22:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmdtbgvyej2f 2025-04-09 01:43:19+00:00| seen|...

CVE-2025-32024

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

CVE-2025-27480

creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 19:47:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10981 2025-04-08 19:48:37+00:00| seen|...

CVE-2025-27481

creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 18:14:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114303700058967662 2025-04-08 19:47:27+00:00| seen|...