Security Advisory April 2025 for Ivanti EPM 2024 and EPM 2022 SU6

Security Advisory Ivanti EPM 2022 SU6 and EPM 2024 Multiple CVEs Summary Ivanti has released updates for Ivanti Endpoint Manager which addresses medium and high vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in various products such as Industrial Edge Devices, Mendix, SENTRON, SIDIS, SIMATIC, SIPLUS,Insights Hub Private Cloud, Siemens License Server and Solid Edge. The vulnerabilities potentially enable a malicious person to carry out attacks that can lead to the...

CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

Ivanti Releases Security Updates for Connect Secure, Policy Secure, and ZTA Gateways

Updated April 8, 2025 CISA updated these mitigations based on identification of a new malware variant called RESURGE that could undermine the effectiveness of the mitigations previously provided. For more information on RESURGE, see MAR-25993211.R1.V1.CLEAR and CISA Releases Malware Analysis Repo...

Google fixes two actively exploited zero-day vulnerabilities in Android

Google has patched 62 vulnerabilities in Android, including two actively exploited zero-days in its April 2025 Android Security Bulletin. When we say "zero-day" we mean an exploitable software vulnerability for which there was no patch at the time of the vulnerability being exploited or published...

RHSA-2025:3635 Red Hat Security Advisory: Red Hat Ceph Storage 8.0 security, bug fix, and enhancement updates

Bulletin has no description...

April 8, 2025—KB5055581 (Monthly Rollup)

None None...

April 8, 2025—KB5055519 (OS Build 17763.7136) - EXPIRED

None None...

April 8, 2025—KB5055518 (OS Builds 19044.5737 and 19045.5737) - EXPIRED

None None...

KB5055515: Cumulative security update for Internet Explorer: April 8, 2025

None None...

April 8, 2025—KB5055527 (OS Build 25398.1551)

None None...

April 8, 2025—KB5055528 (OS Builds 22621.5189 and 22631.5189)

None None...

April 8, 2025—KB5055596 (Security-only update)

None None...

CVE-2025-20946

creationtimestamp| type| source ---|---|--- 2025-04-08 05:47:28+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10853 2025-04-08 07:48:21+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114301239272400759 2025-04-08 08:06:58+00:00| seen|...

CVE-2024-58133

In chainmaker-go aka ChainMaker before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic...

APSB25-15 : Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2025, 2023 and 2021. These updates resolve critical and important vulnerabilities that could lead to arbitrary file system read, arbitrary code execution and security feature bypass...

PT-2025-15570 · Microsoft · Office Word +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office Word affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a use-after-free vulnerability in Microsoft Office Word, which can be exploited by an...

PT-2025-15423 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.6.10.3 Shopware versions prior to 6.5.8.17 Description: The issue allows an attacker to cause a Denial of Service by passing long passwords via forms in Storefront forms or Store-API. Recommendations: For versions...

CVE-2025-26682

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

Security Updates for Microsoft SharePoint Server 2019 (April 2025)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple Remote Code Execution vulnerabilities: - Remote Code Execution Vulnerabilites. CVE-2025-26642, CVE-2025-27747, CVE-2025-29793, CVE-2025-29794 %NASLMINLEVEL 7030...