Patch Tuesday - February 2025

Microsoft is addressing 56 vulnerabilities this February 2025 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation for two of the vulnerabilities published today, which is reflected in CISA KEV. Microsoft is aware of public disclosure for two other vulnerabilities. This is now the...

Patch Tuesday - February 2025

Microsoft is addressing 56 vulnerabilities this February 2025 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation for two of the vulnerabilities published today, which is reflected in CISA KEV. Microsoft is aware of public disclosure for two other vulnerabilities. This is now the...

Microsoft and Adobe Patch Tuesday, February 2025 Security Update Review

As the second Patch Tuesday of 2025 arrives, Microsoft has released crucial updates to strengthen cybersecurity defenses. Let's explore the highlights and what they mean for users. Microsoft Patch Tuesday for February 2025 Microsoft Patch's Tuesday, February 2025 edition addressed 67...

CVE-2025-21373

creationtimestamp| type| source ---|---|--- 2025-02-11 18:08:38+00:00| seen| https://www.thezdi.com/blog/2025/2/11/the-february-2025-security-update-review 2025-02-11 18:17:45+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwbfpze7r2a 2025-02-11 19:49:20+00:00| seen|...

CVE-2024-50569

creationtimestamp| type| source ---|---|--- 2025-02-11 16:51:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113986285732278387 2025-02-11 17:16:40+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhw5yinz452h 2025-02-11 17:45:29+00:00| seen|...

Apple fixes zero-day vulnerability used in “extremely sophisticated attack”

Apple has released an emergency security update for a vulnerability which it says may have been exploited in an "extremely sophisticated attack against specific targeted individuals.” The update is available for: iOS 18.3.1 and iPadOS 18.3.1 - iPhone XS and later, iPad Pro 13-inch, iPad Pro...

CVE-2024-52606

creationtimestamp| type| source ---|---|--- 2025-02-11 07:21:07+00:00| seen| https://infosec.exchange/users/cve/statuses/113984042858977898 2025-02-11 08:15:58+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhv7rnz7ir2h 2025-02-11 11:29:53+00:00| seen|...

XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells

Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore, to drop reverse shells and web shells, and maintain persistent remote access to compromised systems. The zero-day exploitation o...

CVE-2025-20169

creationtimestamp| type| source ---|---|--- 2025-02-05 16:37:05+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113952255128702135 2025-02-05 17:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh35luk6r2c 2025-02-05 19:09:21+00:00| seen|...

CVE-2025-20172

creationtimestamp| type| source ---|---|--- 2025-02-05 16:37:05+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113952255128702135 2025-02-05 17:16:02+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh35tvxig27 2025-02-05 19:09:14+00:00| seen|...

CVE-2025-20170

creationtimestamp| type| source ---|---|--- 2025-02-05 16:37:05+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113952255128702135 2025-02-05 17:15:56+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh35ofn6c2t 2025-02-05 19:09:15+00:00| seen|...

CVE-2025-0413

creationtimestamp| type| source ---|---|--- 2025-02-04 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-082/ 2025-02-04 23:16:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113948163353121381 2025-02-05 00:16:47+00:00| seen|...

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

The Trend ZDI team offers an analysis on how CVE-2025-0411, a zero-day vulnerability in 7-Zip, was actively exploited to target Ukrainian organizations in a SmokeLoader campaign involving homoglyph attacks...

PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters

Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS vector v.4.0: 4.8 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N Description: an attack...

BeyondTrust Zero-Day Breach Exposed 17 SaaS Customers via Compromised API Key

BeyondTrust has revealed it completed an investigation into a recent cybersecurity incident that targeted some of the company's Remote Support SaaS instances by making use of a compromised API key. The company said the breach involved 17 Remote Support SaaS customers and that the API key was used...

CVE-2025-0910

creationtimestamp| type| source ---|---|--- 2025-01-31 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-065/ 2025-02-11 20:16:43+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwi2h7yeo2a 2025-02-11 21:13:36+00:00| seen|...

CVE-2025-0899

creationtimestamp| type| source ---|---|--- 2025-01-31 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-061/ 2025-02-11 20:16:16+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwhznbysg2a 2025-02-12 00:04:29+00:00| seen|...

CVE-2025-0909

creationtimestamp| type| source ---|---|--- 2025-01-31 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-064/ 2025-02-11 20:16:40+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhwi2ecozc2a 2025-02-11 21:13:39+00:00| seen|...

Apple users: Update your devices now to patch zero-day vulnerability

Apple has released a host of security updates across many devices, including for a zero-day bug which is being actively exploited in iOS. Apple said: "A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against...

Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More

Apple has released software updates to address several security flaws across its portfolio, including a zero-day vulnerability that it said has been exploited in the wild. The vulnerability, tracked as CVE-2025-24085 CVSS scores: 7.3/7.8, has been described as a use-after-free bug in the Core Med...