Free Daily Cyber Security Newsletter

Subject: CyberAlerts Daily Newsletter - February 11, 2025

In today's cybersecurity update, we highlight critical and high-severity vulnerabilities that demand immediate attention, particularly those impacting widely used software. The WP Directorybox Manager plugin for WordPress, versions 2.5 and earlier, has a critical authentication bypass vulnerability (CVE-2025-0316) with a CVSS score of 9.8. This flaw allows unauthenticated attackers to log in as any existing user, including administrators, if they know the username. It is crucial for users of this plugin to update to the latest version to mitigate this risk. Additionally, Fedora 40 users should be aware of several high-severity vulnerabilities. The php-phpseclib package is affected by CVE-2023-52892, and it is advised to update this package promptly as it is missing important security patches. Another relevant vulnerability in Fedora 40 is CVE-2025-0638, associated with the rust-routinator package. This vulnerability could lead to potential crashes and improper handling of non-ASCII characters, making it essential for users to ensure their systems are up to date. Overall, it is imperative for system administrators and users of these affected products to take immediate action by applying the necessary updates to protect their systems from possible exploitation. Regularly updating software and monitoring for new vulnerabilities are key strategies in maintaining a secure environment.

Subject: CyberAlerts Daily Newsletter - February 11, 2025

In recent security updates, several critical and high-severity vulnerabilities have been identified, particularly impacting SUSE Linux environments. The most severe issue is CVE-2024-24790, a critical vulnerability in the google-osconfig-agent for SUSE SLES12, with a CVSS score of 9.8. It is crucial for users to update to version 20250115.01 to mitigate this risk. Additionally, multiple high-severity vulnerabilities have been found across various SUSE systems, including CVE-2024-42512 in the OPC UA .NET Standard Stack, which allows unauthorized access when using deprecated security policies; this has a CVSS score of 8.6. Users should upgrade their OPC UA .NET Standard Stack to at least version 1.5.374.158. Several CVEs (CVE-2022-49043 and CVE-2024-11187) affecting the libxml2 and bind packages on SUSE Linux SLED15/SLES15/openSUSE 15 are also critical. These vulnerabilities can lead to memory management issues and CPU exhaustion, respectively, with CVSS scores of 8.1 and 7.5. Users must ensure they update the libxml2 and bind packages to the latest patches to avoid potential exploitation. Moreover, CVE-2024-39917 in the xrdp package, which has a CVSS score of 7.2, affects the login mechanism when credential requirements are set. Updating the xrdp and related packages is advised to enforce proper security measures. In summary, users of SUSE Linux should prioritize updating their systems to address these vulnerabilities, focusing on critical and high-severity issues, especially those that can be exploited in the wild. Regularly applying security updates is essential to maintain system integrity and protect against potential attacks.