CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-22651 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppluginboxdev Stylish Google Sheet Reader allows Reflected XSS. This issue affects Stylish Google Sheet Reader: from n/a through 4.0.
CVSS: HIGH (7.1) EPSS Score: 0.04% SSVC Exploitation: none
April 17th, 2025 (2 months ago)
|
|
CVE-2025-22636 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicente Ruiz Gálvez VR-Frases allows Reflected XSS. This issue affects VR-Frases: from n/a through 3.0.1.
CVSS: HIGH (8.2) EPSS Score: 0.04% SSVC Exploitation: none
April 17th, 2025 (2 months ago)
|
|
CVE-2025-22565 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bill Zimmerman vooPlayer v4 allows Reflected XSS. This issue affects vooPlayer v4: from n/a through 4.0.4.
CVSS: HIGH (7.1) EPSS Score: 0.04% SSVC Exploitation: none
April 17th, 2025 (2 months ago)
|
|
CVE-2024-21829 |
Description: Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS: HIGH (8.7) EPSS Score: 0.03% SSVC Exploitation: none
April 17th, 2025 (2 months ago)
|
|
CVE-2024-12530 |
Description: Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4.
End-users can potentially exploit the vulnerability to execute malicious code in the trusted context of the thick-client application.
CVSS: HIGH (7.0) EPSS Score: 0.02%
April 17th, 2025 (2 months ago)
|
|
CVE-2025-25234 |
Description: Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.
CVSS: HIGH (7.1) EPSS Score: 0.03%
April 17th, 2025 (2 months ago)
|
|
CVE-2025-27363 |
🚨 Marked as known exploited on April 17th, 2025 (2 months ago).
Description:
Nessus Plugin ID 234514 with High Severity
Synopsis
The remote Amazon Linux 2023 host is missing a security update.
Description
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-925 advisory. An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. (CVE-2025-27363)Tenable has extracted the preceding description block directly from the tested product security advisory.Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Run 'dnf update freetype --releasever 2023.7.20250331' to update your system.
Read more at https://www.tenable.com/plugins/nessus/234514
CVSS: HIGH (8.1)
April 17th, 2025 (2 months ago)
|
|
CVE-2024-55549 |
Description:
Nessus Plugin ID 234517 with High Severity
Synopsis
The remote Amazon Linux 2 host is missing a security update.
Description
The version of libxslt installed on the remote host is prior to 1.1.28-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2823 advisory. xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. (CVE-2024-55549) numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)Tenable has extracted the preceding description block directly from the tested product security advisory.Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Run 'yum update libxslt' to update your system.
Read more at https://www.tenable.com/plugins/nessus/234517
CVSS: HIGH (7.8)
April 17th, 2025 (2 months ago)
|
|
CVE-2022-49390 |
Description:
Nessus Plugin ID 234528 with High Severity
Synopsis
The remote Amazon Linux 2 host is missing a security update.
Description
The version of kernel installed on the remote host is prior to 5.10.235-227.919. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-088 advisory. In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for real_dev (CVE-2022-49390) In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870) In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit (CVE-2024-57973) In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process (CVE-2024-57977) In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free (CVE-2024-57979) In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069) In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083) In the Linux kernel, ...
CVSS: HIGH (7.8)
April 17th, 2025 (2 months ago)
|
|
CVE-2020-36327 |
Description:
Nessus Plugin ID 234537 with High Severity
Synopsis
The remote SUSE host is missing a security update.
Description
The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1294-1 advisory. - CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen (bsc#1185842) Other fixes: - Updated to version 2.2.34Tenable has extracted the preceding description block directly from the SUSE security advisory.Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected ruby2.5-rubygem-bundler and / or ruby2.5-rubygem-bundler-doc packages.
Read more at https://www.tenable.com/plugins/nessus/234537
CVSS: HIGH (8.8)
April 17th, 2025 (2 months ago)
|