CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-27497 |
Description: Summary
A denial-of-service (DoS) vulnerability in OpenDJ has been discovered that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests.
I have confirmed this issue using the latest OpenDJ version (9.2), both with the official OpenDJ Docker image and a local OpenDJ server running on my Windows 10 machine.
Details
An unauthenticated attacker can exploit this vulnerability using a single crafted ldapsearch request. Fortunately, the server can be restarted without data corruption. While this attack requires the existence of an alias loop, I am uncertain whether such loops can be easily created in specific environments or if the method can be adapted to execute other DoS attacks more easily.
PoC (Steps to Reproduce)
Set up an OpenDJ server instance as usual, using the base DN dc=example,dc=com
Import the attached example_data_alias_dos.ldif file into the LDAP database
Ensure that the ldap3 Python library is installed (pip install ldap3)
Run the attached Python script python opendj_alias_dos.py, which searches for alias loops and executes the DoS attack
After executing the script, the server will stop responding to requests until it is restarted
Impact
This vulnerability directly affects server availability for everyone usi...
CVSS: HIGH (8.7) EPSS Score: 0.05%
March 5th, 2025 (4 months ago)
|
|
CVE-2025-20206 |
Description: A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.
This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
CVSS: HIGH (7.1) EPSS Score: 0.01% SSVC Exploitation: none
March 5th, 2025 (4 months ago)
|
|
CVE-2025-27497 |
Description: OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.
CVSS: HIGH (8.7) EPSS Score: 0.05%
March 5th, 2025 (4 months ago)
|
|
CVE-2025-24494 |
Description: Path traversal may allow remote code execution using privileged account
(requires device admin account, cannot be performed by a regular user).
In combination with the 'Upload' functionality this could be used to
execute an arbitrary script or possibly an uploaded binary. Remediation
in Version 6.7.0, release date: 20-Oct-24.
CVSS: HIGH (7.2) EPSS Score: 0.34%
March 5th, 2025 (4 months ago)
|
|
CVE-2024-11216 |
Description: Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.This issue affects Pik Online: through 05.03.2025.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS: HIGH (7.6) EPSS Score: 0.04%
March 5th, 2025 (4 months ago)
|
|
CVE-2025-1702 |
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS: HIGH (7.5) EPSS Score: 0.2%
March 5th, 2025 (4 months ago)
|
|
CVE-2024-13471 |
Description: The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_file function in all versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to read arbitrary files on the underlying operating system.
CVSS: HIGH (7.5) EPSS Score: 0.14%
March 5th, 2025 (4 months ago)
|
|
CVE-2025-0956 |
Description: The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS: HIGH (8.1) EPSS Score: 0.16%
March 5th, 2025 (4 months ago)
|
|
CVE-2024-13777 |
Description: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS: HIGH (8.1) EPSS Score: 0.18%
March 5th, 2025 (4 months ago)
|
|
CVE-2024-13232 |
Description: The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account.
CVSS: HIGH (8.8) EPSS Score: 0.06%
March 5th, 2025 (4 months ago)
|