Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-0125 |
Description: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator.
The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue does not affect Cloud NGFW and all Prisma® Access instances.
CVSS: MEDIUM (6.9) EPSS Score: 0.06%
April 11th, 2025 (11 days ago)
|
|
CVE-2025-0124 |
Description: An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files.
The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue affects Cloud NGFW. However, this issue does not affect Prisma® Access software.
CVSS: MEDIUM (5.1) EPSS Score: 0.08%
April 11th, 2025 (11 days ago)
|
|
CVE-2025-0122 |
Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to disrupt the packet processing capabilities of the device by sending a burst of crafted packets to that device.
CVSS: MEDIUM (5.1) EPSS Score: 0.02%
April 11th, 2025 (11 days ago)
|
|
CVE-2025-0121 |
Description: A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.
CVSS: MEDIUM (6.8) EPSS Score: 0.02%
April 11th, 2025 (11 days ago)
|
|
CVE-2024-51461 |
Description: IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume memory resources.
CVSS: MEDIUM (4.3) EPSS Score: 0.12%
April 11th, 2025 (11 days ago)
|
|
CVE-2025-32807 |
Description: A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm for some configurations) via the icon parameter of a GET request to geticon.php.
CVSS: MEDIUM (5.3) EPSS Score: 0.06%
April 11th, 2025 (11 days ago)
|
|
CVE-2025-29918 |
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9.
CVSS: MEDIUM (6.2) EPSS Score: 0.02%
April 10th, 2025 (11 days ago)
|
|
CVE-2025-29917 |
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerability is fixed in 7.0.9.
CVSS: MEDIUM (6.2) EPSS Score: 0.02%
April 10th, 2025 (11 days ago)
|
|
CVE-2025-29916 |
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.
CVSS: MEDIUM (6.2) EPSS Score: 0.02% SSVC Exploitation: none
April 10th, 2025 (11 days ago)
|
|
CVE-2024-2944 |
Description: A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. This issue affects some unknown processing of the file /adminpanel/admin/query/deleteCourseExe.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258035. Eine kritische Schwachstelle wurde in Campcodes Online Examination System 1.0 gefunden. Davon betroffen ist unbekannter Code der Datei /adminpanel/admin/query/deleteCourseExe.php. Durch Manipulieren des Arguments id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (6.3) EPSS Score: 0.03% SSVC Exploitation: poc
April 10th, 2025 (11 days ago)
|