CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Brenny Transportation, headquartered in Central Minnesota, is a premier transportation and logistics company specializing in the safe and efficient delivery of goods to businesses and individuals across the nation. They offer a wide range of services, including long-haul trucking, last-mile delivery, and logistical solutions tailored to the unique needs of their clients. The company serves various customers, from manufacturers and distributors to retailers and individuals, and is dedicated to providing reliable, timely, and cost-effective transportation services. With a focus on grand champion customer service and a commitment to safety, Brenny Transportation is well-equipped to handle all transportation challenges
Employees: 73
Revenue:$18.3 Million
Industry: Transportation
Downloaded: 45GB
Phone Number:(320) 363-6999
July 10th, 2025 (3 days ago)
|
CVE-2025-28245 |
Description: Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body.
EPSS Score: 0.04%
July 10th, 2025 (3 days ago)
|
|
CVE-2025-28244 |
Description: Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover
EPSS Score: 0.08%
July 10th, 2025 (3 days ago)
|
|
Description: The investigation comes in response to an account in the Israeli business publication TheMarker, which reported that the contracts included a deal to buy Pegasus — the powerful spyware manufactured by Israel-based NSO Group.
July 10th, 2025 (3 days ago)
|
|
Description: Thorsten takes stock of a rapidly evolving vulnerability landscape: record-setting CVE publication rates, the growing fragmentation of reporting systems, and why consistent tracking and patching remain critical as we move through 2025.
July 10th, 2025 (3 days ago)
|
|
CVE-2025-53020 |
Description: Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.
This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63.
Users are recommended to upgrade to version 2.4.64, which fixes the issue.
EPSS Score: 0.02%
July 10th, 2025 (3 days ago)
|
|
CVE-2025-49812 |
Description: In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.
Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.
EPSS Score: 0.02%
July 10th, 2025 (3 days ago)
|
|
CVE-2025-49630 |
Description: In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.
Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".
EPSS Score: 0.02%
July 10th, 2025 (3 days ago)
|
|
|
Description: About Accu Reference Medical Lab
Accu Reference is a state-of-the-art medical testing laboratory service that provides a complete range of tests for diagnosis, screening or evaluation of diseases and health conditions. We are certified under ...
July 10th, 2025 (3 days ago)
|
|
Description: Summary
The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks.
Details
1. Sandbox Escape Leading to XSS
The expression evaluator's sandbox can be bypassed to execute arbitrary JavaScript code. Attackers can obtain the Function constructor through indirect methods:
// Attack vector 1: Using Object.getOwnPropertyDescriptor
{ ((f, g) => f(g(Object), "constructor").value)(Object.getOwnPropertyDescriptor, Object.getPrototypeOf)("alert(location)")() }
// Attack vector 2: Using object property access
{ { f: Object.getOwnPropertyDescriptor }.f({ g: Object.getPrototypeOf }.g(Object), "constructor").value("alert(location)")() }
Both payloads bypass the sandbox restrictions and execute Function("alert(location)")().
2. Prototype Pollution
The expression evaluator allows access to prototype accessor methods which can be exploited with Object.assign to pollute the prototype chain:
__lookupGetter__
__lookupSetter__
__defineGetter__
__defineSetter__
Impact
These vulnerabilities allow attackers to:
Execute arbitrary JavaScript code in the context of the application
Steal sensitive information including cookies and tokens
Modify application behavior through prototype pollution
Potentially perform actions on behalf of users
Proof of Concept
Loading the following template in pdfme triggers alert(location):
{
"schemas": [[{
"name": "field1",
"type": "text",
"content...
July 10th, 2025 (3 days ago)
|