CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-32821 |
Description: A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.
EPSS Score: 0.06%
May 7th, 2025 (about 2 months ago)
|
|
CVE-2025-32819 |
Description: A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
EPSS Score: 0.1% SSVC Exploitation: none
May 7th, 2025 (about 2 months ago)
|
|
Description: Hackers are exploiting a critical unauthenticated privilege escalation vulnerability in the OttoKit WordPress plugin to create rogue admin accounts on targeted sites. [...]
May 7th, 2025 (about 2 months ago)
|
|
Description: A new phishing kit named 'CoGUI' sent over 580 million emails to targets between January and April 2025, aiming to steal account credentials and payment data. [...]
May 7th, 2025 (about 2 months ago)
|
|
Description: PowerSchool is warning that the hacker behind its December cyberattack is now individually extorting schools, threatening to release the previously stolen student and teacher data if a ransom is not paid. [...]
May 7th, 2025 (about 2 months ago)
|
|
May 7th, 2025 (about 2 months ago)
|
|
Description: Summary
When verifying SSL certificates, jruby-openssl is not verifying that the hostname presented in the certificate matches the one we are trying to connect to, meaning a MITM could just present any valid cert for a completely different domain they own, and JRuby wouldn't complain.
Details
n/a
PoC
An example domain bad.substitutealert.com was created to present the a certificate for the domain s8a.me. The following script run in IRB in CRuby 3.4.3 will fail with certificate verify failed (hostname mismatch), but will work just fine in JRuby 10.0.0.0 and JRuby 9.4.2.0, both of which use jruby-openssl version 0.15.3
require "net/http"
require "openssl"
uri = URI("https://bad.substitutealert.com/")
https = Net::HTTP.new(uri.host, uri.port)
https.use_ssl = true
https.verify_mode = OpenSSL::SSL::VERIFY_PEER
body = https.start { https.get(uri.request_uri).body }
puts body
Impact
Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely
References
https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx
https://github.com/jruby/jruby-openssl/commit/b1fc5d645c0d90891b8865925ac1c15e3f15a055
https://github.com/advisories/GHSA-72qj-48g4-5xgx
May 7th, 2025 (about 2 months ago)
|
|
|
Description: Summary
When verifying SSL certificates, jruby-openssl is not verifying that the hostname presented in the certificate matches the one we are trying to connect to, meaning a MITM could just present any valid cert for a completely different domain they own, and JRuby wouldn't complain.
Details
n/a
PoC
An example domain bad.substitutealert.com was created to present the a certificate for the domain s8a.me. The following script run in IRB in CRuby 3.4.3 will fail with certificate verify failed (hostname mismatch), but will work just fine in JRuby 10.0.0.0 and JRuby 9.4.2.0, both of which use jruby-openssl version 0.15.3
require "net/http"
require "openssl"
uri = URI("https://bad.substitutealert.com/")
https = Net::HTTP.new(uri.host, uri.port)
https.use_ssl = true
https.verify_mode = OpenSSL::SSL::VERIFY_PEER
body = https.start { https.get(uri.request_uri).body }
puts body
Impact
Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely
References
https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx
https://github.com/jruby/jruby-openssl/commit/b1fc5d645c0d90891b8865925ac1c15e3f15a055
https://github.com/advisories/GHSA-72qj-48g4-5xgx
May 7th, 2025 (about 2 months ago)
|
|
May 7th, 2025 (about 2 months ago)
|
|
Description: Surfshark has become the first VPN provider to launch a free, privacy-focused public DNS service, offering users an alternative to ISP-controlled DNS systems that typically track and monetize browsing data. The company’s new DNS infrastructure prioritizes anonymity, speed, and secure connectivity with no user activity logs and support for encrypted protocols like DoT, DoH, and …
The post Surfshark Launches Free Privacy-Oriented Public DNS Service appeared first on CyberInsider.
May 7th, 2025 (about 2 months ago)
|