CyberAlerts

CVE-2024-45712

SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability

Description: SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account, on the local machine, from the local browser session. Therefore the risk is very low.

CVSS: LOW (2.6)

Source: CVE

April 15th, 2025 (about 2 hours ago)

Building Web Check using PaaS

Description: How Platform as a Service (PaaS) can make good security easier to achieve.

Source: NCSC Alerts and Advisories

April 15th, 2025 (about 3 hours ago)

Hertz Confirms Data Breach Following Clop Ransomware Leaks

Description: The Hertz Corporation has confirmed a data breach resulting from the exploitation of zero-day vulnerabilities in Cleo Communications' file transfer platform, marking the latest fallout in the broader “Cleo campaign” attributed to the Clop ransomware group. The breach, which may have exposed a range of sensitive personal data, affects customers and possibly employees of Hertz, … The post Hertz Confirms Data Breach Following Clop Ransomware Leaks appeared first on CyberInsider.

Source: CyberInsider

April 15th, 2025 (about 3 hours ago)

EU gives staff 'burner phones, laptops' for US visits

Source: TheRegister

April 15th, 2025 (about 4 hours ago)

Referencia de Objeto Directo Inseguro en Deporsite de T-INNOVA

Description: Insecure Direct Object Reference on Deporsite by T-INNOVA Tue, 04/15/2025 - 12:03 Aviso Affected Resources GestorFirmaDocumentos Module, v05.29.0907. Description INCIBE has coordinated the publication of 2 high severity vulnerabilities that affect the specific module in charge of document signature management GestorFirmaDocumentos, of T-INNOVA, which have been discovered by Carlos Alonso Arranz.These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector and the type of vulnerability CWE of each vulnerability:CVE-2025-3574 y CVE-2025-3575: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. | CWE-639 Identificador INCIBE-2025-0186 4 - High Solution The vulnerabilities have been fixed by the T-INNOVA team in release 2024.02 (DSuite2024 v06.1287 fix2).T-Innova has identified the customers using the affected module, and has applied the corresponding patch. Detail Insecure Direct Object Reference (IDOR) vulnerabilities in T-INNOVA's DocumentSignatureManager module could allow an attacker to obtain sensitive information from other users via parameters:CVE-2025-3574: "idUsuario" in the endpoint "/helper/Familia/obtenerFamiliaUsuario".CVE-2025-3575: "idUsuario" in the endpoint "/helper/Familia/establecerUsuarioSeleccion". ...

Source: Incibe CERT

April 15th, 2025 (about 4 hours ago)

CVE-2025-3622

Xorbits Inference model.py load deserialization

Description: A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization. Eine Schwachstelle wurde in Xorbits Inference bis 1.4.1 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um die Funktion load der Datei xinference/thirdparty/cosyvoice/cli/model.py. Dank Manipulation mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden.

CVSS: MEDIUM (5.1)

Source: CVE