CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Each Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In this post, Tenable security engineers Arnie Cabral and Jason Schavel share how you can use risk-based metrics. You can read the entire Exposure Management Academy series here.We’re information security engineers at Tenable. If you’re anything like us, you spend your days on the front lines of the battle against a constantly changing set of cybersecurity threats. No matter your role, you probably face any number of complex challenges to stay one step ahead of the bad guys. To be most effective, you need to move beyond operating across silos toward bringing all of the data together. Exposure management helps bring this all together. Maybe you’re contemplating a move to exposure management or maybe you’ve already started the shift. (Not sure how mature your program is? Check out the Tenable exposure management security assessment.) No matter where you are, exposure management represents a fundamental shift toward a unified view of exposures across the attack surface. It involves continuously discovering, assessing, prioritizing and remediating all types of security exposures, including vulnerabilities, misconfigurations and excessive permissions across various assets. As we like to say, “give us all the things.”In our roles, we are helping Tenable move in this direction. So we thought we’d share some of our...
June 9th, 2025 (18 days ago)
|
|
Description: Authorities said they busted a ring responsible for illegally extracting citizens' data from Kazakhstan's government networks and distributing it through Telegram and other ways.
June 9th, 2025 (18 days ago)
|
CVE-2025-5875 |
Description: A vulnerability classified as critical has been found in TP-Link TL-IPC544EP-W4 1.0.9 Build 240428 Rel 69493n. Affected is the function sub_69064 of the file /bin/main. The manipulation of the argument text leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine kritische Schwachstelle in TP-Link TL-IPC544EP-W4 1.0.9 Build 240428 Rel 69493n entdeckt. Betroffen hiervon ist die Funktion sub_69064 der Datei /bin/main. Durch Manipulation des Arguments text mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (8.8) EPSS Score: 0.08%
June 9th, 2025 (18 days ago)
|
|
CVE-2025-5874 |
Description: A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as critical. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Eine Schwachstelle wurde in Redash bis 10.1.0/25.1.0 ausgemacht. Sie wurde als kritisch eingestuft. Betroffen davon ist die Funktion run_query der Datei /query_runner/python.py der Komponente getattr Handler. Durch die Manipulation mit unbekannten Daten kann eine sandbox issue-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (5.1) EPSS Score: 0.03%
June 9th, 2025 (18 days ago)
|
|
CVE-2025-41444 |
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.
CVSS: HIGH (8.3) EPSS Score: 0.06%
June 9th, 2025 (18 days ago)
|
|
CVE-2025-36528 |
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in Service Account Auditing reports.
CVSS: HIGH (8.3) EPSS Score: 0.06%
June 9th, 2025 (18 days ago)
|
|
CVE-2025-27709 |
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.
CVSS: HIGH (8.3) EPSS Score: 0.06%
June 9th, 2025 (18 days ago)
|
|
Description: You don’t need a rogue employee to suffer a breach.
All it takes is a free trial that someone forgot to cancel. An AI-powered note-taker quietly syncing with your Google Drive. A personal Gmail account tied to a business-critical tool. That’s shadow IT. And today, it’s not just about unsanctioned apps, but also dormant accounts, unmanaged identities, over-permissioned SaaS
June 9th, 2025 (18 days ago)
|
|
Description: A cyberattack on London hospitals last year led to the depletion of stocks of crucial O-type blood, and the U.K.'s National Health Service is calling for a nationwide effort to shore up supplies.
June 9th, 2025 (18 days ago)
|
|
Description: Multiple vulnerabilities in TCMAN GIM
Mon, 06/09/2025 - 13:32
Aviso
Affected Resources
GIM, 11 version.
Description
INCIBE has coordinated the publication of 3 vulnerabilities of medium severity, affecting TCMAN's GIM, a maintenance management software. The vulnerabilities have been discovered by Jorge Riopedre Vega.These vulnerabilities have been assigned the following code, CVSS v4.0 base score, CVSS vector and vulnerability CWE type:CVE-2025-40668 to CVE-2025-40670: CVSS v4.0: 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | CWE-863
Identificador
INCIBE-2025-0300
3 - Medium
Solution
The vulnerabilities have been fixed by the TCMAN team. The manufacturer has reported that the vulnerabilities are not found in the latest version of GIM Web version 20250128.
Detail
CVE-2025-40668: incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.CVE-2025-40669: incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows a...
EPSS Score: 0.04%
June 9th, 2025 (18 days ago)
|