CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE-2025-41365

Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.

CVSS: MEDIUM (5.1)

EPSS Score: 0.05%

Source: CVE
June 6th, 2025 (about 1 month ago)

CVE-2025-41364

Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

CVSS: MEDIUM (5.1)

EPSS Score: 0.05%

Source: CVE
June 6th, 2025 (about 1 month ago)

CVE-2025-41363

Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE
June 6th, 2025 (about 1 month ago)

CVE-2025-41362

Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

CVSS: MEDIUM (5.3)

EPSS Score: 0.05%

Source: CVE
June 6th, 2025 (about 1 month ago)

CVE-2025-41361

Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit this vulnerability, PROCOME ports must be configured and active, with communications encryption active.

CVSS: HIGH (8.3)

EPSS Score: 0.04%

Source: CVE
June 6th, 2025 (about 1 month ago)

CVE-2025-41360

Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack.

CVSS: HIGH (8.7)

EPSS Score: 0.06%

Source: CVE
June 6th, 2025 (about 1 month ago)

CVE-2025-39358

Description: Deserialization of Untrusted Data vulnerability in Teastudio.Pl WP Posts Carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through 1.3.12.

CVSS: HIGH (8.8)

EPSS Score: 0.05%

Source: CVE
June 6th, 2025 (about 1 month ago)
Description: The U.S. government wants to confiscate millions of dollars in funds tied to illegal employment of North Korean IT workers at American companies.
Source: The Record
June 6th, 2025 (about 1 month ago)
Description: The new PathWiper, spotted in an attack on Ukrainian critical infrastructure, has similarities to wiper malware previously deployed by the Russian group known as Sandworm.
Source: The Record
June 6th, 2025 (about 1 month ago)
Source: TheRegister
June 6th, 2025 (about 1 month ago)