CyberAlerts

CVE-2025-41366

Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.

CVSS: MEDIUM (5.1)

EPSS Score: 0.04%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-41365

Code injection vulnerability in IDF and ZLF

Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.

CVSS: MEDIUM (5.1)

EPSS Score: 0.05%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-41364

Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF

Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

CVSS: MEDIUM (5.1)

EPSS Score: 0.05%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-41363

CORS vulnerability in IDF and ZLF

Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-41362

Code injection vulnerability in IDF and ZLF

Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.

CVSS: MEDIUM (5.3)

EPSS Score: 0.05%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-41361

Uncontrolled resource consumption vulnerability in IDF and ZLF

Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit this vulnerability, PROCOME ports must be configured and active, with communications encryption active.

CVSS: HIGH (8.3)

EPSS Score: 0.04%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-41360

Uncontrolled resource consumption vulnerability in IDF and ZLF

Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack.

CVSS: HIGH (8.7)

EPSS Score: 0.06%

Source: CVE

June 6th, 2025 (about 1 month ago)

CVE-2025-39358

WordPress WP Posts Carousel <= 1.3.12 - PHP Object Injection Vulnerability

Description: Deserialization of Untrusted Data vulnerability in Teastudio.Pl WP Posts Carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through 1.3.12.

CVSS: HIGH (8.8)

EPSS Score: 0.05%

Source: CVE

June 6th, 2025 (about 1 month ago)

DOJ moves to claim $7.74 million tied to North Korean IT worker scheme

Description: The U.S. government wants to confiscate millions of dollars in funds tied to illegal employment of North Korean IT workers at American companies.

Source: The Record

June 6th, 2025 (about 1 month ago)

Another data wiper found in Ukrainian critical infrastructure

Description: The new PathWiper, spotted in an attack on Ukrainian critical infrastructure, has similarities to wiper malware previously deployed by the Russian group known as Sandworm.

Source: The Record

June 6th, 2025 (about 1 month ago)

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-41366	CORS vulnerability in IDF and ZLF Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission. CVSS: MEDIUM (5.1) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41365	Code injection vulnerability in IDF and ZLF Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission. CVSS: MEDIUM (5.1) EPSS Score: 0.05% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41364	Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission. CVSS: MEDIUM (5.1) EPSS Score: 0.05% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41363	CORS vulnerability in IDF and ZLF Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission. CVSS: MEDIUM (5.3) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41362	Code injection vulnerability in IDF and ZLF Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission. CVSS: MEDIUM (5.3) EPSS Score: 0.05% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41361	Uncontrolled resource consumption vulnerability in IDF and ZLF Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit this vulnerability, PROCOME ports must be configured and active, with communications encryption active. CVSS: HIGH (8.3) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41360	Uncontrolled resource consumption vulnerability in IDF and ZLF Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack. CVSS: HIGH (8.7) EPSS Score: 0.06% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-39358	WordPress WP Posts Carousel <= 1.3.12 - PHP Object Injection Vulnerability Description: Deserialization of Untrusted Data vulnerability in Teastudio.Pl WP Posts Carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through 1.3.12. CVSS: HIGH (8.8) EPSS Score: 0.05% Source: CVE June 6th, 2025 (about 1 month ago)
	DOJ moves to claim $7.74 million tied to North Korean IT worker scheme Description: The U.S. government wants to confiscate millions of dollars in funds tied to illegal employment of North Korean IT workers at American companies. Source: The Record June 6th, 2025 (about 1 month ago)
	Another data wiper found in Ukrainian critical infrastructure Description: The new PathWiper, spotted in an attack on Ukrainian critical infrastructure, has similarities to wiper malware previously deployed by the Russian group known as Sandworm. Source: The Record June 6th, 2025 (about 1 month ago)