CVSS – Page 4 – Experimental News Clipping Site

Hacker News: Multiple vulnerabilities in ingress-Nginx (Score 9.8)

Mar 24, 2025

—

by

Source URL: https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ Source: Hacker News Title: Multiple vulnerabilities in ingress-Nginx (Score 9.8) Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses critical vulnerabilities in the ingress-nginx component of Kubernetes that could lead to arbitrary code execution and secret disclosure. The seriousness of these vulnerabilities necessitates immediate action, specifically patching or upgrading…

Hacker News: Next.js and the corrupt middleware: the authorizing artifact

Mar 23, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Source: Hacker News Title: Next.js and the corrupt middleware: the authorizing artifact Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses a critical security vulnerability discovered in Next.js, a widely used JavaScript framework, specifically regarding its middleware functionality. The vulnerability allows unauthorized access by manipulating request headers, which could…

The Register: ‘Dead simple’ hijacking hole in Apache Tomcat ‘now actively exploited in the wild’

Mar 18, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/03/18/apache_tomcat_java_rce_flaw/ Source: The Register Title: ‘Dead simple’ hijacking hole in Apache Tomcat ‘now actively exploited in the wild’ Feedly Summary: One PUT request, one poisoned session file, and the server’s yours A trivial flaw in Apache Tomcat that allows remote code execution and access to sensitive files is said to be under attack…

Bulletins: Vulnerability Summary for the Week of March 10, 2025

Mar 17, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.cisa.gov/news-events/bulletins/sb25-076 Source: Bulletins Title: Vulnerability Summary for the Week of March 10, 2025 Feedly Summary: High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info 1E–1E Client Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged…

The Register: FCC stands up Council on National Security to fight China in ways that CISA used to

Mar 16, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/03/16/infosec_news_in_brief/ Source: The Register Title: FCC stands up Council on National Security to fight China in ways that CISA used to Feedly Summary: PLUS: Alleged Garantex admin arrested in India; Google deletes more North Korean malware Infosec In Brief United States Federal Communications Commission chair Brendan Carr has unveiled plans to form a…

The Register: Choose your own Patch Tuesday adventure: Start with six zero day fixes, or six critical flaws

Mar 12, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/03/12/patch_tuesday/ Source: The Register Title: Choose your own Patch Tuesday adventure: Start with six zero day fixes, or six critical flaws Feedly Summary: Microsoft tackles 50-plus security blunders, Adobe splats 3D bugs, and Apple deals with a doozy Patch Tuesday Microsoft’s Patch Tuesday bundle has appeared, with a dirty dozen flaws competing for…

Cisco Talos Blog: Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities

Mar 11, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://blog.talosintelligence.com/march-patch-tuesday-release/ Source: Cisco Talos Blog Title: Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities Feedly Summary: Microsoft has released its monthly security update for March of 2025 which includes 57 vulnerabilities affecting a range of products, including 6 that Microsoft marked as “critical”. AI Summary and Description: Yes Summary:…

Hacker News: Vulnerability in partner.microsoft.com allows unauthenticated access

Mar 5, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://nvd.nist.gov/vuln/detail/CVE-2024-49035 Source: Hacker News Title: Vulnerability in partner.microsoft.com allows unauthenticated access Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a significant vulnerability (CVE-2024-49035) related to improper access control in Microsoft’s Partner Center, allowing unauthenticated attackers to elevate their privileges over a network. The vulnerability is classified as critical due…

The Register: VMware patches guest-to-hypervisor escape flaws already under attack

Mar 4, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/03/04/vmware_plugs_three_hypervisorhijack_holes/ Source: The Register Title: VMware patches guest-to-hypervisor escape flaws already under attack Feedly Summary: The heap overflow in the memory unsafe code by Miss Creant Broadcom today pushed out patches for three VMware hypervisor-hijacking bugs, including one rated critical, that have already been found and exploited by criminals.… AI Summary and Description:…

Bulletins: Vulnerability Summary for the Week of February 17, 2025

Feb 24, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.cisa.gov/news-events/bulletins/sb25-055 Source: Bulletins Title: Vulnerability Summary for the Week of February 17, 2025 Feedly Summary: High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info a1post–A1POST.BG Shipping for Woo Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo allows Privilege Escalation. This issue affects A1POST.BG Shipping for Woo: from n/a…

Tag: CVSS