Bundles

Vulnerabilities in various SAP products

2026-01-13T06:48:14+0000 by Cédric Bonhomme

JSON

Vulnerabilities in various SAP products.

Privilege boundary violation vulnerability is identified affecting multiple Radiometer Products

2025-12-17T12:04:22+0000 by Cédric Bonhomme

JSON

A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The vulnerability is due to weakness in the design of access control implementation in application software.

Other related CVE's are CVE-2025-14096 and CVE-2025-14097.

Affected customers have been informed about this vulnerability.

This CVE is being published to provide transparency.

Required configuration for Exposure

Physical access to the analyzer is needed.

Temporary work Around Only authorized people can physically access the analyzer.

Permanent solution Local Radiometer representatives will contact all affected customers to discuss a permanent solution.

Exploit Status Researchers have provided working proof-of-concept. Radiometer is not aware of any publicly available exploit at the time of publication.

Related vulnerabilities: CVE-2025-14096 CVE-2025-14095 CVE-2025-14097

Uhale digital frames with Android operating system have several critical vulnerabilities

2025-12-03T15:23:07+0000 by Cédric Bonhomme

JSON

> Experts have found that many of the digital frame models analyzed download malicious payloads from Chinese servers immediately after ignition. At startup, devices check for an update of the Uhale app, install the update to version 4.2.0 and restart. After restarting, the updated app starts downloading and running the malware. > > The downloaded JAR/DEX file is saved in the Uhale application directory and run at each subsequent system start. It is not yet clear why version 4.2.0 of the application became malicious (whether this was done intentionally by the developers themselves or whether the ZEASN upgrade infrastructure was compromised). > > The malware detected has been linked to the Vo1d botnet, which has millions of devices, as well as the Mzmess family of malware. This connection is confirmed by packet prefixes, string names, endpoints, malware distribution process, and a range of artifacts. > > In addition to the automatic download of the malware (which did not occur on all the frames analyzed), the researchers also discovered numerous vulnerabilities. In their report, Quokka's specialists detailed 17 problems, 11 of which have already received CVE identifiers.

The most serious are:

CVE-2025-58392 and CVE-2025-58397 – An insecure implementation of TrustManager allows a MitM attack to inject counterfeit encrypted responses, eventually leading to remote code execution with root privileges;
CVE-2025-58388 – During an application update, raw file names are passed directly to shell commands, allowing command injection and remote installation of arbitrary APKs;
CVE-2025-58394 – All the camera frames tested were shipped with disabled SELinux, default root access and AOSP public test keys, which means they were completely compromised from the first moment;
CVE-2025-58396 – A pre-installed application launches a file server on the TCP 17802 port, which accepts file uploads without authentication. As a result, any host on the local network gets the ability to write or delete arbitrary files on your device;
CVE-2025-58390 – WebView in the app ignores SSL/TLS errors and allows mixed content, allowing attackers to inject or intercept data viewed on the device, opening the door to phishing and content spoofing.

npm.js - account qix and duckdb_admin compromised and associated CVEs allocated

2025-09-10T13:18:37+0000 by Cédric Bonhomme

JSON

CVE Assigned for the account compromised

Account compromised: https://www.npmjs.com/~qix) and duckdb_admin - source code of the malware

DuckDB packages - https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c - CVE-2025-59037
Prebid - prebid-universal-creative - https://vulnerability.circl.lu/vuln/CVE-2025-59039 - CVE-2025-59039
Prebid.js - https://vulnerability.circl.lu/vuln/cve-2025-59038 - CVE-2025-59038

Package known to be compromised

Package	Version
backslash	0.2.1
chalk-template	1.1.1
supports-hyperlinks	4.1.1
has-ansi	6.0.1
simple-swizzle	0.2.3
color-string	2.1.1
error-ex	1.3.3
color-name	2.0.1
is-arrayish	0.3.3
slice-ansi	7.1.1
color-convert	3.1.1
wrap-ansi	9.0.1
ansi-regex	6.2.1
supports-color	10.2.1
strip-ansi	7.1.1
chalk	5.6.1
debug	4.4.2
ansi-styles	6.2.2

Related vulnerabilities: CVE-2025-59038 CVE-2025-59039 CVE-2025-59037 GHSA-W62P-HX95-GF2C

Multiple Vulnerabilities in Certain Autodesk Products

2025-07-29T20:45:45+0000 by Cédric Bonhomme

JSON

Certain Autodesk products use a shared component that is affected by multiple vulnerabilities listed below. Exploitation of these vulnerabilities can lead to code execution. Exploitation of these vulnerabilities requires user interaction. Description

The details of the vulnerabilities are as follows:

CVE-2025-5038: A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVE-2025-5043: A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2025-6631: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2025-6635: A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2025-6636: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2025-6637: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2025-7497: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2025-7675: A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Affected Products

Item: Autodesk AutoCAD 2026 and the following specialized toolsets: Autodesk AutoCAD Architecture 2026, Autodesk AutoCAD Electrical 2026, Autodesk AutoCAD Mechanical 2026, Autodesk AutoCAD MEP 2026, Autodesk AutoCAD Plant 3D 2026, Autodesk AutoCAD Map 3D 2026

Autodesk Advance Steel 2026, Autodesk 3ds Max 2026, Autodesk Civil 3D 2026, Autodesk InfraWorks 2026, Autodesk Inventor 2026, Autodesk Revit 2026, Autodesk Revit LT 2026, Autodesk Vault 2026

Impacted Versions: Autodesk Shared Components 2026.2

Mitigated Versions: Autodesk Shared Components 2026.3

Update Source: Autodesk Access or Accounts Portal

Qualcomm July 2025 Security Bulletin

2025-07-08T13:19:01+0000 by Cédric Bonhomme

JSON

Public ID	Security Rating	CVSS Rating	Technology Area	Date Reported
CVE-2024-53009	Critical	Medium	Automotive Autonomy	Internal
CVE-2025-21444	Critical	High	Data Network Stack & Connectivity	Internal
CVE-2025-21445	Critical	High	Data Network Stack & Connectivity	Internal
CVE-2025-21450	Critical	Critical	GPS	Internal
CVE-2025-21422	High	High	Automotive	Internal
CVE-2025-21427	High	High	Data Network Stack & Connectivity	08/18/2024
CVE-2025-21432	High	High	HLOS	Internal
CVE-2025-21433	High	Medium	HLOS	Internal
CVE-2025-21446	High	High	WLAN Firmware	Internal
CVE-2025-21449	High	High	WLAN Firmware	Internal
CVE-2025-21454	High	High	WLAN Firmware	Internal
CVE-2025-21466	High	High	Display	Internal
CVE-2025-27044	High	High	Video	10/27/2024
CVE-2025-27046	High	High	Display	Internal
CVE-2025-27047	High	High	Display	Internal
CVE-2025-27050	High	High	Camera	11/06/2024
CVE-2025-27051	High	High	Windows WLAN Host	12/14/2024
CVE-2025-27052	High	High	Core Services	12/20/2024
CVE-2025-27055	High	High	Camera	Internal
CVE-2025-27058	High	High	Computer Vision	Internal

Open Source Software Issues

The tables below summarize security vulnerabilities that were addressed through open source software

This table lists high impact security vulnerabilities. Patches are being actively shared with OEMs, who have been notified and strongly recommended to deploy those patches on released devices as soon as possible. Please contact the device manufacturer for information on the patching status of released devices.

Public ID	Security Rating	CVSS Rating	Technology Area	Date Reported
CVE-2025-27042	High	High	Video	09/22/2024
CVE-2025-27043	High	High	Video	09/17/2024
CVE-2025-27056	High	High	DSP Service	Internal
CVE-2025-27057	High	High	WLAN Host	Internal
CVE-2025-27061	High	High	Video	10/04/2024

CitrixBleed 2

2025-06-25T09:04:23+0000 by Cédric Bonhomme

JSON

Citrix patched a critical vulnerability in its NetScaler ADC and NetScaler Gateway products that is already being compared to the infamous CitrixBleed flaw exploited by ransomware gangs and other cyber scum, although there haven't been any reports of active exploitation. Yet.

Security analyst Kevin Beaumont dubbed the vulnerability "CitrixBleed 2." As The Register's readers likely remember, that earlier flaw (CVE-2023-4966) allowed attackers to access a device's memory, find session tokens, and then use those to impersonate an authenticated user while bypassing multi-factor authentication — which is also possible with this new bug.

https://www.theregister.com/2025/06/24/critical_citrix_bug_citrixbleed/

Related vulnerabilities: CVE-2023-4966 CVE-2025-5777

Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0

2025-03-13T05:57:30+0000 by Cédric Bonhomme

JSON

Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. More information: https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/

Related vulnerabilities: CVE-2024-45409 CVE-2025-25292 CVE-2024-9487 CVE-2025-25291

Cyber Threat Overview 2024 from CERT-FR

2025-03-11T20:37:58+0000 by Cédric Bonhomme

JSON

In this fourth edition of the Cyber Threat Overview, The French Cybersecurity Agency (ANSSI) addresses prevalent cybersecurity threats and the pivotal incidents which occurred in 2024. In line with the previous years, ANSSI estimates that attackers associated with the cybercriminal ecosystem and reputedly linked to China and Russia are three of the main threats facing both critical information systems and the national ecosystem as a whole.

This past year was also marked by the hosting of the Paris Olympic and Paralympic Games and by the number and the impact of vulnerabilities affecting information systems’ security edge devices.

CVE	SCORE CVSS3.x	ÉDITEUR	RISQUE	RÉFÉRENCE CERT-FR
CVE-2024-21887	9.1	IVANTI	Remote execution of arbitrary code, security policy and authentication bypass, access to restricted resources on different security and VPN gateways	CERTFR-2024-ALE-001, CERTFR-2024-AVI-0109, CERTFR-2024-AVI-0085
CVE-2023-46805	8.2	IVANTI	Remote execution of arbitrary code, security policy and authentication bypass on different security and VPN gateways	CERTFR-2024-ALE-0097
CVE-2024-21893	8.2	IVANTI
CVE-2024-3400	10.0	PALO ALTO NETWORKS	Remote execution of arbitrary code on different security devices	CERTFR-2024-ALE-006, CERTFR-2024-AVI-0307
CVE-2022-42475	9.8	FORTINET	Remote execution of arbitrary code on different SSL VPN gateways	CERTFR-2022-ALE-012, CERTFR-2022-AVI-1090
CVE-2024-8963	9.4	IVANTI	Remote execution of arbitrary code and security policy bypass on different security and VPN gateways	CERTFR-2024-ALE-013, CERTFR-2024-AVI-0796, CERTFR-2024-AVI-0917
CVE-2024-8190	7.2	IVANTI		CERTFR-2024-ALE-014, CERTFR-2024-AVI-0917
CVE-2024-47575	9.8	FORTINET	Remote execution of arbitrary code on different security devices	CERTFR-2024-ALE-014, CERTFR-2024-AVI-0917
CVE-2024-21762	9.8	FORTINET	Remote execution of arbitrary code on different security devices	CERTFR-2024-ALE-004, CERTFR-2024-AVI-0108
CVE-2021-44228	10.0	APACHE	Remote execution of arbitrary code	CERTFR-2021-ALE-022
CVE-2024-24919	8.6	CHECK POINT	Breach of data confidentiality	CERTFR-2024-ALE-008, CERTFR-2024-AVI-0449

Black Basta’s Leaked Chat Logs

2025-02-28T23:49:13+0000 by Cédric Bonhomme

JSON

Leaked ransomware chat logs reveal Black Basta’s targeted CVEs.

On February 11, 2025, a major leak exposed BLACKBASTA's internal Matrix chat logs. The leaker claimed they released the data because the group was targeting Russian banks. This leak closely resembles the previous Conti leaks.

Cybercrime group focused on Microsoft vulnerabilities as well as flaws in network edge devices and communications software.

We have sightings from MISP and The Shadowserver fundation related to the rejected CVE:

CVE-2024-21683
ghsa-vr88-2hv2-5jvf

Recent bundles

CVE Assigned for the account compromised

Package known to be compromised

Open Source Software Issues