Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.23.0), Mendix Studio Pro 10.12 (All versions < V10.12.17), Mendix Studio Pro 10.18 (All versions < V10.18.7), Mendix Studio Pro 10.6 (All versions < V10.6.24), Mendix Studio Pro 11 (All versions), Mendix Studio Pro 8 (All versions < V8.18.35), Mendix Studio Pro 9 (All versions < V9.24.35). A zip path traversal vulnerability exists in the module installation process of Studio Pro. By crafting a malicious module and distributing it via (for example) the Mendix Marketplace, an attacker could write or modify arbitrary files in directories outside a developer’s project directory upon module installation.

CVE-2025-40592 is a path traversal vulnerability identified in Siemens Mendix Studio Pro 10 and several other versions of Mendix Studio Pro (including versions 8, 9, 10, and 11). The vulnerability arises during the module installation process, where the software improperly limits pathname inputs when extracting zip archives. Specifically, a maliciously crafted module distributed, for example, via the Mendix Marketplace, can exploit this flaw to write or modify arbitrary files outside the intended project directory. This occurs because the path traversal allows directory traversal sequences (e.g., "../") within the zip archive to escape the restricted directory sandbox. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS 3.1 base score is 6.1, indicating a medium severity level. The vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) shows that the attack can be performed remotely over the network without privileges but requires user interaction (installing the malicious module). The impact is high on integrity, as arbitrary files can be overwritten or created, potentially leading to code execution or tampering with project files, but there is no direct impact on confidentiality or availability. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable software boundary. No known exploits are currently in the wild, and no patches are linked yet, indicating that mitigation relies on cautious module installation and monitoring. This vulnerability affects all Mendix Studio Pro versions prior to the specified fixed versions (e.g., <10.23.0 for version 10).

Detailed information about CVE-2025-40592: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Siemens Mendix Studio Pro 1

CVE-2025-40592: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Siemens Mendix Studio Pro 10 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40592: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Siemens Mendix Studio Pro 10

Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.

CVE-2025-35978 is a high-severity vulnerability affecting Fujitsu Client Computing Limited's UpdateNavi software, specifically versions V1.4 L10 through L33 and the UpdateNaviInstallService Service versions 1.2.0091 to 1.2.0125. The vulnerability arises from improper restriction of communication channels to intended endpoints within the UpdateNavi update mechanism. This flaw allows a local authenticated attacker to send crafted malicious data through these communication channels, which can lead to unauthorized modification of arbitrary registry values or execution of arbitrary code on the affected system. The vulnerability does not require user interaction but does require local authentication, meaning the attacker must have some level of access to the system. The CVSS v3.0 score is 7.1, reflecting a high severity due to the potential for integrity and availability impacts without compromising confidentiality. The exploitation vector is local (AV:L), with low attack complexity (AC:L), and privileges required are low (PR:L). The scope remains unchanged (S:U), indicating the vulnerability affects only the vulnerable component and does not extend to other system components. The lack of known exploits in the wild suggests this vulnerability has not yet been actively exploited, but the potential impact remains significant given the ability to execute arbitrary code and modify critical registry settings. The vulnerability is particularly concerning because registry modifications can persist across reboots and may be leveraged to establish persistence or disable security controls, while arbitrary code execution can lead to full system compromise within the privileges of the UpdateNavi service or user context. UpdateNavi is a utility used primarily on Fujitsu client computing devices to manage system updates, making this vulnerability relevant to organizations using Fujitsu hardware and software management tools.

Detailed information about CVE-2025-35978: Improper restriction of communication channel to intended endpoints in Fujitsu Client Computing Limited UpdateNavi af

CVE-2025-35978: Improper restriction of communication channel to intended endpoints in Fujitsu Client Computing Limited UpdateNavi - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-35978: Improper restriction of communication channel to intended endpoints in Fujitsu Client Computing Limited UpdateNavi

SmartAttack uses smartwatches to steal data from air-gapped systems

Source: https://www.bleepingcomputer.com/news/security/smartattack-uses-smartwatches-to-steal-data-from-air-gapped-systems/

SmartAttack represents a novel and sophisticated cyber-espionage technique that leverages smartwatches as covert channels to exfiltrate data from air-gapped systems. Air-gapped systems are physically isolated from unsecured networks, including the internet, to protect highly sensitive information. Traditional cybersecurity measures assume these systems are secure due to their isolation. However, SmartAttack circumvents this by exploiting the wireless communication capabilities of smartwatches worn by personnel who have physical proximity to these secure environments. The attack likely involves malware or malicious code implanted on the air-gapped system that encodes sensitive data into signals or vibrations detectable by the smartwatch sensors. Alternatively, the smartwatch could be used to receive data transmitted via subtle electromagnetic or acoustic signals emitted by the air-gapped device. Once the smartwatch collects the data, it can relay it to an external attacker through its internet connection or paired smartphone. This attack vector is particularly insidious because it exploits the human factor and trusted devices rather than network vulnerabilities. The technical details are limited, but the attack does not require network connectivity of the air-gapped system itself, making traditional network-based defenses ineffective. The lack of known exploits in the wild suggests this is an emerging threat, but its high severity rating indicates significant potential impact. The attack requires physical proximity and the presence of compromised or malicious smartwatches, implying a targeted approach rather than broad opportunistic attacks.

Detailed information about SmartAttack uses smartwatches to steal data from air-gapped systems. Get real-time updates, technical details, and mitigation strateg

SmartAttack uses smartwatches to steal data from air-gapped systems - Live Threat Intelligence - Threat Radar | OffSeq.com

SmartAttack uses smartwatches to steal data from air-gapped systems

Reddit Discussion: SmartAttack uses smartwatches to steal data from air-gapped systems

Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. This vulnerability is fixed in 0.51.0.

CVE-2025-49150 is a medium-severity vulnerability affecting versions of the Cursor code editor prior to 0.51.0. Cursor is an AI-assisted programming editor that supports editing JSON files among other features. The vulnerability arises from the default configuration setting json.schemaDownload.enable being set to True before version 0.51.0. This setting allows the editor to automatically perform HTTP GET requests to download JSON schemas without requiring user confirmation. An attacker who can write or manipulate JSON files—potentially via a prior prompt injection attack on the Cursor Agent—can exploit this behavior to trigger arbitrary HTTP GET requests to attacker-controlled URLs. Since the Cursor Agent can edit JSON files, a malicious agent could craft JSON content that causes the editor to send sensitive data to an external server without user interaction or authentication. This results in an exposure of sensitive information (CWE-200) to unauthorized actors. The vulnerability does not affect integrity or availability but poses a confidentiality risk. The CVSS v3.1 base score is 5.9 (medium), with the vector indicating network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N/A:N). No known exploits are reported in the wild, and the issue is fixed in Cursor version 0.51.0 by disabling or securing the json.schemaDownload.enable setting by default. This vulnerability is particularly relevant in environments where Cursor is used with AI agents that can modify JSON files, as it enables data exfiltration through crafted JSON schemas triggering HTTP requests without user consent.

Detailed information about CVE-2025-49150: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in getcursor cursor affecting getcursor cursor. G

CVE-2025-49150: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in getcursor cursor - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49150: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in getcursor cursor

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

CVE-2025-0913 is a vulnerability identified in the Go standard library's syscall package, specifically related to the os.OpenFile function behavior when handling symbolic links (symlinks) with the O_CREATE and O_EXCL flags. The issue arises from inconsistent handling of dangling symlinks between Unix and Windows platforms. On Unix systems, when os.OpenFile is called with O_CREATE|O_EXCL flags on a path that is a dangling symlink (a symlink pointing to a nonexistent target), the function correctly does not follow the symlink and returns an error, preventing unintended file creation. However, on Windows, the same call would follow the symlink and create a new file at the symlink's target location if it did not exist, potentially leading to unexpected file creation in locations controlled by the attacker. This behavior constitutes an improper link resolution vulnerability (CWE-59), which can be exploited to bypass file creation restrictions or cause files to be created in unintended locations, potentially leading to privilege escalation, data corruption, or security policy violations. The Go standard library has since been updated to unify the behavior across platforms by making os.OpenFile return an error when both O_CREATE and O_EXCL flags are set and the target path is a symlink, thus preventing the creation of files through dangling symlinks on Windows as well. The affected versions include all Go versions prior to 1.24.0-0. No known exploits are currently reported in the wild. This vulnerability primarily affects applications written in Go that rely on os.OpenFile for secure file creation, especially those that operate cross-platform or handle untrusted file paths.

Detailed information about CVE-2025-0913: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Go standard library syscall affecting Go sta

CVE-2025-0913: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Go standard library syscall - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-0913: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Go standard library syscall

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

CVE-2025-4673 is a vulnerability identified in the Go standard library's net/http package, affecting all versions up to 1.24.0-0. The issue involves the improper handling of Proxy-Authorization and Proxy-Authenticate HTTP headers during cross-origin redirects. Specifically, these sensitive headers, which typically contain credentials used for proxy authentication, are inadvertently persisted and sent along with redirected requests to different origins. This behavior can lead to the leakage of sensitive authentication information to unintended third-party servers. The vulnerability is classified under CWE-201, which refers to the insertion of sensitive information into sent data, highlighting the risk of exposing confidential credentials through network communication. Since the Go net/http library is widely used for HTTP client and server implementations in various applications and services, this flaw could impact a broad range of software that relies on Go for HTTP communications. The vulnerability does not require user interaction or authentication to be exploited, as it stems from the automatic handling of HTTP redirects by the library. No known exploits are reported in the wild as of the publication date, and no official patches have been released yet. However, the issue poses a significant risk of credential leakage in environments where proxy authentication is used and cross-origin redirects occur, potentially enabling attackers to capture sensitive proxy credentials and use them for unauthorized access or further attacks.

Detailed information about CVE-2025-4673: CWE-201: Insertion of Sensitive Information Into Sent Data in Go standard library net/http affecting Go standard libra

CVE-2025-4673: CWE-201: Insertion of Sensitive Information Into Sent Data in Go standard library net/http - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4673: CWE-201: Insertion of Sensitive Information Into Sent Data in Go standard library net/http

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

CVE-2025-22874 is a vulnerability identified in the Go standard library's crypto/x509 package, specifically related to improper certificate validation (CWE-295). The issue arises when the Verify function is called with VerifyOptions.KeyUsages containing ExtKeyUsageAny. Under these conditions, the policy validation step is unintentionally disabled for certificate chains that include policy graphs. Certificate policy graphs are a mechanism used in X.509 certificates to specify the policies under which a certificate is considered valid. While such policy graphs are uncommon, their presence is critical in environments requiring strict certificate policy enforcement. The flaw means that when ExtKeyUsageAny is specified, the verification process does not enforce the intended certificate policies, potentially allowing certificates that do not meet the required policy constraints to be accepted as valid. This could lead to acceptance of certificates that should otherwise be rejected, undermining the trust model of TLS or other cryptographic protocols relying on Go's crypto/x509 package for certificate validation. The affected versions include Go standard library versions from 0 up to 1.24.0-0. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The vulnerability was published on June 11, 2025, and was reserved earlier in January 2025. The absence of patch links suggests that fixes may be pending or not yet widely disseminated at the time of this report.

Detailed information about CVE-2025-22874: CWE-295: Improper Certificate Validation in Go standard library crypto/x509 affecting Go standard library crypto/x509

CVE-2025-22874: CWE-295: Improper Certificate Validation in Go standard library crypto/x509 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-22874: CWE-295: Improper Certificate Validation in Go standard library crypto/x509

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow.

CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

CVE-2025-40914 is a critical vulnerability identified in the Perl CryptX library prior to version 0.087. The root cause of this vulnerability lies in CryptX's embedded dependency on a specific version of the libtommath library, which itself is susceptible to an integer overflow vulnerability previously cataloged as CVE-2023-36328. Integer overflow vulnerabilities occur when an arithmetic operation attempts to create a numeric value that is outside the range that can be represented with a given number of bits, potentially leading to memory corruption, buffer overflows, or other unintended behaviors. In this case, the overflow within libtommath can be triggered during cryptographic operations performed by CryptX, which is a Perl module widely used for cryptographic functions such as encryption, decryption, hashing, and digital signatures. The vulnerability is exploitable remotely without requiring authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact is severe, affecting confidentiality, integrity, and availability (C:H/I:H/A:H), meaning an attacker could execute arbitrary code, cause denial of service, or compromise sensitive cryptographic operations. Although no known exploits are currently reported in the wild, the high CVSS score of 9.8 underscores the critical nature of this vulnerability. The affected version explicitly mentioned is 0.002, and the issue is resolved in versions 0.087 and later. The vulnerability is classified under CWE-1395, which relates to dependency on vulnerable third-party components, emphasizing the risk of inherited vulnerabilities through embedded libraries. This highlights the importance of supply chain security and timely updates of dependencies in cryptographic software.

Detailed information about CVE-2025-40914: CWE-1395 Dependency on Vulnerable Third-Party Component in MIK CryptX affecting MIK CryptX. Get real-time updates, te

CVE-2025-40914: CWE-1395 Dependency on Vulnerable Third-Party Component in MIK CryptX - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40914: CWE-1395 Dependency on Vulnerable Third-Party Component in MIK CryptX

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

CVE-2025-4922 is a high-severity vulnerability affecting HashiCorp Nomad, a widely used workload orchestrator for deploying and managing containerized and non-containerized applications. The vulnerability arises from an incorrect privilege assignment due to a flaw in the prefix-based Access Control List (ACL) policy lookup mechanism. Specifically, the ACL system in Nomad Community and Enterprise editions incorrectly applies rules because of prefix matching logic, which can cause rule shadowing. This means that some ACL rules may be bypassed or overridden unintentionally, leading to improper privilege assignments. As a result, users with limited privileges might gain unauthorized access to resources or perform actions beyond their intended permissions. The vulnerability affects Nomad versions starting from 1.4.0 and was addressed in Nomad Community Edition 1.10.2 and Nomad Enterprise versions 1.8.14, 1.9.10, and 1.10.2. The CVSS v3.1 score is 8.1, indicating a high severity level. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) shows that the vulnerability can be exploited remotely over the network with low attack complexity, requires low privileges but no user interaction, and impacts confidentiality and integrity significantly, though availability is not affected. No known exploits are currently reported in the wild. The root cause is classified under CWE-266 (Incorrect Privilege Assignment), highlighting a fundamental security design flaw in the ACL implementation. This vulnerability can lead to unauthorized data access or modification within Nomad-managed environments, potentially compromising sensitive workloads and configurations.

Detailed information about CVE-2025-4922: CWE-266: Incorrect Privilege Assignment in HashiCorp Nomad affecting HashiCorp Nomad. Get real-time updates, technical

CVE-2025-4922: CWE-266: Incorrect Privilege Assignment in HashiCorp Nomad - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4922: CWE-266: Incorrect Privilege Assignment in HashiCorp Nomad

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.
*This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).

CVE-2025-5687 is a local privilege escalation vulnerability affecting Mozilla VPN clients on macOS, specifically versions 2.28.0 and earlier. This vulnerability allows a local attacker with normal user privileges to escalate their privileges to root, effectively gaining full administrative control over the affected system. The issue is confined to the macOS platform and does not impact Mozilla VPN clients on other operating systems. The vulnerability arises from improper handling of privilege boundaries within the Mozilla VPN client software, potentially due to insecure execution of privileged operations or inadequate validation of user inputs or permissions. Exploiting this flaw requires local access to the machine, meaning an attacker must already have a foothold as a standard user. There are no known exploits in the wild at the time of publication, and no official patches or mitigation links have been provided yet. The absence of a CVSS score suggests that the vulnerability is newly disclosed and under evaluation. However, the ability to escalate privileges to root on a macOS system is a significant security risk, as it compromises the confidentiality, integrity, and availability of the system and any data or services running on it. Given that Mozilla VPN is used to secure network traffic, an attacker gaining root access could also manipulate VPN configurations, intercept or redirect traffic, or disable security controls, further exacerbating the threat.

Detailed information about CVE-2025-5687: Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. in Mozilla Mozilla VPN 2.

CVE-2025-5687: Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. in Mozilla Mozilla VPN 2.28.0 - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Affecting Finland

Filter Threats

Threats Affecting Finland