CyberDanube Security Research 20251215-0 | Multiple Vulnerabilities in Phoenix Contact FL Switch Series

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Dec 17

CyberDanube Security Research 20251215-0
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| FL Switch
vulnerable version| 3.40
fixed version| TODO
CVE number| CVE-2025-41692, CVE-2025-41693, CVE-2025-41694,
| CVE-2025-41695, CVE-2025-41696, CVE-2025-41697,
| CVE-2025-41745,...

[KIS-2025-09] Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection Vulnerability

Posted by Egidio Romano on Dec 17

------------------------------------------------------------------------------------
Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection
Vulnerability
------------------------------------------------------------------------------------

[-] Software Link:

https://control-webpanel.com

[-] Affected Versions:

Version 0.9.8.1208 and prior versions.

[-] Vulnerability Description:

User input passed via the "key" GET...

Raydium CP Swap: Unchecked Account Allows Creator Fee Hijacking

Posted by LRKTBEYK LRKTBEYK on Dec 17

I tried to report these vulnerabilities to ImmuneFi, but they closed it
(report 62070) as "out of scope." I believe them when they tell me
something is out of scope, so now it's public.

https://github.com/raydium-io/raydium-cp-swap/pull/62

These vulnerabilities collectively enable fee theft, creator fee hijacking,
and potential user exploitation through uncapped fee rates. Issue #3 allows
attackers to steal all creator fees from...

[CFP] Security BSidesLjubljana 0x7EA | March 13, 2026

Posted by Andraz Sraka on Dec 17

MMMMMMMMMMMMMMMMNmddmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMN..-..--+MMNy:...-.-/yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMy..ymd-.:Mm::-:osyo-..-mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MM:..---.:dM/..+NNyyMN/..:MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
Mm../dds.-oy.-.dMh--mMds++MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
My:::::/ydMmo..-hMMMmo//omMs/+Mm+++++shNMN+//+//+oMNy+///ohM
MMMs//yMNo+hMh---m:-:hy+sMN..+Mo..os+.-:Ny--ossssdN-.:yyo+mM...

[KIS-2025-08] 1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability

Posted by Egidio Romano on Dec 15

------------------------------------------------------------------------------
1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability
------------------------------------------------------------------------------

[-] Software Link:

https://www.1c-bitrix.ru

[-] Affected Versions:

Version 25.100.500 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate...

[KIS-2025-07] Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability

Posted by Egidio Romano on Dec 15

-----------------------------------------------------------------------------
Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability
-----------------------------------------------------------------------------

[-] Software Link:

https://www.bitrix24.com

[-] Affected Versions:

Version 25.100.300 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate Module",...

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was identified Cross-Site Request Forgery (CSRF) vulnerability on the "Run now" button of Schedule tasks
functionality. Exploiting this vulnerability, an attacker can run a scheduled task without the victim users consent or
knowledge.

Assigned CVE code:
      > CVE-2025-65593

[Discoverer]
      > AlterSec t/a PenTest.NZ

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that multiple Stored Cross-Site Scripting (Stored XSS) vulnerabilities in the product
management functionality. Malicious JavaScript payloads inserted into the "Product Name" and "Short Description" fields
are stored in the backend database and executed automatically whenever a user (administrator or customer) views the
affected pages.

Assigned CVE code:
    ...

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that a Stored XSS vulnerability on the "Currencies" functionality, specifically on the
following input field: "Configuration > Currencies > Edit one of the currencies > "Custom formatting" input field.
After saving the payload, the vulnerability can be triggered by visiting the following pages:
- Bestsellers,
- "Sales" > "Orders"...

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that a Stored XSS vulnerability in the "Content Management" > "Blog posts" area. Malicious
HTML/JavaScript added to the Body overview field of a blog post is stored in the backend and executes when the blog
page is visited (http://localhost/blog/)

Assigned CVE code:
     > CVE-2025-65590

[Discoverer]
      > AlterSec t/a PenTest.NZ

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that a Stored XSS vulnerability in the Attributes management workflow. An attacker can insert
JavaScript into the Name field when adding a new Attribute Group (Catalog > Attributes > Specification attributes > Add
Group > Name input field). To exploit the vulnerability, privileged users should visit the "Specification attributes
page.

Assigned CVE code:
    >...

Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Posted by Yuffie Kisaragi via Fulldisclosure on Dec 15

UPDATE:

The reported vulnerabilities have now been assigned CVE identifiers:
CVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411
[https://www.cve.org/cverecord?id=CVE-2025-34411]
CVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412
[https://www.cve.org/cverecord?id=CVE-2025-34412]

APPLE-SA-12-12-2025-9 Safari 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-9 Safari 26.2

Safari 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125892.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Safari
Available for: macOS Sonoma and macOS Sequoia
Impact: On a Mac with Lockdown Mode enabled, web content opened via a
file URL may...

APPLE-SA-12-12-2025-8 visionOS 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-8 visionOS 26.2

visionOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125891.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive payment tokens
Description: A...

APPLE-SA-12-12-2025-7 watchOS 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-7 watchOS 26.2

watchOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125890.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: Apple Watch Series 6 and later
Impact: An app may be able to access sensitive payment tokens
Description: A...

APPLE-SA-12-12-2025-6 tvOS 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-6 tvOS 26.2

tvOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125889.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a file may lead to memory corruption
Description: The...

APPLE-SA-12-12-2025-5 macOS Sonoma 14.8.3

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-5 macOS Sonoma 14.8.3

macOS Sonoma 14.8.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125888.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: macOS Sonoma
Impact: Processing a file may lead to memory corruption
Description: The issue was...

APPLE-SA-12-12-2025-4 macOS Sequoia 15.7.3

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-4 macOS Sequoia 15.7.3

macOS Sequoia 15.7.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125887.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: macOS Sequoia
Impact: Processing a file may lead to memory corruption
Description: The issue...

APPLE-SA-12-12-2025-3 macOS Tahoe 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-3 macOS Tahoe 26.2

macOS Tahoe 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125886.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: macOS Tahoe
Impact: An app may be able to access sensitive payment tokens
Description: A permissions...

Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Posted by Yuffie Kisaragi via Fulldisclosure on Dec 05

Advisory ID: CONVERCENT-2025-001
Title: Multiple Security Misconfigurations and Customer Enumeration Exposure in
Convercent Whistleblowing Platform (EQS Group)
Date: 2025-12-04
Vendor: EQS Group
Product: Convercent Whistleblowing Platform (app.convercent.com)
Severity: Critical
CVSS v4.0 Base Score: 9.3
Vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

A series of security weaknesses were identified in the Convercent...

8 vulnerabilities in AudioCodes Fax/IVR Appliance

Posted by Pierre Kim on Dec 01

## Advisory Information

Title: 8 vulnerabilities in AudioCodes Fax/IVR Appliance
Advisory URL: https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt
Blog URL: https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html
Date published: 2025-11-20
Vendors contacted: Audiocodes
Release mode: Released
CVE: CVE-2025-34328, CVE-2025-34329, CVE-2025-34330, CVE-2025-34331,
CVE-2025-34332, CVE-2025-34333,...

2 vulnerabilities in Egovframe

Posted by Pierre Kim on Dec 01

## Advisory Information

Title: 2 vulnerabilities in Egovframe
Advisory URL: https://pierrekim.github.io/advisories/2025-egovframe.txt
Blog URL: https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html
Date published: 2025-11-20
Vendors contacted: KISA/KrCERT
Release mode: Released
CVE: CVE-2025-34336, CVE-2025-34337

## Product description

Egovframe is a Java-based framework mainly used in the websites of the
Government of...

[REVIVE-SA-2025-005] Revive Adserver Vulnerability

Posted by Matteo Beccati on Dec 01

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-005
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-005
------------------------------------------------------------------------
Date: 2025-11-26
Risk Level: Medium
Applications affected: Revive...

Missing Critical Security Headers in Legality WHISTLEBLOWING

Posted by Aerith Gainsborough via Fulldisclosure on Dec 01

Advisory ID: LEGALITYWHISTLEBLOWING-2025-001
Title: Missing Critical Security Headers in Legality WHISTLEBLOWING
Date: 2025-11-29
Vendor: DigitalPA (segnalazioni.net)
Severity: High
CVSS v3.1 Base Score: 8.2 (High)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Summary:

Multiple public deployments of Legality WHISTLEBLOWING by DigitalPA
are missing essential HTTP security headers.
This misconfiguration exposes users to client-side attacks...

[REVIVE-SA-2025-004] Revive Adserver Vulnerabilities

Posted by Matteo Beccati on Nov 19

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-004
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-004
------------------------------------------------------------------------
Date: 2025-11-19
Risk Level: Medium
Applications affected: Revive...

[REVIVE-SA-2025-003] Revive Adserver Vulnerabilities

Posted by Matteo Beccati on Nov 19

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-003
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-003
------------------------------------------------------------------------
Date: 2025-11-05
Risk Level: High
Applications affected: Revive...

[SYSS-2025-059]: Dell computer UEFI boot protection bypass

Posted by Micha Borrmann via Fulldisclosure on Nov 19

Advisory ID: SYSS-2025-059
Product: Dell computer
Manufacturer: Dell
Affected Version(s): Probably all Dell computers
Tested Version(s): Latitude 5431 (BIOS 1.33.1),
Latitude 7320 (BIOS 1.44.1),
Latitude 7400 (BIOS 1.41.1),
Latitude 7480 (BIOS 1.41.3),
Latitude 9430 (BIOS...

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Patrick via Fulldisclosure on Nov 13

Hello Jan,

You are completely right and it’s something I warned about early, which is abuse of AI-generated sensationalized
headline and fake PoC-s, for fame.

I urge the Full Disclosure staff to look into it.

Discussions with the individual responsible seem to be fruitless, and this likely constitutes abuse of this mailing
list.

Sent from Proton Mail for iOS.

-------- Original Message --------

I looked at few repos and posts of...

APPLE-SA-11-13-2025-1 Compressor 4.11.1

Posted by Apple Product Security via Fulldisclosure on Nov 13

APPLE-SA-11-13-2025-1 Compressor 4.11.1

Compressor 4.11.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125693.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Compressor
Available for: macOS Sequoia 15.6 and later
Impact: An unauthenticated user on the same network as a Compressor...

Re: 83 vulnerabilities in Vasion Print / PrinterLogic

Posted by Pierre Kim on Nov 13

No message preview for long message of 668188 bytes.

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Joseph Goydish II via Fulldisclosure on Nov 07

Hey Patrick, I understand the doubt.

However… what’s not slop is reproducible logs I provided a video of and the testable, working exploit I provided.

Neither is the upstream patches that can be tracked from the disclosure dates to the cve’s listed in the report.

The exploit was caught in the wild, reversed engineered via log analysis and the logs provided are simply observed
behavior. Please feel free to independently test the...

Re: : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Jan Schermer on Nov 07

I looked at few repos and posts of "Joseph Goydish".
It all seems to be thinly veiled AI slop and BS.
Cited vulns are not attributed to him really and those chains don’t make a lot of sense. Screen recordings look
suspicious, some versions reference High Sierra for some reason (but I can’t find those bits now).

I invite anyone to look at his GH repos and scroll through commit history.
Does this make any sense?...

runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881

Posted by Aleksa Sarai via Fulldisclosure on Nov 07

| NOTE: This advisory was sent to <security-announce () opencontainers org>
| on 2025-10-16. If you ship any Open Container Initiative software, we
| highly recommend that you subscribe to our security-announce list in
| order to receive more timely disclosures of future security issues.
| The procedure for subscribing to security-announce is outlined here:
| <...

OXAS-ADV-2025-0002: OX App Suite Security Advisory

Posted by Martin Heiland via Fulldisclosure on Nov 07

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at
https://documentation.open-xchange.com/appsuite/security/advisories/html/2025/oxas-adv-2025-0002.html.

Yours sincerely,
Martin Heiland, Open-Xchange...

APPLE-SA-11-05-2025-1 iOS 18.7.2 and iPadOS 18.7.2

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-05-2025-1 iOS 18.7.2 and iPadOS 18.7.2

iOS 18.7.2 and iPadOS 18.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125633.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch
3rd generation...

APPLE-SA-11-03-2025-9 Xcode 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-9 Xcode 26.1

Xcode 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125641.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

GNU
Available for: macOS Sequoia 15.6 and later
Impact: Processing a maliciously crafted file may lead to heap
corruption
Description: An...

APPLE-SA-11-03-2025-8 Safari 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-8 Safari 26.1

Safari 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125640.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Safari
Available for: macOS Sonoma and macOS Sequoia
Impact: Visiting a malicious website may lead to address bar spoofing
Description:...

APPLE-SA-11-03-2025-7 visionOS 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-7 visionOS 26.1

visionOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125638.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Account
Available for: Apple Vision Pro (all models)
Impact: A malicious app may be able to take a screenshot of sensitive...

APPLE-SA-11-03-2025-6 watchOS 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-6 watchOS 26.1

watchOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125639.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Account
Available for: Apple Watch Series 6 and later
Impact: A malicious app may be able to take a screenshot of sensitive...

APPLE-SA-11-03-2025-5 tvOS 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-5 tvOS 26.1

tvOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125637.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: Apple TV 4K (2nd generation and later)
Impact: An app may be able to cause unexpected system termination...

APPLE-SA-11-03-2025-4 macOS Sonoma 14.8.2

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-4 macOS Sonoma 14.8.2

macOS Sonoma 14.8.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125636.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Admin Framework
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: A...

APPLE-SA-11-03-2025-3 macOS Sequoia 15.7.2

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-3 macOS Sequoia 15.7.2

macOS Sequoia 15.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125635.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Admin Framework
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: A...

APPLE-SA-11-03-2025-2 macOS Tahoe 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-2 macOS Tahoe 26.1

macOS Tahoe 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125634.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Admin Framework
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: The issue was...

APPLE-SA-11-03-2025-1 iOS 26.1 and iPadOS 26.1

Posted by Apple Product Security via Fulldisclosure on Nov 07

APPLE-SA-11-03-2025-1 iOS 26.1 and iPadOS 26.1

iOS 26.1 and iPadOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125632.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro...

Re: [oss-security] runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881

Posted by akendo () akendo eu on Nov 07

Thank you for sharing this. I wondered how big the impact of this vulnerability is when you have only the ability to
access runs via the Kubernetes API? Would you argue that the vulnerability becomes harder (or impossible?) to exploit
when you can only interact with the service via another API?

In my current understanding of the vulnerabilities, it seems like you need to be able to interact with runs directly.

Furthermore, the ability to...

SEC Consult SA-20251029-0 :: Unprotected NFC card manipulation leading to free top-up in GiroWeb Cashless Catering Solutions (only legacy customer infrastructure)

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 29

SEC Consult Vulnerability Lab Security Advisory < 20251029-0 >
=======================================================================
title: Unprotected NFC card manipulation leading to free top-up
product: GiroWeb Cashless Catering Solutions
vulnerable version: Only legacy customer infrastructure using outdated
Legic Prime or other insecure NFC cards
fixed version: -
CVE...

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by josephgoyd via Fulldisclosure on Oct 29

The exploit I caught in the wild and the flow of the attack chain are in this repo:
https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201

The report was constructed via log analysis.

-------- Original Message --------

It seems, the whole account is down

Re: : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Christoph Gruber on Oct 29

It seems, the whole account is down

Dovecot CVE-2025-30189: Auth cache causes access to wrong account

Posted by Aki Tuomi via Fulldisclosure on Oct 29

Affected product: Dovecot IMAP Server
Internal reference: DOV-7830
Vulnerability type: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)
Vulnerable version: 2.4.0, 2.4.1
Vulnerable component: auth
Report confidence: Confirmed
Solution status: Fixed in 2.4.2
Researcher credits: Erik <erik () broadlux com>
Vendor notification: 2025-07-25
CVE reference: CVE-2025-30189
CVSS: 7.4...

SEC Consult SA-20251027-0 :: Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System #CVE-2025-12055

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 28

SEC Consult Vulnerability Lab Security Advisory < 20251027-0 >
=======================================================================
title: Unauthenticated Local File Disclosure
product: MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing
Execution System
vulnerable version: 10.14.STD, MIP 2 / FEDRA 2 / HYDRA X with Servicepack 8
Maintenance versions until week...

Stored Cross-Site Scripting (XSS) via SVG File Upload - totaljsv5013

Posted by Andrey Stoykov on Oct 28

# Exploit Title: Stored Cross-Site Scripting (XSS) via SVG File Upload -
totaljsv5013
# Date: 10/2025
# Exploit Author: Andrey Stoykov
# Version: 5013
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/10/friday-fun-pentest-series-46-stored.html

Stored Cross-Site Scripting (XSS) via SVG File Upload:

Steps to Reproduce:
1. Login with user and visit "Layouts"
2. Visit "Files" and click "Upload"
3....

Stored HTML Injection - Layout Functionality - totaljsv5013

Posted by Andrey Stoykov on Oct 28

# Exploit Title: Stored HTML Injection - Layout Functionality - totaljsv5013
# Date: 10/2025
# Exploit Author: Andrey Stoykov
# Version: 5013
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/10/friday-fun-pentest-series-45-stored.html

Stored HTML Injection - Layout Functionality:

Steps to Reproduce:
1. Login with user and visit "Layouts"
2. Click on "Create" and enter name for the layout
3. Trap the HTTP...

Stored Cross-Site Scripting (XSS) - Layout Functionality - totaljsv5013

Posted by Andrey Stoykov on Oct 28

# Exploit Title: Stored Cross-Site Scripting (XSS) - Layout Functionality -
totaljsv5013
# Date: 10/2025
# Exploit Author: Andrey Stoykov
# Version: 5013
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/10/friday-fun-pentest-series-44-stored.html

Stored Cross-Site Scripting (XSS) - Layout Functionality:

Steps to Reproduce:
1. Login with user and visit "Layouts"
2. Click on "Create" and enter name for the...

Current Password not Required When Changing Password - totaljsv5013

Posted by Andrey Stoykov on Oct 28

# Exploit Title: Current Password not Required When Changing Password -
totaljsv5013
# Date: 10/2025
# Exploit Author: Andrey Stoykov
# Version: 5013
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/10/friday-fun-pentest-series-43-current.html

Current Password not Required When Changing Password:

Steps to Reproduce:
1. Login with user and click on profile icon
2. Select "Change Credentials"
3. The user would not be...

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Noor Christensen on Oct 28

Hi Joseph,

Looks like your post with the technical details is down; I'm getting a 404 since
yesterday.

-- kchr

Struts2 and Related Framework Array/Collection DoS

Posted by Daniel Owens via Fulldisclosure on Oct 28

Struts2 has, since its inception and to today, contained a significant denial of service (DoS) vulnerability stemming
from how the Struts2 default deserialiser parses and deserialises arrays, collections (including maps), and related
objects. Specifically, Struts2 and related frameworks allow attackers to specify indices and adhere to the
user-supplied indices such that attackers can make arbitrarily large data structures with extremely tiny...

[REVIVE-SA-2025-002] Revive Adserver Vulnerability

Posted by Matteo Beccati on Oct 25

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-002
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-002
------------------------------------------------------------------------
Date: 2025-10-24
Risk Level: High
Applications affected: Revive...

[REVIVE-SA-2025-001] Revive Adserver Vulnerability

Posted by Matteo Beccati on Oct 25

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-001
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-001
------------------------------------------------------------------------
CVE-ID: CVE-2025-27208
Date: 2025-10-22
Risk Level:...

SEC Consult SA-20251021-0 :: Multiple Vulnerabilities in EfficientLab WorkExaminer Professional (CVE-2025-10639, CVE-2025-10640, CVE-2025-10641)

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 21

SEC Consult Vulnerability Lab Security Advisory < 20251021-0 >
=======================================================================
title: Multiple Vulnerabilities
product: EfficientLab WorkExaminer Professional
vulnerable version: <= 4.0.0.52001
fixed version: -
CVE number: CVE-2025-10639, CVE-2025-10640, CVE-2025-10641
impact: Critical
homepage:...

[SYSS-2025-017]: Verbatim Store 'n' Go Secure Portable HDD (security update v1.0.0.6) - Offline brute-force attack

Posted by Matthias Deeg via Fulldisclosure on Oct 21

Advisory ID: SYSS-2025-017
Product: Store 'n' Go Secure Portable HDD
Manufacturer: Verbatim
Affected Version(s): Part Number #53401 (GD25LK01-3637-C VER4.0)
Tested Version(s): Part Number #53401 (GD25LK01-3637-C VER4.0)
Vulnerability Type: Use of a Cryptographic Primitive with a Risky
Implementation (CWE-1240)
Risk Level: High...