- VulnVerse
- Posts
- Security Week Review - VulnVerse #27
Security Week Review - VulnVerse #27
Marko Živanović
March 17, 2025
Welcome back to VulnVerse! This is our 27th weekly dispatch, packed with the latest vulnerabilities, exploits, and cyber threats. Let's get to it.
Content:
Vulnerabilities and Exploits 🔥
Tomcat's got a hole, CVE-2025-24813. One PUT and boom, root. Exploits are live. If you're running Tomcat, patch. Now.
VMware's bleeding. Zero-days, actively exploited. Patch, or get owned. Seriously. If you're on VMware, you're a target.
SolarWinds, still taking hits. Weak crypto key management, critical vulnerability. Exploit details, damage potential. Patch, or data's wide open.
Laravel's debug mode? XSS party. Exploit details, damage potential. Patch, and kill debug mode in prod.
Apache Camel, new CVE PoC. Exploit demonstrated. Review and patch, or get rekt.
Moxa switches, critical hole. Admin access, easy. Risks and damage potential? High. Patch, or you're toast.
WooCommerce plugin, Husky Products Filter Professional, LFI. Unauthenticated. Exploit details, damage potential. Update the plugin, or your site gets owned.
Facebook advisory, CVE-2025-27363. Vulnerability details, impact potential. Review, patch, or face the consequences.
Cisco IOS XR, BGP DoS. Exploit details, impact potential. If you're on IOS XR, patch, or go down.
Palo Alto Networks, four new holes. Vulnerability details, impact potential.
Japan's under siege. Persistent attacks, stealthy tactics. Increased vigilance is a must. If you're in Japan, you're in the crosshairs.
XXE, made "impossible," still exploitable. Security bypass tricks. Learn them, or get owned.
SAML SSO bypass, sign in as anyone. Parser differentials, subtle exploits. Exploit details, damage potential. If you're on SAML, pay attention.
Reply