CISCO’s Secure FMC Being Exploited in 0-Day Attack, Targeting Firewalls
Zeroday attack attributed to Interlock ransomware group by CISCO
Continue ReadingSecurity patches
SAP Dec 2025 Security Patch Released, Critical RCE Fixed & DoS Vulnerabilities
Critical and High severity flaws in SAP business software, includes remote code execution, code injection, DoS and other vulnerabilities
Continue Reading
Jenkins Security Patch Fixed HTTP/2 DoS and Permission Issues
Security advisory: Jenkins addressed critical security flaws in its built-in HTTP server related to the handling of HTTP/2 connections, where attackers could overwhelm servers causing denial of service. This mainly impacts Jenkins instances running with HTTP/2 enabled, which is not the default setting.
| Severity | High |
| CVSS Score | 7.7 |
| CVEs | CVE-2025-5115, CVE-2025-59474, CVE-2025-59475, CVE-2025-59476 |
| POC Available | No |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
Jenkins, a popular open-source automation server used for building and deploying software, recently patched several high & medium security flaws.
The high severity issue is a Denial-of-Service (DoS) vulnerability that could allow attackers to overwhelm the server and make it stop working properly even without needing to log in.
Other issues included the risk of unauthorized users viewing sensitive configuration information and the possibility of attackers inserting fake log entries to confuse system administrators. Jenkins released updates to fix these issues and strongly recommends users upgrade to the latest versions to stay protected.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| HTTP/2 Denial of Service in bundled Jetty | CVE-2025-5115 | Jenkins (bundled Jetty) | High | Weekly 2.524+, LTS 2.516.3+ |
| Missing permission check – agent names | CVE-2025-59474 | Jenkins core | Medium | Weekly 2.528+, LTS 2.516.3+ |
| Missing permission check – user profile menu | CVE-2025-59475 | Jenkins core | Medium | Weekly 2.528+, LTS 2.516.3+ |
| Log Message Injection Vulnerability | CVE-2025-59476 | Jenkins core | Medium | Weekly 2.528+, LTS 2.516.3+ |
Technical Summary
Additionally, permission checks in some user interface areas were incomplete, allowing unauthorized users to access sensitive information such as agent names and configuration details.
There was also a vulnerability in log message processing that could let attackers insert misleading entries to confuse administrators. All the issues are fixed in Jenkins latest version.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-5115 | Jenkins instances with embedded Jetty server with HTTP/2 enabled | It causes the Jetty server to repeatedly reset HTTP/2 streams (RST_STREAM) in response to malicious or malformed frames, leading to resource exhaustion and potential denial of service. | Denial of service |
| CVE-2025-59474 | Jenkins automation server | Permission check flaw allowing unauthorized users to view Jenkins agent/executor names via the side panel executor’s widget | Information Disclosure |
| CVE-2025-59475 | Jenkins automation server | Permission check flaw allowing authenticated users without Overall/Read permission to view sensitive configuration details via the Jenkins user profile dropdown menu. | Information Disclosure |
| CVE-2025-59476 | Jenkins automation server | An attacker can inject line breaks into Jenkins log messages, leading to forged or misleading log entries. | Misleading administrators |
Remediation:
- Users should immediately install the latest, patched version of Jenkins on all servers:
- Weekly Release: Update to Jenkins v2.528 or later.
- Long-Term Support (LTS): Update to Jenkins v2.516.3 or later
Here are some recommendations below.
- If immediate upgrade is not possible, users should disable HTTP/2 to mitigate the Denial-of-Service vulnerability.
- Always keep Jenkins core and plugins up to date with the latest security patches.
- Regularly audit and monitor access logs and system activity
Conclusion:
These security flaws could seriously impact Jenkins users, especially those relying on it for continuous integration and deployment. The DoS vulnerability is particularly dangerous because it can be triggered by anyone over the internet, even if they don’t have an account.
Enterprise admins & users should upgrade immediately to the patched versions or disable HTTP/2 to reduce the risk. Keeping Jenkins up to date and following good security practices along with restricting user permissions and monitoring logs is essential to prevent attacks and maintain the stability and safety of software delivery pipelines.
References:
Critical Flaw in FortiSwitch of Fortinet Allows Attackers to Change Admin Password
An unverified password change vulnerability [CWE-620] in FortiSwitch GUI discovered.
This may allow a remote unauthenticated attacker to modify admin passwords via a specially crafted request as per Fortinet advisory released.
Summary
| OEM | Fortinet |
| Severity | CRITICAL |
| CVSS Score | 9.8 |
| CVEs | CVE-2024-48887 |
| Actively Exploited | Yes |
| Exploited in Wild | Yes |
| Advisory Version | 1.0 |
Overview
Fortinet’s FortiSwitch product line has revealed a significant vulnerability noted as CVE-2024-48887. This flaw allows unauthenticated remote attackers to change administrative passwords by sending specially crafted requests to the device’s password management endpoint. With a CVSS score of 9.8, the vulnerability is classified as Critical and is actively being exploited in the wild.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score |
| A unverified password change vulnerability | CVE-2024-48887 | Fortinet | CRITICAL | 9.8 |
Technical Summary
A critical vulnerability (CVE-2024-48887) has been identified in Fortinet FortiSwitch devices, affecting versions 6.4.0 through 7.6.0. This flaw resides in the web-based management interface and allows remote, unauthenticated attackers to change administrator passwords by sending a specially crafted HTTP request to the set_password endpoint.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2024-48887 | FortiSwitch v7.6, 7.4, 7.2, 7.0, 6.4 | CVE-2024-48887 is an unauthenticated password change vulnerability in FortiSwitch web GUI. It enables remote unauthenticated attackers to modify admin passwords through crafted requests to the set_password endpoint. | Unverified Password Change |
Remediation:
- Apply Security Patches: Install the latest security update for your FortiSwitch version. Fortinet has fixed the issue in 6.4.15 and above,7.0.11 and above,7.2.9 and above,7.4.5 and above,7.6.1 and above versions.
General Recommendations
- Update Devices Regularly always install the latest firmware and security patches from Fortinet to fix known vulnerabilities.
- Limit access to the FortiSwitch web GUI to trusted IP addresses and disable HTTP/HTTPS access if it is not required.
- Set strong and unique passwords and change them regularly to prevent unauthorized access.
- Monitor unusual Activity for suspicious logins or configuration changes.
Conclusion:
The CVE-2024-48887 vulnerability poses a serious security risk to organizations using affected FortiSwitch devices. Its ease of exploitation and the lack of authentication required make it particularly dangerous.
Organizations must act immediately by applying the relevant security patches, limiting administrative access, and monitoring for unusual activity.
References:
Update Google Chrome to Fix Critical Remote Code Execution Vulnerability in Lens
| OEM | Google Chrome |
| Severity | High |
| CVSS | 8.8 |
| CVEs | CVE-2025-2476 |
| Exploited in Wild | No |
| Patch/Remediation Available | Yes |
| Advisory Version | 1.0 |
Overview
Google Chrome’s Lens component has been found to have a critical use-after-free vulnerability (CVE-2025-2476) that impacts Linux, Mac, and Windows.
This vulnerability might compromise user systems by enabling remote attackers to run arbitrary code. To lessen the danger, Google has issued security patches.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Use after free Vulnerability | CVE-2025-2476 | Google Chrome | High | 134.0.6998.117/.118 |
Technical Summary
The vulnerability exists due to a use-after-free (UAF) condition in Chrome’s Lens component. This occurs when a program continues to use memory after it has been freed, potentially leading to arbitrary code execution or system compromise. Attackers can exploit this flaw using specially crafted HTML pages that trigger heap corruption.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-2476 | Windows, Mac, Linux | Use-after-free vulnerability in Chrome’s Lens component, leading to heap corruption and potential arbitrary code execution. | Remote code execution |
Remediation:
- Users should immediately update their Google Chrome browser to the latest patched version:
- Open Google Chrome.
- Click the three-dot menu in the upper-right corner.
- Navigate to Help > About Google Chrome.
- Allow Chrome to automatically check for and install the latest update.
- Restart the browser to complete the update process.
- The update will roll out over the coming days and weeks, However, due to the critical nature of this security issue, users should not rely on automatic updates and should manually confirm they are running the latest version.
Google has restricted detailed vulnerability information until a majority of users have applied the fix to prevent potential exploitation.
A vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged-on user.
Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts.
Threat Intelligence :
There are currently no reports of the vulnerability being exploited in the wild.
Conclusion:
The possibility of remote code execution makes CVE-2025-2476 a serious security risk. It is highly recommended that users upgrade their Chrome browsers ASAP.
This vulnerability emphasizes how crucial it is to keep up with security patches on time and to be vigilant about new online threats.
References:
Image
PoC Released for High-Severity Linux Kernel UVC Driver Vulnerability
| OEM | Linux |
| Severity | HIGH |
| CVSS | 7.8 |
| CVEs | CVE-2024-53104 |
| Actively Exploited | Yes |
| Publicly POC Available | Yes |
| Patch/Remediation Available | Yes |
| Advisory Version | 1.0 |
Overview
CVE-2024-53104 is a high-severity out-of-bounds write vulnerability in the Linux kernel’s USB Video Class (UVC) driver, leading to privilege escalation. The issue affects Linux kernel versions 2.6.26 and later. The vulnerability has gained renewed attention as a proof-of-concept (PoC) exploit has now been publicly released, increasing the risk of exploitation. A patch has been released to address this vulnerability, but unpatched systems remain at high risk.
| Vulnerability Name | CVE ID | Product Affected | Severity |
| out-of-bounds write vulnerability | CVE-2024-53104 | Linux Kernel | High |
Technical Summary
The vulnerability exists in the uvc_parse_format function of the UVC driver (uvc_driver.c). It arises due to improper parsing of UVC_VS_UNDEFINED frames, leading to incorrect buffer allocation and out-of-bounds writes.
An attacker could exploit this flaw by inserting a malicious USB device or manipulating video streams, potentially leading to memory corruption, privilege escalation, or arbitrary code execution.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2024-53104 | Linux Kernel (2.6.26 and later) | Incorrect parsing of UVC_VS_UNDEFINED frames in uvc_parse_format, leading to miscalculated buffer sizes and memory corruption. | Privilege escalation, system instability, arbitrary code execution |
Remediation:
- Apply Security Patches: Ensure that the latest security patches provided by the Linux distribution maintainers are promptly applied to mitigate vulnerability.
Recommendations
- Implement USB Device Control Policies: Organizations should establish and enforce USB device control policies to prevent unauthorized usage and ensure only approved devices can be connected.
- Deploy Log Monitoring and Analysis Tools: Implement security monitoring tools to continuously monitor logs for potential security incidents, such as exploitation attempts or suspicious activity.
Conclusion:
CVE-2024-53104 is a major vulnerability that poses a substantial risk to Linux systems since it allows for privilege escalation and arbitrary code execution. Users and administrators are strongly urged to apply the latest security patches to mitigate the risk of exploitation. Additionally, implementing a multi-layered security approach can further enhance system protection.
The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) list, emphasizing the need for immediate remediation.
CISA has ordered federal agencies to secure their systems within three weeks against a high-severity Linux kernel flaw actively exploited in attacks.
References:
- https://cybersecuritynews.com/poc-exploit-linux-kernel-write-vulnerability/
- https://hackyboiz.github.io/2025/03/08/j0ker/2025-03-08/
- https://lore.kernel.org/linux-cve-announce/2024120232-CVE-2024-53104-d781@gregkh/T/
High-Severity SMB Server Flaws (CVE-2024-56626 & CVE-2024-56627) in Linux Kernel
High-Severity SMB Server Flaws (CVE-2024-56626 & CVE-2024-56627) in Linux Kernel
Jordy Zomer, a Security researcher have recently discovered two critical vulnerabilities in KSMBD, the in-kernel SMB server for Linux. These vulnerabilities, CVE-2024-56626 and CVE-2024-56627, could allow attackers to gain control of vulnerable systems.
SUMMARY
| OEM | Linux |
| Severity | High |
| CVSS | 7.8 |
| CVEs | CVE-2024-56626, CVE-2024-56627 |
| Exploited in Wild | No |
| Publicly POC Available | Yes |
| Patch/Remediation Available | Yes |
| Advisory Version | 1.0 |
These vulnerabilities affect Linux kernel versions greater than 5.15 and have been addressed in version 6.13-rc2. Proof-of-concept (PoC) exploits have been publicly released, emphasizing the critical nature of these issues.
| Vulnerability Name | CVE ID | Product Affected | Severity | Affected Version |
| Out-of-bounds write vulnerability in ksmbd. | CVE-2024-56626 | Linux | High | Linux kernel versions greater than 5.15 |
| Out-of-bounds read vulnerability in ksmbd. | CVE-2024-56627 | Linux | High | Linux kernel versions greater than 5.15 |
Technical Summary
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2024-56626 | Linux Kernel | A vulnerability in ksmbd’s ksmbd_vfs_stream_write allowed negative offsets from clients, causing out-of-bounds writes and potential memory corruption. It was triggered when using vfs objects = streams_xattr in ksmbd.conf. The issue has been fixed in recent kernel updates. | Attackers can execute arbitrary code with kernel privileges |
| CVE-2024-56627 | Linux Kernel | A vulnerability in ksmbd’s ksmbd_vfs_stream_write allowed negative client offsets, enabling out-of-bounds writes and potential memory corruption. This issue occurred when the vfs objects = streams_xattr parameter was set in ksmbd.conf and has been resolved in recent kernel updates. | Attackers can read sensitive kernel memory, leading to information disclosure |
Remediation:
- Update: Ensure that the appropriate patches or updates are applied to the relevant versions
listed below
| Version | Fixes and Releases |
| kernel version > 5.15 | kernel version 6.13-rc2 |
Conclusion:
The discovery of CVE-2024-56626 and CVE-2024-56627 highlights critical security flaws in the Linux kernel’s SMB server implementation. Given the availability of proof-of-concept exploits, immediate action is essential to protect systems from potential exploitation. Regularly updating systems and applying security patches are vital practices to maintain a secure environment.
References:
Recent Comments