Tag: 2025-05-21

8 Attack Reports | 124 Vulnerabilities

Attack reports

China-Nexus Threat Actor Actively Exploiting Ivanti Endpoint Manager Mobile (CVE-2025-4428) Vulnerability

A critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) is being actively exploited by a China-nexus threat actor, UNC5221. The exploitation targets internet-facing EPMM deployments across various sectors including healthcare, telecommunications, and government. The attackers utilize unau…
ivanti
sliver
data exfiltration
china-nexus
auto-color
2025-05-21
krustyloader
frp
unauthenticated rce
epmm
CVE-2025-4427
CVE-2025-4428
Published: May 21, 2025
Linked vulnerabilities : CVE-2025-22457 (CVSS 9.0), CVE-2025-31324 (CVSS 10.0), CVE-2025-4428, CVE-2025-4427
Downloadable IOCs: 12

Dero miner spreads inside containerized Linux environments

A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises e…
linux
persistence
cloud
docker
cryptocurrency mining
container security
nginx
2025-05-21
dero
golang malware
port scanning
Published: May 21, 2025
Downloadable IOCs: 3

Lumma Stealer is Out... of business!

A coordinated action led by Microsoft's Digital Crimes Unit, with participation from Bitsight and other partners, has successfully dismantled the operational capabilities of Lumma Stealer (LummaC2), a prominent information stealer operating since late 2022. The operation involved seizing over 1,000…
lummac2
data theft
redline
malware-as-a-service
information stealer
2025-05-21
lummac
infrastructure takedown
multi-tiered c2
Published: May 21, 2025
Downloadable IOCs: 1091

How Adversary Telegram Bots Help to Reveal Threats: Case Study

This analysis examines a phishing campaign targeting Italian and US users, focusing on credential harvesting for Microsoft services and Italy's PEC system. The attackers use Notion workspaces and other cloud platforms to host phishing pages, exfiltrating stolen data via Telegram bots. The campaign,…
phishing
exfiltration
credential harvesting
telegram
2025-05-21
notion
pec
cloud platforms
Published: May 21, 2025
Downloadable IOCs: 16

Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor

Hazy Hawk, a sophisticated threat actor, exploits abandoned cloud resources of high-profile organizations through DNS hijacking. By identifying and taking over dangling CNAME records pointing to unused cloud services, they create malicious URLs on reputable domains. These URLs lead users to scams a…
scams
dns hijacking
traffic distribution systems
2025-05-21
cloud resources
affiliate marketing
push notifications
cname records
Published: May 21, 2025
Downloadable IOCs: 19

Hidden Threats of Dual-Function Malware Found in Chrome Extensions

An unknown threat actor has been creating malicious Chrome browser extensions since February 2024, using fake websites to lure users into installing them. These extensions have dual functionality, appearing to work as intended while also connecting to malicious servers to steal user data and execut…
data theft
code execution
2025-05-21
traffic manipulation
lure websites
chrome extensions
api endpoints
Published: May 21, 2025
Downloadable IOCs: 100

The Sting of Fake Kling: Facebook Malvertising Lures Victims to Fake AI Generation Website

A threat actor has orchestrated a sophisticated malvertising campaign impersonating Kling AI, a popular AI-powered image and video synthesis tool. The attackers use counterfeit Facebook pages and paid ads to drive traffic to a convincing fake website. Users are tricked into downloading malicious fi…
malvertising
infostealer
purehvnc
facebook ads
2025-05-21
crypto theft
Published: May 21, 2025
Downloadable IOCs: 42

Dero miner zombies biting through Docker APIs to build a cryptojacking horde

A new Dero mining campaign exploits insecurely published Docker APIs to spread through containerized Linux environments. The attack uses two Golang malware implants: 'nginx' for propagation and 'cloud' for cryptocurrency mining. The 'nginx' malware scans for vulnerable Docker APIs, creates maliciou…
linux
cloud
exploitation
docker
cryptocurrency mining
nginx
2025-05-21
dero
containerized environments
golang malware
Published: May 21, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-48200

10.0
    Typo3
  • Sr Feuser Register
Published: May 21, 2025

CVE-2025-36535

10.0
    Embedded
  • Web Server
Published: May 21, 2025

CVE-2025-34027

10.0
    Versa
  • Concerto
Published: May 21, 2025

CVE-2025-4094

9.8
    Wordpress
  • Digits
Published: May 21, 2025

CVE-2025-4524

9.8
    Madara
  • Madara
Published: May 21, 2025

CVE-2025-44083

9.8
    D-Link
  • Di-8100
Published: May 21, 2025

CVE-2025-4008

9.4
    Onekey
  • Meteobridge
Published: May 21, 2025

CVE-2025-41426

9.3
    Vertiv
  • Product
Published: May 21, 2025

CVE-2025-46412

9.3
    Vertiv
  • *
Published: May 21, 2025

CVE-2025-34026

9.2
    Versa
  • Concerto
Published: May 21, 2025

CVE-2025-41232

9.1
    Vmware
  • Spring Security
Published: May 21, 2025

CVE-2025-27558

9.1
    Ieee
  • Ieee P802.11
    Wpa
    Wpa2
    Wpa3
    Wep
Published: May 21, 2025

CVE-2025-1712

8.7
    Checkmk
  • Checkmk
Published: May 21, 2025

CVE-2025-48201

8.6
    Typo3
  • Ns Backup
Published: May 21, 2025

CVE-2025-48205

8.6
    Typo3
  • Sr Feuser Register
Published: May 21, 2025

CVE-2025-48207

8.6
    Typo3
  • Reint Downloadmanager
Published: May 21, 2025

CVE-2025-20152

8.6
    Cisco
  • Identity Services Engine
Published: May 21, 2025

CVE-2025-34025

8.6
    Versa
  • Concerto
Published: May 21, 2025

CVE-2025-27997

8.4
    Blizzard
  • Battle.Net
Published: May 21, 2025

CVE-2025-27998

8.4
    Valvesoftware
  • Steam Client
Published: May 21, 2025

CVE-2021-25255

8.3
    Yandex
  • Yandex Browser Lite
Published: May 21, 2025

CVE-2021-25254

8.2
    Yandex
  • Yandex Browser Lite
Published: May 21, 2025

CVE-2019-16536

8.2
    Clickhouse
  • Clickhouse
Published: May 21, 2025

CVE-2025-48413

7.7
    Unix
  • Unix
    Linux
Published: May 21, 2025

CVE-2024-56429

7.7
    Itech
  • Ilabclient
Published: May 21, 2025

CVE-2025-46822

7.7
    Osamataher
  • Java-Springboot-Codebase
Published: May 21, 2025

CVE-2025-48060

7.7
    Jq
  • Jq
Published: May 21, 2025

CVE-2025-40775

7.5
    Isc
  • Bind
Published: May 21, 2025

CVE-2025-4416

7.5
    Drupal
  • Events Log Track
Published: May 21, 2025

CVE-2025-47947

7.5
    Modsecurity
  • Modsecurity
Published: May 21, 2025

CVE-2025-4803

7.2
    Wordpress
  • Plugin
Published: May 21, 2025

CVE-2025-45752

7.2
    Seeddms
  • Seeddms
Published: May 21, 2025

CVE-2025-44040

7.2
    Orangehrm
  • Orangehrm
Published: May 21, 2025

CVE-2025-45753

7.2
    Vtiger
  • Crm
Published: May 21, 2025

CVE-2025-20113

7.1
    Cisco
  • Unified Intelligence Center
Published: May 21, 2025

CVE-2025-1416

7.0
    Konsola
  • Proget
Published: May 21, 2025

CVE-2025-2261

7.0
    Tibco
  • Activematrix Administrator
Published: May 21, 2025

CVE-2025-3751

7.0
    Tibco
  • *
Published: May 21, 2025

CVE-2021-25262

6.9
    Yandex
  • Yandex Browser
Published: May 21, 2025

CVE-2025-5032

6.9
    Campcodes
  • Online Shopping Portal
Published: May 21, 2025

CVE-2025-5049

6.9
    Freefloat
  • Ftp Server
Published: May 21, 2025

CVE-2025-5050

6.9
    Freefloat
  • Ftp Server
Published: May 21, 2025

CVE-2025-5051

6.9
    Freefloat
  • Ftp Server
Published: May 21, 2025

CVE-2025-5052

6.9
    Freefloat
  • Ftp Server
Published: May 21, 2025

CVE-2025-5053

6.9
    Freefloat
  • Ftp Server
Published: May 21, 2025

CVE-2025-5056

6.9
    Campcodes
  • Online Shopping Portal
Published: May 21, 2025

CVE-2025-5057

6.9
    Campcodes
  • Online Shopping Portal
Published: May 21, 2025

CVE-2025-4949

6.8
    Eclipse
  • Jgit
Published: May 21, 2025

CVE-2025-48204

6.8
    Typo3
  • Typo3
  • Ns Backup
Published: May 21, 2025

CVE-2025-48069

6.6
    Unknown
  • Ejson2env
Published: May 21, 2025

CVE-2025-4969

6.5
    Libsoup
  • Libsoup
Published: May 21, 2025

CVE-2025-27803

6.5
    *
  • Devices
Published: May 21, 2025

CVE-2025-27804

6.5
    Device Firmware
  • *
    Unknown
Published: May 21, 2025

CVE-2025-48414

6.5
    *
  • *
Published: May 21, 2025

CVE-2025-48417

6.5
    *
  • *
Published: May 21, 2025

CVE-2024-42922

6.5
    Aapanels
  • Aapanels
Published: May 21, 2025

CVE-2025-44892

6.5
    Fw-Wgs
  • Fw-Wgs-804hpt
Published: May 21, 2025

CVE-2025-44895

6.5
    Fw
  • Fw-Wgs-804hpt
Published: May 21, 2025

CVE-2025-20242

6.5
    Cisco
  • Cisco Unified Contact Center Enterprise
Published: May 21, 2025

CVE-2025-20256

6.5
    Cisco
  • Secure Network Analytics Manager
  • Secure Network Analytics Virtual Manager
Published: May 21, 2025

CVE-2025-20257

6.5
    Cisco
  • Secure Network Analytics Manager
  • Secure Network Analytics Virtual Manager
Published: May 21, 2025

CVE-2025-25539

6.5
    Vasco
  • Vasco
Published: May 21, 2025

CVE-2025-3750

6.4
    Wordpress
  • Network Posts Extended
Published: May 21, 2025

CVE-2025-3781

6.4
    Raisely
  • Donation Form
Published: May 21, 2025

CVE-2025-4217

6.4
    Wordpress
  • Wp Youtube Video Optimizer
Published: May 21, 2025

CVE-2025-4219

6.4
    Dpepress
  • Dpepress
Published: May 21, 2025

CVE-2025-4221

6.4
    Wordpress
  • Plugin
Published: May 21, 2025

CVE-2025-4611

6.4
    Wordpress
  • Slim Seo
Published: May 21, 2025

CVE-2025-48203

6.4
    Typo3
  • Typo3
  • Cs Seo
Published: May 21, 2025

CVE-2025-48415

6.2
    *
  • *
Published: May 21, 2025

CVE-2024-12561

6.1
    Wordpress
  • Affiliate Sales Plugin
Published: May 21, 2025

CVE-2025-48206

6.1
    Typo3
  • Ns Backup
Published: May 21, 2025

CVE-2025-20246

6.1
    Cisco
  • Webex
Published: May 21, 2025

CVE-2025-20247

6.1
    Cisco
  • Webex
Published: May 21, 2025

CVE-2025-20250

6.1
    Cisco
  • Webex
Published: May 21, 2025

CVE-2024-57529

6.1
    Jeppesen
  • Jetplanner Pro
Published: May 21, 2025

CVE-2025-45755

6.1
    Vtiger
  • Vtiger Crm
Published: May 21, 2025

CVE-2025-0372

5.9
    Hypr
  • Hypr Passwordless
Published: May 21, 2025

CVE-2025-2102

5.7
    Hypr
  • Passwordless
Published: May 21, 2025

CVE-2024-56428

5.5
    Itech
  • Ilabclient
Published: May 21, 2025

CVE-2025-4105

5.4
    Wordpress
  • Splitit
Published: May 21, 2025

CVE-2025-20258

5.4
    Cisco
  • Duo
Published: May 21, 2025

CVE-2025-45754

5.4
    Seeddms
  • Seeddms
Published: May 21, 2025

CVE-2025-5013

5.3
    Hkcms
  • Hkcms
Published: May 21, 2025

CVE-2025-5029

5.3
    Kingdee
  • Cloud Galaxy Private Cloud Bbc System
Published: May 21, 2025

CVE-2025-48202

5.3
    Typo3
  • Femanager
Published: May 21, 2025

CVE-2025-5033

5.3
    Teacms
  • Teacms
Published: May 21, 2025

CVE-2025-47942

5.3
    Openedx
  • Openedx Platform
Published: May 21, 2025

CVE-2025-1415

5.1
    Proget
  • Konsola Proget
Published: May 21, 2025

CVE-2025-1418

5.1
    Konsola
  • Proget
Published: May 21, 2025

CVE-2025-20112

5.1
    Cisco
  • Unified Communications
  • Contact Center Solutions
Published: May 21, 2025

CVE-2025-5059

5.1
    Campcodes
  • Online Shopping Portal
Published: May 21, 2025

CVE-2025-5010

4.8
    Moonlightl
  • Hexo-Boot
Published: May 21, 2025

CVE-2025-5011

4.8
    Moonlightl
  • Hexo-Boot
Published: May 21, 2025

CVE-2025-20267

4.8
    Cisco
  • Identity Services Engine
Published: May 21, 2025

CVE-2025-48010

4.8
    Drupal
  • One Time Password
Published: May 21, 2025

CVE-2025-48011

4.8
    Drupal
  • One Time Password
Published: May 21, 2025

CVE-2025-48012

4.8
    Drupal
  • One Time Password
Published: May 21, 2025

CVE-2025-4415

4.8
    Drupal
  • Piwik Pro
Published: May 21, 2025

CVE-2025-48063

4.8
    Xwiki
  • Xwiki
Published: May 21, 2025

CVE-2025-1417

4.6
    Konsola
  • Proget Mdm
Published: May 21, 2025

CVE-2025-47291

4.6
    Containerd
  • Containerd
Published: May 21, 2025

CVE-2024-23337

4.3
    Jq
  • Jq
Published: May 21, 2025

CVE-2025-20114

4.3
    Cisco
  • Unified Intelligence Center
Published: May 21, 2025

CVE-2025-20255

4.3
    Cisco
  • Webex Meetings
Published: May 21, 2025

CVE-2025-5020

4.3
    Mozilla
  • Firefox
Published: May 21, 2025

CVE-2025-48070

3.5
    Plane
  • Plane
Published: May 21, 2025

CVE-2025-48064

3.3
    Github
  • Github Desktop
Published: May 21, 2025

CVE-2025-48009

3.1
    Drupal
  • Single Content Sync
Published: May 21, 2025

CVE-2025-1419

2.4
    Konsola
  • Proget
Published: May 21, 2025

CVE-2025-1420

2.4
    Konsola
  • Proget
Published: May 21, 2025

CVE-2025-1421

2.4
    Konsola
  • Proget
Published: May 21, 2025

CVE-2025-5030

2.3
    Ackites
  • Killwxapkg
Published: May 21, 2025

CVE-2025-5031

2.3
    Ackites
  • Killwxapkg
Published: May 21, 2025

CVE-2025-48419

None
    Fortinet
  • Fortigate
Published: May 21, 2025

CVE-2025-48420

None
    Fortinet
  • *
Published: May 21, 2025

CVE-2025-48421

None
    Fortinet
  • Fortinet
Published: May 21, 2025

CVE-2025-48422

None
    Fortinet
  • Fortinet
Published: May 21, 2025

CVE-2025-48423

None
    Fortinet
  • Fortigate
Published: May 21, 2025

CVE-2025-48424

None
    Fortinet
  • *
Published: May 21, 2025

CVE-2025-48425

None
    Fortinet
  • *
Published: May 21, 2025

CVE-2025-48426

None
    Fortinet
  • Fortinet
Published: May 21, 2025

CVE-2025-48427

None
    Fortinet
  • *
Published: May 21, 2025

CVE-2025-48416

None
    Openssh
  • Openssh
Published: May 21, 2025
Click here to see more Vulnerabilities