Tag: 2025-07-23

7 Attack Reports | 104 Vulnerabilities

Attack reports

Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief

Several critical vulnerabilities in Microsoft SharePoint are being actively exploited, targeting on-premises servers in government, education, healthcare, and large enterprises. The vulnerabilities allow unauthenticated attackers to bypass security controls and gain privileged access, leading to da…
vulnerability
exploitation
web shell
sharepoint
CVE-2025-53770
CVE-2025-53771
CVE-2025-49704
CVE-2025-49706
on-premises
2025-07-23
unauthenticated access
Published: July 23, 2025
Downloadable IOCs: 0

A Special Mission to Nowhere

A phishing campaign exploiting the aftermath of a military conflict between Israel and Iran has been identified. The scam, using a fake domain 'lineageembraer.online', offers evacuation flights from Tel Aviv to New York on an Embraer Lineage 1000E business jet. The website presents unrealistic pric…
phishing
financial fraud
scam
aviation
identity theft
2025-07-23
middle east crisis
evacuation
embraer
Published: July 23, 2025
Downloadable IOCs: 1

Defending Against ToolShell: SharePoint's Latest Critical Vulnerability

A critical zero-day vulnerability named ToolShell (CVE-2025-53770) has been discovered in on-premises SharePoint Server deployments. This vulnerability allows unauthenticated remote code execution, posing a significant threat to organizations worldwide. SentinelOne has detected active exploitation …
vulnerability
zero-day
cybersecurity
remote code execution
threat detection
sharepoint
patch
CVE-2025-53770
toolshell
2025-07-23
Published: July 23, 2025
Downloadable IOCs: 2

Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode

The Arctic Wolf Labs team has uncovered a new cyber-espionage campaign by the Dropping Elephant APT group targeting Turkish defense contractors. The attack leverages a five-stage execution chain delivered via malicious LNK files disguised as conference invitations. It uses legitimate binaries like …
apt
powershell
shellcode
dll side-loading
cyber-espionage
turkey
defense industry
2025-07-23
vlc player
dropping elephant rat
Published: July 23, 2025
Linked vulnerabilities : CVE-2025-5777 (CVSS 9.3), CVE-2025-20337 (CVSS 10.0), CVE-2025-53770 (CVSS 9.8)
Downloadable IOCs: 10

Illusory Wishes: China-nexus APT Targets the Tibetan Community

Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and Phant…
social engineering
dll sideloading
phantomnet
multi-stage attack
2025-07-23
ghost rat
web compromise
tibetan community
Published: July 23, 2025
Downloadable IOCs: 26

NET RFQ: Request for Quote Scammers Casting Wide Net to Steal Real Goods

This intelligence analysis examines a widespread Request for Quote (RFQ) scam that exploits Net financing options to steal high-value electronics and goods. The scammers pose as procurement agents for legitimate companies, using stolen information and lookalike domains to appear credible. They requ…
social engineering
supply chain
business email compromise
2025-07-23
rfq scam
electronics theft
net financing fraud
Published: July 23, 2025
Downloadable IOCs: 94

Back to Business: Lumma Stealer Returns with Stealthier Methods

Lumma Stealer, an information-stealing malware, has resurfaced shortly after its takedown in May 2025. The cybercriminals behind it are now employing more covert tactics and expanding their reach. The malware is being distributed through discreet channels and uses stealthier evasion techniques. Lum…
social engineering
lumma stealer
malware-as-a-service
infrastructure
information stealer
evasion tactics
cracked software
2025-07-23
github abuse
Published: July 23, 2025
Downloadable IOCs: 52
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-54438

9.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-54440

9.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-54442

9.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-54443

9.8
    Samsung Electronics
  • Magicinfo
Published: July 23, 2025

CVE-2025-54444

9.8
    Samsung Electronics
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-54446

9.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-54448

9.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-54449

9.8
    Samsung
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-54451

9.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-41687

9.8
    U-Link
  • U-Link Management Api
Published: July 23, 2025

CVE-2025-54120

9.3
    Pcl
  • Plain Craft Launcher
Published: July 23, 2025

CVE-2025-54294

9.3
    Joomla
  • Komento
Published: July 23, 2025

CVE-2015-10141

9.3
    Derick Rethans
  • Xdebug
Published: July 23, 2025

CVE-2017-20198

9.3
    Dcos
  • Marathon
Published: July 23, 2025

CVE-2018-25114

9.3
    Oscommerce
  • Online Merchant
Published: July 23, 2025

CVE-2022-4978

9.3
    Steppschuh
  • Remote Control Server
Published: July 23, 2025

CVE-2016-15044

9.3
    Kaltura
  • Kaltura
Published: July 23, 2025

CVE-2025-8070

9.2
    Asustor
  • Abp
  • Aes
Published: July 23, 2025

CVE-2025-54454

9.1
    Samsung Electronics
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-54455

9.1
    Samsung Electronics
  • Magicinfo
Published: July 23, 2025

CVE-2025-53882

9.1
    Suse
  • Mailman3
  • Opensuse Tumbleweed
Published: July 23, 2025

CVE-2025-40599

9.1
    Sonicwall
  • Sma 100 Series
Published: July 23, 2025

CVE-2025-6190

8.8
    Wordpress
  • Realty Portal Agent
Published: July 23, 2025

CVE-2025-7722

8.8
    Wordpress
  • Social Streams
Published: July 23, 2025

CVE-2025-8020

8.8
    Private-Ip
  • Private-Ip
Published: July 23, 2025

CVE-2025-54439

8.8
    Samsung Electronics
  • Magicinfo
Published: July 23, 2025

CVE-2025-54441

8.8
    Samsung Electronics
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-54453

8.8
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-41683

8.8
    *
  • *
Published: July 23, 2025

CVE-2025-41684

8.8
    *
  • *
Published: July 23, 2025

CVE-2025-33076

8.8
    Ibm
  • Engineering Systems Design Rhapsody
Published: July 23, 2025

CVE-2025-33077

8.8
    Ibm
  • Engineering Systems Design Rhapsody
Published: July 23, 2025

CVE-2025-8022

8.7
    Package
  • Bun
Published: July 23, 2025

CVE-2010-10012

8.7
    Httpdasm
  • Httpdasm
Published: July 23, 2025

CVE-2018-25113

8.7
    Dicoogle
  • Dicoogle Pacs Web Server
Published: July 23, 2025

CVE-2025-4700

8.7
    Gitlab
  • Gitlab Ce
  • Gitlab Ee
Published: July 23, 2025

CVE-2025-50127

8.5
    Joomla
  • Dj-Flyer
Published: July 23, 2025

CVE-2016-15045

8.5
    Wuhan Deepin Technology Co.
  • Lastore Daemon
Published: July 23, 2025

CVE-2025-54445

8.2
    Samsung
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-54447

8.1
    Samsung Electronics
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-31700

8.1
    Dahua
  • Dahua
Published: July 23, 2025

CVE-2025-31701

8.1
    Dahua
  • Dahua
Published: July 23, 2025

CVE-2025-6018

7.8
    Redhat
  • Pam
Published: July 23, 2025

CVE-2025-54377

7.8
    Roocode
  • Roocode
Published: July 23, 2025

CVE-2025-54365

7.8
    Fastapi-Guard
  • Fastapi-Guard
Published: July 23, 2025

CVE-2025-8021

7.7
    Files-Bucket-Server
  • *
Published: July 23, 2025

CVE-2025-4439

7.7
    Gitlab
  • Gitlab Ce
  • Gitlab Ee
Published: July 23, 2025

CVE-2025-47281

7.7
    Kyverno
  • Kyverno
Published: July 23, 2025

CVE-2025-40597

7.5
    Sonicwall
  • Sma100
Published: July 23, 2025

CVE-2025-47187

7.5
    Mitel
  • 6800 Series
  • 6900 Series
  • 6900w Series
  • 6970 Conference Unit
Published: July 23, 2025

CVE-2025-53537

7.5
    Libhtp
  • Libhtp
Published: July 23, 2025

CVE-2025-8060

7.4
    Tenda
  • Ac23
Published: July 23, 2025

CVE-2025-54452

7.3
    Samsung
  • Magicinfo
Published: July 23, 2025

CVE-2025-40596

7.3
    Sonicwall
  • Sma100
Published: July 23, 2025

CVE-2025-2633

7.3
    National Instruments
  • Labview
Published: July 23, 2025

CVE-2025-2634

7.3
    National Instruments
  • Labview
Published: July 23, 2025

CVE-2025-8069

7.3
    Amazon
  • Aws Client Vpn
Published: July 23, 2025

CVE-2024-53286

7.2
    Synology
  • Synology Router Manager
Published: July 23, 2025

CVE-2025-54450

7.2
    Samsung Electronics
  • Magicinfo 9 Server
Published: July 23, 2025

CVE-2025-46099

7.1
    Pluck
  • Cms
Published: July 23, 2025

CVE-2025-53942

7.1
    Authentik
  • Authentik
Published: July 23, 2025

CVE-2024-12310

7.0
    Imprivata
  • Enterprise Access Management
Published: July 23, 2025

CVE-2025-54296

7.0
    Joomla
  • Profiles Component
Published: July 23, 2025

CVE-2025-54297

7.0
    Joomla
  • Ccomment
Published: July 23, 2025

CVE-2025-43487

6.9
    Hp
  • Poly Clariti Manager
Published: July 23, 2025

CVE-2025-6214

6.5
    Wordpress
  • Omnishop Plugin
Published: July 23, 2025

CVE-2025-4411

6.5
    Dataprom
  • Pacs-Acss
Published: July 23, 2025

CVE-2025-5753

6.4
    Wordpress
  • Valuation Calculator
Published: July 23, 2025

CVE-2025-6261

6.4
    Wordpress
  • Fleetwire Fleet Management
Published: July 23, 2025

CVE-2025-27930

6.4
    Zohocorp
  • Manageengine Applications Manager
Published: July 23, 2025

CVE-2025-54090

6.3
    Apache
  • Http Server
Published: July 23, 2025

CVE-2025-36116

6.3
    Ibm
  • Db2 Mirror For I
Published: July 23, 2025

CVE-2025-36117

6.3
    Ibm
  • Db2 Mirror For I
Published: July 23, 2025

CVE-2024-40682

6.2
    Ibm
  • Smartcloud Analytics
Published: July 23, 2025

CVE-2025-6054

6.1
    Wordpress
  • Yanewsflash
Published: July 23, 2025

CVE-2025-6174

6.1
    Qwizcards
  • Qwizcards
Published: July 23, 2025

CVE-2025-40598

6.1
    Sonicwall
  • Sma100
Published: July 23, 2025

CVE-2025-43484

6.0
    Hp
  • Poly Clariti Manager
Published: July 23, 2025

CVE-2025-43483

5.9
    Poly
  • Clariti Manager
Published: July 23, 2025

CVE-2024-53287

5.9
    Synology
  • Router Manager
Published: July 23, 2025

CVE-2024-53288

5.9
    Synology
  • Synology Router Manager
Published: July 23, 2025

CVE-2025-33020

5.9
    Ibm
  • Engineering Systems Design Rhapsody
Published: July 23, 2025

CVE-2025-8058

5.9
    Gnu
  • Gnu C Library
Published: July 23, 2025

CVE-2025-43485

5.7
    Poly
  • Clariti Manager
Published: July 23, 2025

CVE-2025-43486

5.7
    Hp
  • Poly Clariti Manager
Published: July 23, 2025

CVE-2025-5818

5.5
    Wordpress
  • Featured Image Plus Quick Bulk Edit With Unsplash
Published: July 23, 2025

CVE-2025-42947

5.5
    Sap
  • Feca Odn Framework
Published: July 23, 2025

CVE-2024-41750

5.5
    Ibm
  • Smartcloud Analytics Log Analysis
Published: July 23, 2025

CVE-2024-41751

5.5
    Ibm
  • Smartcloud Analytics
Published: July 23, 2025

CVE-2024-40686

5.4
    Ibm
  • Smartcloud Analytics
Published: July 23, 2025

CVE-2025-46171

5.4
    Vbulletin
  • Vbulletin
Published: July 23, 2025

CVE-2025-50477

5.4
    Lbry
  • Lbry-Desktop
Published: July 23, 2025

CVE-2025-44109

5.4
    Pinokio
  • Pinokio
Published: July 23, 2025

CVE-2025-6215

5.3
    Omnishop
  • Plugin
Published: July 23, 2025

CVE-2025-43881

5.3
    *
  • Real-Time Bus Tracking System
Published: July 23, 2025

CVE-2025-54295

5.1
    Joomla
  • Joomla
  • Dj-Reviews
Published: July 23, 2025

CVE-2025-46686

4.9
    Redis
  • Redis
Published: July 23, 2025

CVE-2025-50481

4.8
    Mezzanine
  • Mezzanine Cms
Published: July 23, 2025

CVE-2025-4296

4.7
    Hotelrunner
  • B2b
Published: July 23, 2025

CVE-2025-54139

4.3
    Haxcms
  • Haxcms-Nodejs
  • Haxcms-Php
Published: July 23, 2025

CVE-2025-32019

4.1
    Harbor
  • Harbor
Published: July 23, 2025

CVE-2025-43488

2.0
    Hp
  • Poly Clariti Manager
Published: July 23, 2025

CVE-2025-43489

2.0
    Poly
  • Clariti Manager
Published: July 23, 2025

CVE-2025-54371

None
    *
  • *
Published: July 23, 2025
Click here to see more Vulnerabilities