About Remote Code Execution – SAP NetWeaver (CVE-2025-31324, CVE-2025-42999) vulnerability

Leave a reply

About Remote Code Execution - SAP NetWeaver (CVE-2025-31324, CVE-2025-42999) vulnerability

About Remote Code Execution – SAP NetWeaver (CVE-2025-31324, CVE-2025-42999) vulnerability. SAP NetWeaver is the core SAP platform for running applications and integrating systems. Vulnerabilities were found in its Visual Composer component – a web tool for business app modeling. A lack of authorization checks (CVE-2025-31324) and insecure deserialization (CVE-2025-42999) allows unauthenticated attackers to perform remote code execution and compromise SAP systems, data, and processes.

🩹 The vulnerabilities were fixed by SAP in April and May 2025.

👾 On May 13, Onapsis researchers reported that CVE-2025-31324 had been exploited since February 10. The CVEs were added to CISA KEV on April 29 and May 15.

🛠 PoCs for CVE-2025-31324 began appearing on GitHub in late April. A public exploit combining CVE-2025-31324 and CVE-2025-42999 was reported by Onapsis on August 15.

📊 According to estimates, SAP products are still used by around 2,000 Russian organizations.

На русском

September Microsoft Patch Tuesday

Leave a reply

September Microsoft Patch Tuesday

September Microsoft Patch Tuesday. A total of 103 vulnerabilities, 29 fewer than in August. Of these, 25 vulnerabilities were added between the August and September MSPT. So far, no vulnerabilities are known to be exploited in the wild. Two have public PoC exploits:

🔸 DoS – Newtonsoft.Json (CVE-2024-21907)
🔸 EoP – Azure Networking (CVE-2025-54914)

Notable among the other vulnerabilities without public exploits:

🔹 RCE – Microsoft Office (CVE-2025-54910), Windows Graphics Component (CVE-2025-55228), NTFS (CVE-2025-54916), SharePoint (CVE-2025-54897), Microsoft HPC Pack (CVE-2025-55232), Hyper-V (CVE-2025-55224), Graphics Kernel (CVE-2025-55226, CVE-2025-55236)
🔹 EoP – Windows NTLM (CVE-2025-54918), Windows Kernel (CVE-2025-54110), Windows SMB (CVE-2025-55234), Windows TCP/IP Driver (CVE-2025-54093), Hyper-V (CVE-2025-54091, CVE-2025-54092, CVE-2025-54098, CVE-2025-54115)

🗒 Full Vulristics report

На русском

August Linux Patch Wednesday

Leave a reply

August Linux Patch Wednesday

August Linux Patch Wednesday. I’m late with this LPW since I was improving the generation of LPW bulletin lists and the operation of Vulristics. 🙂 In August, Linux vendors addressed 867 vulnerabilities, nearly twice July’s total, including 455 in the Linux Kernel. One vulnerability is confirmed exploited in the wild (CISA KEV):

🔻 SFB – Chromium (CVE-2025-6558) – an exploited SFB in Chromium for the fourth month in a row. 🙄

Public exploits are available or suspected for 72 (❗️) vulnerabilities. The most important are:

🔸 RCE – WordPress (CVE-2024-31211) – from last year, but recently fixed in Debian; Kubernetes (CVE-2025-53547), NVIDIA Container Toolkit (CVE-2025-23266), Kafka (CVE-2025-27819)
🔸 Command Injection – Kubernetes (CVE-2024-7646)
🔸 Code Injection – PostgreSQL (CVE-2025-8714/8715), Kafka (CVE-2025-27817)
🔸 Arbitrary File Writing – 7-Zip (CVE-2025-55188)

🗒 Full Vulristics report

На русском

About Remote Code Execution – WinRAR (CVE-2025-6218, CVE-2025-8088) vulnerabilities

Leave a reply

About Remote Code Execution - WinRAR (CVE-2025-6218, CVE-2025-8088) vulnerabilities

About Remote Code Execution – WinRAR (CVE-2025-6218, CVE-2025-8088) vulnerabilities. A crafted file path inside an archive may cause the extraction process to move into unintended directories (including the Startup directories 😈), which can result in archive extraction leading to the execution of malicious code in the context of the current user.

🩹 Vulnerability CVE-2025-6218 was reported to the vendor on June 5. It was fixed on June 25 in version 7.12. A month later, on July 30, version 7.13 was released, which addressed CVE-2025-8088 with the same description.

🛠 A public exploit for CVE-2025-6218 has been available on GitHub since June 27.

👾 On August 8, BiZone reported phishing attacks against Russian organizations exploiting CVE-2025-6218 and CVE-2025-8088 since early July, linked to the group Paper Werewolf (GOFFEE). ESET also observed attacks exploiting these vulnerabilities to deploy RomCom backdoors.

На русском

🔍 Vulners Lookup – augmented CVE reality

Leave a reply

🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality

🔍 Vulners Lookup – augmented CVE reality.

Yesterday, VulnCheck unveiled a prototype Chrome/Chromium plugin that highlights CVE identifiers on any website and shows a popup with vulnerability details, including whether the vulnerability is in the VulnCheck KEV (an extended CISA KEV). ⚡️

The Vulners team saw this news, loved the idea, and built their own plugin in just one day. 👨‍💻 CVEs are highlighted, and hovering over them shows up-to-date details: description, evidence of exploitation in the wild, and public exploits. Clicking takes you to the Vulners website, where you can explore actual exploits and attack details. 😉🚀

The wow factor is definitely here! 🤯🙂👍 News, regulatory bulletins, vulnerability top lists, and blogs are suddenly bursting with new colors. 🎨 So cool! 😎 And best of all – it’s free! 🆓

📦 While Vulners Lookup is under review in the Google plugin store, you can download and install it from the archive.

На русском

Statistics on 2024 trending vulnerabilities were featured in the OIC-CERT annual report

Leave a reply

Statistics on 2024 trending vulnerabilities were featured in the OIC-CERT annual report

Statistics on 2024 trending vulnerabilities were featured in the OIC-CERT annual report. 🎉

🔹 The Organisation of Islamic Cooperation (OIC) is the largest and most influential official intergovernmental Muslim international organization. It currently unites 57 countries with a population of about 2 billion people. Russia is also a member of the OIC as an observer.

🔹 OIC-CERT is a computer incident response team and a subsidiary of the OIC. It brings together national CERTs from 27 countries, as well as 8 commercial organizations, including Positive Technologies.

➡️ The statistics on 2024 trending vulnerabilities that I prepared were published in the section highlighting Positive Technologies’ results (report size: 67.49 MB, p.229).

I’m glad my work contributed to promoting PT ESC and Positive Technologies among national CERTs and key decision-makers! 😉

На русском

August Microsoft Patch Tuesday

Leave a reply

August Microsoft Patch Tuesday

August Microsoft Patch Tuesday. A total of 132 vulnerabilities, 20 fewer than in July. Of these, 25 were added between the July and August MSPT. Three are actively exploited, including two related to the trending SharePoint “ToolShell” flaw, exploited since July 17.

🔻 RCE – Microsoft SharePoint Server (CVE-2025-53770)
🔻 Spoofing – Microsoft SharePoint Server (CVE-2025-53771)

Another actively exploited vulnerability affects Chromium:

🔻SFB – Chromium (CVE-2025-6558)

Notable among the rest, without public exploits or exploitation signs, are:

🔹 RCE – SharePoint (CVE-2025-49712), GDI+ (CVE-2025-53766), Windows Graphics Component (CVE-2025-50165), DirectX Graphics Kernel (CVE-2025-50176), Microsoft Office (CVE-2025-53731, CVE-2025-53740), MSMQ (CVE-2025-53144, CVE-2025-53145, CVE-2025-50177)
🔹 EoP – Kerberos (CVE-2025-53779), NTLM (CVE-2025-53778)

🗒 Full Vulristics report

На русском