CVE Trends

CVE-2023-31122 is an out-of-bounds read vulnerability found in the `mod_macro` module of the Apache HTTP Server. This vulnerability affects Apache HTTP Server versions 2.4.57 and earlier. When processing a long macro, the module fails to add a null byte terminator. This oversight leads to an out-of-bounds read. Exploiting this vulnerability may cause a server crash. While the provided sources mention the potential for remote code execution, directory traversal, and command injection, other sources primarily describe the impact as a denial-of-service vulnerability due to the server crash. Upgrading to Apache HTTP Server version 2.4.58 or later mitigates this vulnerability.

CVE-2025-24200 is an authorization issue in Apple's iOS and iPadOS, fixed with improved state management. This vulnerability could allow a physical attacker to disable USB Restricted Mode on a locked device. USB Restricted Mode, introduced in iOS 11.4.1, prevents USB accessories from connecting to an iOS device after it has been locked for a certain period. Disabling this feature could allow unauthorized access to the device's data. The vulnerability affects iPhone XS and later, iPad Pro (13-inch), iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (7th generation and later), and iPad mini (5th generation and later). Apple acknowledges that this vulnerability may have been actively exploited in highly targeted attacks, describing them as "extremely sophisticated" and directed at specific individuals. Patches for CVE-2025-24200 were released by Apple on February 9, 2025, and are included in iOS 18.3.1, iPadOS 18.3.1, and iPadOS 17.7.5. The vulnerability was reported by Bill Marczak of the Citizen Lab at the University of Toronto's Munk School.

CVE-2024-12754 is a vulnerability found in the AnyDesk remote administration software. It allows local attackers to escalate their privileges on affected Windows systems. The vulnerability exists due to how the AnyDesk service manages background images during remote sessions. More specifically, the service copies the user's background image to the `C:\Windows\Temp` directory with `NT AUTHORITY\SYSTEM` privileges, which can be exploited by an attacker. By manipulating this process, for example, by using a junction, an attacker who can run low-privileged code on the system can potentially read arbitrary files. This could lead to the disclosure of sensitive information, such as stored credentials, which could be used for further compromise. The vulnerability has been patched in AnyDesk version 9.0.1.

CVE-2023-43622 is a denial-of-service (DoS) vulnerability affecting Apache HTTP Server versions 2.4.55 through 2.4.57. It involves an attacker establishing an HTTP/2 connection with an initial window size set to zero. This manipulation can cause the server to indefinitely block handling of the connection, effectively tying up resources. The vulnerability resembles the "slow loris" attack pattern, which aims to exhaust server resources and disrupt service. This vulnerability was addressed in Apache HTTP Server version 2.4.58. Upgrading to this or a later version is recommended to mitigate the risk associated with CVE-2023-43622.

CVE-2025-25064 is an SQL injection vulnerability found in the ZimbraSync Service SOAP endpoint of Zimbra Collaboration. This vulnerability arises from insufficient sanitization of a user-supplied parameter. An attacker who has authenticated to the system can manipulate this parameter to inject arbitrary SQL queries. This manipulation could allow the attacker to retrieve email metadata. Zimbra Collaboration versions 10.0.x before 10.0.12 and 10.1.x before 10.1.4 are affected. Zimbra has addressed this vulnerability and released patches. Users of affected versions are strongly encouraged to update their installations to version 10.0.12 or 10.1.4, respectively, to mitigate the risk. This information is current as of February 10, 2025.

CVE-2025-25065 is a server-side request forgery (SSRF) vulnerability found in the RSS feed parser of Zimbra Collaboration. This vulnerability affects versions 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4. Successful exploitation could allow unauthorized redirection to internal network endpoints. Zimbra has addressed this vulnerability in versions 9.0.0 Patch 43, 10.0.12, and 10.1.4, strengthening input sanitization and enhancing security. Users of affected Zimbra Collaboration versions are strongly advised to update to the patched versions as soon as possible. As of today, February 10, 2025, this information is current, but may change in the future.

CVE-2024-57968 is an unrestricted file upload vulnerability in Advantive VeraCore software prior to version 2024.4.2.1. It allows authenticated remote users to upload files of dangerous types to unintended folders within the application. These folders may then be accessible to other users browsing the web application. The vulnerability specifically involves the `upload.aspx` file. This vulnerability was exploited by the XE Group, a cybercriminal group, to upload web shells, granting them unauthorized access to compromised systems. The fix for this vulnerability is available in VeraCore version 2024.4.2.1 and later. It is recommended to update to the latest version to mitigate this risk.

CVE-2025-23369 refers to a vulnerability discovered in GitHub Enterprise Server. This flaw allows unauthorized internal users to spoof cryptographic signatures. This vulnerability stems from improper verification of these signatures. This vulnerability allows signature spoofing for unauthorized internal users. Exploit code targeting libxml2 vulnerabilities has been developed for this CVE.

CVE-2025-0411 is a vulnerability found in the 7-Zip file archiver that allows attackers to bypass the Mark-of-the-Web (MOTW) security feature in Windows. This vulnerability enables attackers to create specially crafted archives. When these archives are extracted using a vulnerable version of 7-Zip, the extracted files do not inherit the MOTW attribute, which normally marks files downloaded from the internet as potentially unsafe. This bypass allows malicious code within the extracted files to execute without triggering the usual security warnings associated with MOTW. Exploiting this vulnerability requires user interaction: a user must either open a malicious file or visit a webpage that triggers the download and extraction of a malicious archive. The vulnerability was addressed in 7-Zip version 24.09, released on November 29, 2024. A proof-of-concept exploit has been publicly released as of January 27, 2025.