Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.ie is one of the many independent Mastodon servers you can use to participate in the fediverse.
Irish Mastodon - run from Ireland, we welcome all who respect the community rules and members.

Administered by:

Server stats:

1.6K
active users

mastodon.ie: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.1

#vulnerability

154 posts40 participants0 posts today
BeyondMachines :verified:

Critical remote code execution flaw in mcp-remote exposes AI Systems to compromise

JFrog Security Research discovered a critical vulnerability (CVE-2025-6514) in the widely-used mcp-remote project that allows attackers to execute arbitrary operating system commands through OAuth authentication manipulation.

**If you use the mcp-remote npm package for connecting local LLM hosts to remote MCP servers, plan an urgent update to version 0.1.16. The flaw allows malicious MCP servers can push back commands to your computer and hack you. Also, make sure to only connect to trusted MCP servers using HTTPS connections.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachines :verified:

SureForms WordPress Plugin flaw enables unauthenticated file deletion, potential site takeover

A vulnerabilityin the SureForms WordPress plugin (CVE-2025-6691) allows unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can force sites into setup mode and enable complete website takeover. Patches are available in multiple updated versions.

**If you have the SureForms WordPress plugin installed, immediately check your version and update to the latest patched release (1.7.4 or appropriate version for your branch). Don't delay this one, because you can't really hide the form, and updating the plugin is nearly trivial.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesSureForms WordPress Plugin flaw enables unauthenticated file deletion, potential site takeoverA vulnerabilityin the SureForms WordPress plugin (CVE-2025-6691) allows unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can force sites into setup mode and enable complete website takeover. Patches are available in multiple updated versions.
BeyondMachines :verified:

Multiple flaws in Schneider Electric EcoStruxure IT Data Center Expert, at least one critical

Schneider Electric reports multiple vulnerabilities in its EcoStruxure IT Data Center Expert platform, including a CVSS 10.0 flaw (CVE-2025-50121) that enables unauthenticated remote code execution. The company released version 9.0 to patch all vulnerabilities.

**If you have Schneider Electric EcoStruxure IT Data Center Expert, make sure it's isolated from the internet and accesible from trusted networks only. Then plan an update cycle to version 9.0 available through Schneider's Customer Care Center with proper testing.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesMultiple flaws in Schneider Electric EcoStruxure IT Data Center Expert, at least one criticalSchneider Electric reports multiple vulnerabilities in its EcoStruxure IT Data Center Expert platform, including a CVSS 10.0 flaw (CVE-2025-50121) that enables unauthenticated remote code execution. The company released version 9.0 to patch all vulnerabilities.
JayeLTee

I received an email earlier this week from EA asking if I wanted to be added to a public acknowledgement page they were creating for individuals who responsibly disclosed vulnerabilities to them.

For all the shit people give EA, of the 100+ companies I contacted in the last two years, they were the only company I would say had a decent incident response.

They fixed the issue within 12 hours after validating it as critical, and proactively provided me multiple updates over time.

When the IR was done on their side, they reached out again with some more information about the potential impact if the issue hadn't been solved quickly, and also offered me a reward.

I did not have to keep chasing anyone for updates, I wasn't asked for non-disclosure, or offered money in exchange for it, and people replied instead of ignoring me.

I wasn't blamed for their mistake, either, or reported to the authorities.

Unfortunately, at least one or multiple of the things mentioned above are present in most of my other incidents reported; it's a real shit show out there.

#cybersecurity#infosec#responsibledisclosure
PrivacyDigest

Critical #CitrixBleed 2 #vulnerability has been under active #exploit for weeks

A critical vulnerability allowing #hackers to bypass #multifactor #authentication in network management devices made by #Citrix has been actively #exploited for more than a month, researchers said. The finding is at odds with advisories from the vendor saying there is no evidence of in-the-wild #exploitation.
#security #privacy

arstechnica.com/security/2025/

Ars Technica · Critical CitrixBleed 2 vulnerability has been under active exploit for weeksBy Dan Goodin
BeyondMachines :verified:

Juniper releases patches for Junos OS and Junos OS Evolved to fix "BlastRADIUS" RADIUS protocol flaw

Juniper Networks patched a critical vulnerability called "BlastRADIUS" (CVE-2024-3596) affecting the RADIUS protocol in Junos OS and Junos OS Evolved that allows attackers to bypass authentication and gain unauthorized access to network devices due to improper validation of integrity check values.

**Review your Juniper device configuration. If you have Juniper devices using RADIUS authentication (configurations with [access radius-server]), update to the latest patched Junos OS or Junos OS Evolved versions to fix the BlastRADIUS flaw. If you can't patch, enable RADIUS over TLS (RADSEC) as a temporary workaround to encrypt RADIUS traffic and prevent exploitation of BlastRadius.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachines :verified:

Authorization bypass flaw in Juniper Security Director enables access to sensitive resources

Juniper Networks patched a critical vulnerability (CVE-2025-52950) in its Security Director network management platform that allows unauthenticated attackers to access sensitive resources and potentially compromise downstream managed devices including firewalls, switches, and routers due to missing authorization controls.

**If you have Juniper Security Director network management platforms, make sure to isolate the web interface from the internet and make it available only through trusted networks. Then plan an update to Software Bundle Update 24.4.1-1703 or later. Not a panic mode if you have isolated the web interface, but still a lot of endpoints are problematic so better to patch.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesAuthorization bypass flaw in Juniper Security Director enables access to sensitive resourcesJuniper Networks patched a critical vulnerability (CVE-2025-52950) in its Security Director network management platform that allows unauthenticated attackers to access sensitive resources and potentially compromise downstream managed devices including firewalls, switches, and routers due to missing authorization controls.
BeyondMachines :verified:

Multiple vulnerabilities reported in Siemens SINEC NMS, at least one critical

Siemens patched multiple critical vulnerabilities in its SINEC NMS network management system, including a critical flaw (CVE-2025-40736). The company released SINEC NMS version V4.0 to address the vulnerabilities.

**If you have Siemens SINEC NMS network management systems, make sure they are islated from the internet and accessible only from trusted networks. If you are running versions prior to V4.0, plan an update to version V4.0. There is at least one critical flaw that can easily be exploited if a hacker reaches the system. And given enough time, they will. No isolation is perfect.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesMultiple vulnerabilities reported in Siemens SINEC NMS, at least one criticalSiemens patched multiple critical vulnerabilities in its SINEC NMS network management system, including a critical flaw (CVE-2025-40736). The company released SINEC NMS version V4.0 to address the vulnerabilities.
BeyondMachines :verified:

Critical flaws in KUNBUS Revolution Pi industrial control systems enable authentication bypass and command execution

CISA issued advisories warning of critical vulnerabilities in KUNBUS Revolution Pi industrial control systems, including multiple CVSS 9.3 flaws that allow attackers to bypass authentication, gain unauthorized access to critical functions, and execute malicious commands on industrial automation infrastructure. KUNBUS has released patches for the affected Revolution Pi OS, PiCtory, and Webstatus components, and organizations should prioritize updating their industrial control deployments immediately.

**If you have KUNBUS Revolution Pi industrial control systems, as usual first check that they are isolated from the internet and accessible only from trusted networks. Then check your versions and update to the latest releases (PiCtory 2.12, Webstatus 2.4.6, and the new OS Bookworm image from April 2025). There a lot of nasty flaws in the product, so don't ignore patching.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesCritical flaws in KUNBUS Revolution Pi industrial control systems enable authentication bypass and command executionCISA issued advisories warning of critical vulnerabilities in KUNBUS Revolution Pi industrial control systems, including multiple CVSS 9.3 flaws that allow attackers to bypass authentication, gain unauthorized access to critical functions, and execute malicious commands on industrial automation infrastructure. KUNBUS has released patches for the affected Revolution Pi OS, PiCtory, and Webstatus components, and organizations should prioritize updating their industrial control deployments immediately.
TrendingLive feeds
About