Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 15:11:35 +0200 *************** ✏️Title: CVE-2025-5264 | Mozilla Firefox up to 138 Copy as cURL privilege escalation (Nessus ID 237301) *************** 📎Link: https://vuldb.com/?id.310370 *************** ⚙️Information: #Vendor: Mozilla #Product: Firefox #Type: Web Browser #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 15:11:53 +0200 *************** ✏️Title: CVE-2025-5265 | Mozilla Firefox up to 138 on Windows Copy as cURL Remote Code Execution (Nessus ID 237301) *************** 📎Link: https://vuldb.com/?id.310371 *************** ⚙️Information: #Vendor: Mozilla #Product: Firefox #Type: Web Browser #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 15:12:07 +0200 *************** ✏️Title: CVE-2025-5270 | Mozilla Firefox up to 138 cleartext transmission *************** 📎Link: https://vuldb.com/?id.310372 *************** ⚙️Information: #Vendor: Mozilla #Product: Firefox #Type: Web Browser #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 15:12:23 +0200 *************** ✏️Title: CVE-2025-5271 | Mozilla Firefox up to 138 Devtools injection *************** 📎Link: https://vuldb.com/?id.310373 *************** ⚙️Information: #Vendor: Mozilla #Product: Firefox #Type: Web Browser #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:39:49 +0200 *************** ✏️Title: CVE-2025-48796 | GIMP ANI File Parser ani_load_image stack-based overflow *************** 📎Link: https://vuldb.com/?id.310374 *************** ⚙️Information: #Product: GIMP #Type: Image Processing Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:39:50 +0200 *************** ✏️Title: CVE-2025-48797 | GIMP TGA Image Parser heap-based overflow *************** 📎Link: https://vuldb.com/?id.310375 *************** ⚙️Information: #Product: GIMP #Type: Image Processing Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:39:56 +0200 *************** ✏️Title: CVE-2025-48798 | GIMP XCF Image Parser use after free *************** 📎Link: https://vuldb.com/?id.310376 *************** ⚙️Information: #Product: GIMP #Type: Image Processing Software #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:40:11 +0200 *************** ✏️Title: CVE-2025-3704 | DBAR Productions Volunteer Sign Up Sheets Plugin up to 5.5.4 on WordPress cross site scripting *************** 📎Link: https://vuldb.com/?id.310377 *************** ⚙️Information: #Vendor: DBAR Productions #Product: Volunteer Sign Up Sheets Plugin #Type: WordPress Plugin #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:40:24 +0200 *************** ✏️Title: CVE-2025-2236 | OpenText Advanced Authentication up to 6.4 exposure of sensitive system information to an unauthorized control sphere *************** 📎Link: https://vuldb.com/?id.310378 *************** ⚙️Information: #Vendor: OpenText #Product: Advanced Authentication #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:40:48 +0200 *************** ✏️Title: CVE-2025-48383 | codingjoe django-select2 up to 8.4.0 on Select2 ModelSelect2MultipleWidget/ModelSelect2Widget transmission of private resources into a new sphere ('resource leak') (GHSA-wjrh-hj83-3wh7) *************** 📎Link: https://vuldb.com/?id.310379 *************** ⚙️Information: #Vendor: codingjoe #Product: django_select2 #Type: Content Management System #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:41:09 +0200 *************** ✏️Title: CVE-2025-48370 | auth-js up to 2.69.0 API improper authentication (GHSA-8r88-6cj9-9fh5) *************** 📎Link: https://vuldb.com/?id.310380 *************** ⚙️Information: #Product: auth_js #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:41:29 +0200 *************** ✏️Title: CVE-2024-56193 | Google Android Bluetooth Adapter information disclosure *************** 📎Link: https://vuldb.com/?id.310381 *************** ⚙️Information: #Vendor: Google #Product: Android #Type: Smartphone Operating System #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:41:37 +0200 *************** ✏️Title: CVE-2025-27700 | Google Android Local Privilege Escalation *************** 📎Link: https://vuldb.com/?id.310382 *************** ⚙️Information: #Vendor: Google #Product: Android #Type: Smartphone Operating System #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:41:57 +0200 *************** ✏️Title: CVE-2025-27701 | Google Android process_crypto_cmd ptrs memory corruption *************** 📎Link: https://vuldb.com/?id.310383 *************** ⚙️Information: #Vendor: Google #Product: Android #Type: Smartphone Operating System #Risk: critical #Local: Yes #Remote: No #Exploit: No #Countermeasures: Patch *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 18:42:52 +0200 *************** ✏️Title: CVE-2025-48057 | Icinga icinga2 up to 2.12.11/2.13.11/2.14.5 VerifyCertificate improper following of a certificate's chain of trust *************** 📎Link: https://vuldb.com/?id.310384 *************** ⚙️Information: #Vendor: Icinga #Product: icinga2 #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 19:28:54 +0200 *************** ✏️Title: CVE-2025-23247 | NVIDIA CUDA Toolkit ELF File Parser length parameter *************** 📎Link: https://vuldb.com/?id.310385 *************** ⚙️Information: #Vendor: NVIDIA #Product: CUDA Toolkit #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 19:30:26 +0200 *************** ✏️Title: CVE-2024-49197 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 1480 Wi-Fi out-of-bounds *************** 📎Link: https://vuldb.com/?id.310386 *************** ⚙️Information: #Vendor: Samsung #Product: Mobile Processor/Wearable Processor/Modem Exynos #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 19:30:41 +0200 *************** ✏️Title: CVE-2025-22377 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 9110 GPRS Protocol out-of-bounds write *************** 📎Link: https://vuldb.com/?id.310387 *************** ⚙️Information: #Vendor: Samsung #Product: Mobile Processor/Wearable Processor/Modem Exynos #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 19:30:59 +0200 *************** ✏️Title: CVE-2024-49196 | Samsung Mobile Processor 1480/2400 GPU denial of service *************** 📎Link: https://vuldb.com/?id.310388 *************** ⚙️Information: #Vendor: Samsung #Product: Mobile Processor #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Tue, 27 May 2025 19:32:23 +0200 *************** ✏️Title: CVE-2025-5278 | GNU Coreutils 7.2 Key Specification heap-based overflow *************** 📎Link: https://vuldb.com/?id.310389 *************** ⚙️Information: #Vendor: GNU #Product: Coreutils #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security