Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:28:49 +0200 *************** ✏️Title: CVE-2025-2500 | Hitachi Energy Asset Suite 9.6.4.4/9.7 SOAP Web Services credentials storage *************** 📎Link: https://vuldb.com/?id.310684 *************** ⚙️Information: #Vendor: Hitachi Energy #Product: Asset Suite #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:29:01 +0200 *************** ✏️Title: CVE-2025-1484 | Hitachi Energy Asset Suite up to 9.6.4.4 Media Upload incomplete blacklist *************** 📎Link: https://vuldb.com/?id.310685 *************** ⚙️Information: #Vendor: Hitachi Energy #Product: Asset Suite #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:29:24 +0200 *************** ✏️Title: CVE-2025-40909 | Perl up to 5.41.12 race condition (Patch 10387) *************** 📎Link: https://vuldb.com/?id.310686 *************** ⚙️Information: #Product: Perl #Type: Programming Language Software #Risk: problematic #Local: Yes #Remote: No #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:20 +0200 *************** ✏️Title: CVE-2025-4985 | Dassault Systèmes Project Portfolio Manager cross site scripting *************** 📎Link: https://vuldb.com/?id.310687 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Project Portfolio Manager #Type: Project Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:27 +0200 *************** ✏️Title: CVE-2025-48331 | Vanquish WooCommerce Orders & Customers Exporter Plugin up to 5.0 on WordPress insertion of sensitive information into sent data *************** 📎Link: https://vuldb.com/?id.310688 *************** ⚙️Information: #Vendor: Vanquish #Product: WooCommerce Orders & Customers Exporter Plugin #Type: E_Commerce Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:28 +0200 *************** ✏️Title: CVE-2025-4989 | Dassault Systèmes Product Manager cross site scripting *************** 📎Link: https://vuldb.com/?id.310689 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Product Manager #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:28 +0200 *************** ✏️Title: CVE-2025-4984 | Dassault Systèmes City Referential Manager cross site scripting *************** 📎Link: https://vuldb.com/?id.310690 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: City Referential Manager #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:29 +0200 *************** ✏️Title: CVE-2025-4988 | Dassault Systèmes Multidisciplinary Optimization Engineer cross site scripting *************** 📎Link: https://vuldb.com/?id.310691 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Multidisciplinary Optimization Engineer #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:30 +0200 *************** ✏️Title: CVE-2025-4983 | Dassault Systèmes City Referential Manager cross site scripting *************** 📎Link: https://vuldb.com/?id.310692 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: City Referential Manager #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:30 +0200 *************** ✏️Title: CVE-2025-4990 | Dassault Systèmes Product Manager cross site scripting *************** 📎Link: https://vuldb.com/?id.310693 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Product Manager #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:31 +0200 *************** ✏️Title: CVE-2025-4986 | Dassault Systèmes Product Manager cross site scripting *************** 📎Link: https://vuldb.com/?id.310694 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Product Manager #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:32 +0200 *************** ✏️Title: CVE-2025-4991 | Dassault Systèmes Collaborative Industry Innovator cross site scripting *************** 📎Link: https://vuldb.com/?id.310695 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Collaborative Industry Innovator #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:32 +0200 *************** ✏️Title: CVE-2025-0602 | Dassault Systèmes Collaborative Industry Innovator cross site scripting *************** 📎Link: https://vuldb.com/?id.310696 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Collaborative Industry Innovator #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 16:31:47 +0200 *************** ✏️Title: CVE-2025-4992 | Dassault Systèmes Service Process Engineer Items Management Service cross site scripting *************** 📎Link: https://vuldb.com/?id.310697 *************** ⚙️Information: #Vendor: Dassault Systèmes #Product: Service Process Engineer #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 18:00:03 +0200 *************** ✏️Title: CVE-2025-2571 | Mattermost up to 9.11.12/10.5.3/10.6.2/10.7.0 Google OAuth Signup incorrect implementation of authentication algorithm *************** 📎Link: https://vuldb.com/?id.310698 *************** ⚙️Information: #Product: Mattermost #Type: Groupware Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 18:00:25 +0200 *************** ✏️Title: CVE-2025-1792 | Mattermost up to 9.11.12/10.5.3/10.7.0 Channel Members API Endpoint authorization *************** 📎Link: https://vuldb.com/?id.310699 *************** ⚙️Information: #Product: Mattermost #Type: Groupware Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 18:00:44 +0200 *************** ✏️Title: CVE-2025-3611 | Mattermost up to 9.11.12/10.5.3/10.7.0 System Console authorization *************** 📎Link: https://vuldb.com/?id.310700 *************** ⚙️Information: #Product: Mattermost #Type: Groupware Software #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 18:00:51 +0200 *************** ✏️Title: CVE-2024-7096 | WSO2 Open Banking IAM SOAP Admin Services authorization *************** 📎Link: https://vuldb.com/?id.310701 *************** ⚙️Information: #Vendor: WSO2 #Product: Open Banking IAM/Open Banking AM/API Manager/Enterprise Mobility Manager/Identity Server/Identity Server as Key Manager/Open Banking KM #Type: Banking Software #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 18:01:14 +0200 *************** ✏️Title: CVE-2024-7097 | WSO2 Open Banking AM SOAP Admin Services resource consumption *************** 📎Link: https://vuldb.com/?id.310702 *************** ⚙️Information: #Vendor: WSO2 #Product: Open Banking AM/Open Banking KM/Identity Server as Key Manager/API Manager/Identity Server/Open Banking IAM/Enterprise Mobility Manager #Type: Banking Software #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Fri, 30 May 2025 18:01:33 +0200 *************** ✏️Title: CVE-2024-23589 | HCL Glovius Cloud 240520 weak hash (KB0121015) *************** 📎Link: https://vuldb.com/?id.310703 *************** ⚙️Information: #Vendor: HCL #Product: Glovius Cloud #Type: Cloud Software #Risk: problematic #Local: No #Remote: Partially #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security