Recent searches

No recent searches

Search options

Only available when logged in.
digitalcourage.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Diese Instanz wird betrieben von Digitalcourage e.V. für die Allgemeinheit. Damit wir das nachhaltig tun können, erheben wir einen jährlichen Vorausbeitrag von 1€/Monat per SEPA-Lastschrifteinzug.

Administered by:

Server stats:

828
active users

digitalcourage.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.4

#vulnerability

72 posts19 participants0 posts today
BeyondMachines :verified:

Critical stored XSS vulnerability reported in DotNetNuke Platform

DNN Software patched a critical stored cross-site scripting vulnerability (CVE-2025-59545) in the DotNetNuke Platform CMS that allows authenticated attackers to execute arbitrary scripts through the Prompt module, potentially compromising administrative sessions and stealing sensitive data.

**If you're running DNN Platform (DotNetNuke), plan a VERY QUICK upgrade to version 10.1.0 or later to patch the stored XSS attack. This is very serios, so don't ignore it! Until you can upgrade, restrict access to the Prompt module and monitor admin activity logs for suspicious behavior.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesCritical stored XSS vulnerability reported in DotNetNuke PlatformDNN Software patched a critical stored cross-site scripting vulnerability (CVE-2025-59545) in the DotNetNuke Platform CMS that allows authenticated attackers to execute arbitrary scripts through the Prompt module, potentially compromising administrative sessions and stealing sensitive data.
BeyondMachines :verified:

Installer hijacking vulnerability reported in Salesforce CLI, allows SYSTEM-Level Access

Salesforce patched a high-severity vulnerability (CVE-2025-9844) in its CLI installer that allows attackers to achieve SYSTEM-level privilege escalation by tricking users into downloading fake installers from untrusted sources that include malicious executables mimicking legitimate helper binaries.

**Only download Salesforce CLI from official Salesforce distribution channels, never from third-party or untrusted sources that could contain malicious fake installers. If you already have Salesforce CLI installed, update to version 2.106.6 or later to ensure you have the patched version. If you are using Salesforce CLI, make sure to check your computers for possible infection.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesInstaller hijacking vulnerability reported in Salesforce CLI, allows SYSTEM-Level AccessSalesforce patched a high-severity vulnerability (CVE-2025-9844) in its CLI installer that allows attackers to achieve SYSTEM-level privilege escalation by tricking users into downloading fake installers from untrusted sources that include malicious executables mimicking legitimate helper binaries.
BeyondMachines :verified:

CISA provides details of Federal Agency Network attack through GeoServer vulnerability

CISA analyzed a cyberattack against a U.S. federal agency where threat actors exploited a critical GeoServer vulnerability (CVE-2024-36401) just 11 days after public disclosure, deploying China Chopper web shells and Stowaway proxy tools while remaining undetected for three weeks due to security deficiencies. The incident exposed gaps including lack of endpoint protection on web servers, untested incident response procedures, and unmonitored EDR alerts that allowed attackers to establish persistence and move laterally through the network.

**This is one of those very scary stories, where there were multiple chances to prevent or detect the attack earlier, but the attack still continued. Any organization security is far from perfect. All we can share is the lessons learned and advise a bit more discipline, first with fast patching.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

BeyondMachinesCISA provides details of Federal Agency Network attack through GeoServer vulnerabilityCISA analyzed a cyberattack against a U.S. federal agency where threat actors exploited a critical GeoServer vulnerability (CVE-2024-36401) just 11 days after public disclosure, deploying China Chopper web shells and Stowaway proxy tools while remaining undetected for three weeks due to security deficiencies. The incident exposed gaps including lack of endpoint protection on web servers, untested incident response procedures, and unmonitored EDR alerts that allowed attackers to establish persistence and move laterally through the network.
TrendingLive feeds
About