Digest · Tuesday
Security digest: February 4, 2025
4 known exploited (cisa kev) additions and 1 critical advisory.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Apache OFBiz, Microsoft .NET Framework, Paessler PRTG Network Monitor. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-02-25.
- npm: 1 critical advisory (
vitest). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 4
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2024-45195 | Apache OFBiz Apache OFBiz Forced Browsing Vulnerability | 2025-02-25 |
| CVE-2024-29059 | Microsoft .NET Framework Microsoft .NET Framework Information Disclosure Vulnerability | 2025-02-25 |
| CVE-2018-9276 | Paessler PRTG Network Monitor Paessler PRTG Network Monitor OS Command Injection Vulnerability | 2025-02-25 |
| CVE-2018-19410 | Paessler PRTG Network Monitor Paessler PRTG Network Monitor Local File Inclusion Vulnerability | 2025-02-25 |
Critical advisories by ecosystem 1
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 1
Check: npm audit (or: npm ls <package>)
- Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening CVE-2025-24964 CVSS 9.6 Critical
vitest>= 1.0.0, < 1.6.1 → fixed in 1.6.1;vitest>= 2.0.0, < 2.1.9 → fixed in 2.1.9;vitest>= 3.0.0, < 3.0.5 → fixed in 3.0.5; +1 more packages