--- title: "Security digest: February 4, 2025" url: https://erroneo.us/security/2025-02-04/ description: "February 4, 2025 vulnerability digest: 4 CISA KEV additions (Apache, Microsoft, Paessler); 1 critical advisory (npm). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2025-02-04 date_modified: 2025-02-04 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 4, 2025 4 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Do you run any of these? Apache OFBiz, Microsoft .NET Framework, Paessler PRTG Network Monitor. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-02-25. - npm: 1 critical advisory ( vitest ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-45195](https://erroneo.us/security/cve/CVE-2024-45195/index.md) Apache OFBiz: Apache OFBiz Forced Browsing Vulnerability (CISA due 2025-02-25) - [CVE-2024-29059](https://erroneo.us/security/cve/CVE-2024-29059/index.md) Microsoft .NET Framework: Microsoft .NET Framework Information Disclosure Vulnerability (CISA due 2025-02-25) - [CVE-2018-9276](https://erroneo.us/security/cve/CVE-2018-9276/index.md) Paessler PRTG Network Monitor: Paessler PRTG Network Monitor OS Command Injection Vulnerability (CISA due 2025-02-25) - [CVE-2018-19410](https://erroneo.us/security/cve/CVE-2018-19410/index.md) Paessler PRTG Network Monitor: Paessler PRTG Network Monitor Local File Inclusion Vulnerability (CISA due 2025-02-25) ## Critical advisories - [CVE-2025-24964](https://erroneo.us/security/cve/CVE-2025-24964/index.md) Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening — npm vitest >= 1.0.0, < 1.6.1 → 1.6.1; npm vitest >= 2.0.0, < 2.1.9 → 2.1.9; npm vitest >= 3.0.0, < 3.0.5 → 3.0.5 --- Source page: https://erroneo.us/security/2025-02-04/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt