Digest · Monday
Security digest: May 19, 2025
6 known exploited (cisa kev) additions and 4 critical advisories.
All digests · RSS · Markdown
Take stock
- Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM), Srimax Output Messenger, Synacor Zimbra Collaboration Suite (ZCS), MDaemon Email Server, ZKTeco BioTime. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-09.
- Go: 3 critical advisories (
github.com/gardener/external-dns-management,github.com/gardener/gardener-extension-shoot-dns-service,github.com/gardener/gardener). Check withgovulncheck ./.... - npm: 1 critical advisory (
samlify). Check withnpm audit (or: npm ls <package>). - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 6
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
| CVE | Product and flaw | CISA due |
|---|---|---|
| CVE-2025-4428 | Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 2025-06-09 |
| CVE-2025-4427 | Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability | 2025-06-09 |
| CVE-2025-27920 | Srimax Output Messenger Srimax Output Messenger Directory Traversal Vulnerability | 2025-06-09 |
| CVE-2024-27443 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2025-06-09 |
| CVE-2024-11182 | MDaemon Email Server MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability | 2025-06-09 |
| CVE-2023-38950 | ZKTeco BioTime ZKTeco BioTime Path Traversal Vulnerability | 2025-06-09 |
Critical advisories by ecosystem 4
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 3
Check: govulncheck ./...
- Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation CVE-2025-47282 CVSS 9.9 Critical
github.com/gardener/external-dns-management< 0.23.6 → fixed in 0.23.6;github.com/gardener/gardener-extension-shoot-dns-service<= 1.6.0 → no fix listed - Gardener allows metadata injection for a project secret which can lead to privilege escalation CVE-2025-47284 CVSS 9.9 Critical
github.com/gardener/gardener< 1.116.4 → fixed in 1.116.4;github.com/gardener/gardener>= 1.117.0, < 1.117.5 → fixed in 1.117.5;github.com/gardener/gardener>= 1.118.0, < 1.118.2 → fixed in 1.118.2 - Gardener allows bypassing project secret validation which can lead to privilege escalation CVE-2025-47283 CVSS 9.9 Critical
github.com/gardener/gardener< 1.116.4 → fixed in 1.116.4;github.com/gardener/gardener>= 1.117.0, < 1.117.5 → fixed in 1.117.5;github.com/gardener/gardener>= 1.118.0, < 1.118.2 → fixed in 1.118.2
npm 1
Check: npm audit (or: npm ls <package>)
- samlify SAML Signature Wrapping attack CVE-2025-47949 CVSS 9.9 Critical
samlify< 2.10.0 → fixed in 2.10.0