---
title: "Security digest: May 19, 2025"
url: https://erroneo.us/security/2025-05-19/
description: "May 19, 2025 vulnerability digest: 6 CISA KEV additions (Ivanti, MDaemon, Srimax, Synacor, ZKTeco); 4 critical advisories (Go, npm). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-05-19
date_modified: 2025-05-19
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 19, 2025

6 known exploited (cisa kev) additions and 4 critical advisories.

## Take stock

- Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM), Srimax Output Messenger, Synacor Zimbra Collaboration Suite (ZCS), MDaemon Email Server, ZKTeco BioTime. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-06-09.
- Go: 3 critical advisories ( github.com/gardener/external-dns-management , github.com/gardener/gardener-extension-shoot-dns-service , github.com/gardener/gardener ). Check with govulncheck ./... .
- npm: 1 critical advisory ( samlify ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-4428](https://erroneo.us/security/cve/CVE-2025-4428/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (CISA due 2025-06-09)
- [CVE-2025-4427](https://erroneo.us/security/cve/CVE-2025-4427/index.md) Ivanti Endpoint Manager Mobile (EPMM): Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability (CISA due 2025-06-09)
- [CVE-2025-27920](https://erroneo.us/security/cve/CVE-2025-27920/index.md) Srimax Output Messenger: Srimax Output Messenger Directory Traversal Vulnerability (CISA due 2025-06-09)
- [CVE-2024-27443](https://erroneo.us/security/cve/CVE-2024-27443/index.md) Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CISA due 2025-06-09)
- [CVE-2024-11182](https://erroneo.us/security/cve/CVE-2024-11182/index.md) MDaemon Email Server: MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability (CISA due 2025-06-09)
- [CVE-2023-38950](https://erroneo.us/security/cve/CVE-2023-38950/index.md) ZKTeco BioTime: ZKTeco BioTime Path Traversal Vulnerability (CISA due 2025-06-09)

## Critical advisories

- [CVE-2025-47282](https://erroneo.us/security/cve/CVE-2025-47282/index.md) Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation — Go github.com/gardener/external-dns-management < 0.23.6 → 0.23.6; Go github.com/gardener/gardener-extension-shoot-dns-service <= 1.6.0 → no fix
- [CVE-2025-47949](https://erroneo.us/security/cve/CVE-2025-47949/index.md) samlify SAML Signature Wrapping attack — npm samlify < 2.10.0 → 2.10.0
- [CVE-2025-47284](https://erroneo.us/security/cve/CVE-2025-47284/index.md) Gardener allows metadata injection for a project secret which can lead to privilege escalation — Go github.com/gardener/gardener < 1.116.4 → 1.116.4; Go github.com/gardener/gardener >= 1.117.0, < 1.117.5 → 1.117.5; Go github.com/gardener/gardener >= 1.118.0, < 1.118.2 → 1.118.2
- [CVE-2025-47283](https://erroneo.us/security/cve/CVE-2025-47283/index.md) Gardener allows bypassing project secret validation which can lead to privilege escalation — Go github.com/gardener/gardener < 1.116.4 → 1.116.4; Go github.com/gardener/gardener >= 1.117.0, < 1.117.5 → 1.117.5; Go github.com/gardener/gardener >= 1.118.0, < 1.118.2 → 1.118.2

---
Source page: https://erroneo.us/security/2025-05-19/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt