Security Vulnerabilities - CVEs Published In February 2025
IBM OpenPages with Watson 8.3 and 9.0
could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit this vulnerability to gain access to sensitive information disclosed through email notifications generated by OpenPages or disrupt notification delivery.
CVSS Score
6.8
EPSS Score
0.001
Published
2025-02-20
IBM OpenPages with Watson 8.3 and 9.0
application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses.
CVSS Score
4.3
EPSS Score
0.001
Published
2025-02-20
Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file
CVSS Score
7.8
EPSS Score
0.0
Published
2025-02-20
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
CVSS Score
6.1
EPSS Score
0.0
Published
2025-02-20
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
CVSS Score
6.1
EPSS Score
0.0
Published
2025-02-20
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
CVSS Score
8.2
EPSS Score
0.002
Published
2025-02-20
Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows.
CVSS Score
8.8
EPSS Score
0.002
Published
2025-02-20
CVE-2025-24989
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.
This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
Known exploited
CVSS Score
8.2
EPSS Score
0.257
Published
2025-02-19
An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memory allocated in SampleArray::SampleArray in Mp4Fragment.cpp is not properly released.
CVSS Score
6.5
EPSS Score
0.001
Published
2025-02-19
Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in Ap4Stz2Atom.cpp.
CVSS Score
7.8
EPSS Score
0.001
Published
2025-02-19