cm0002

joined 2 years ago
MODERATOR OF
[–] [email protected] 0 points 34 minutes ago

Hm, [email protected] is already the next off-world comm in MAUs and is just shy of the .world version

I'd say just go with the flow lol

 

Introduction

This vulnerability report has been generated using data aggregated on Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently mentioned vulnerability for June 2025, based on sightings collected from various sources, including MISP, Exploit-DB, Bluesky, Mastodon, GitHub Gists, The Shadowserver Foundation, Nuclei, and more. For further details, please visit this page.

The final section focuses on exploitations observed through The Shadowserver Foundation's honeypot network.

The Month at a Glance

The June 2025 report highlights a mix of long-standing and newly identified high-risk vulnerabilities. Notably, Citrix discloses a critical NetScaler ADC/Gateway flaw (CVE-2025-5777), dubbed “CitrixBleed 2,” which can expose session tokens and bypass multi-factor authentication — echoing last year’s infamous CitrixBleed. Other urgent issues include a PayU India WordPress plugin vulnerability (CVE-2025-31022) that allows full account takeover across thousands of sites, and a Python “tarfile” library bug (CVE-2025-4517) that enables attackers to write files outside intended directories. Among the most sighted vulnerabilities are multiple Microsoft Windows 10 and Google Chrome flaws, as well as several Citrix ADC bugs, many rated “High” or “Critical.” Common web weaknesses like cross-site scripting and SQL injection (CWE-79, CWE-89) remain widespread, highlighting the ongoing need for strong patching hygiene. Some older vulnerabilities — such as the 2015 D-Link DIR-645 flaw and known Confluence or Cisco RCE bugs — also continue to see active exploitation. Organizations should prioritize remediation of these critical and actively targeted vulnerabilities, while reinforcing application security against injection and XSS attacks.

Top 10 vulnerabilities of the Month

Vulnerability Vendor Product VLAI Severity
CVE-2025-33053 Microsoft Windows 10 Version 1809 High
CVE-2025-49113 Roundcube Webmail High
CVE-2025-5777 NetScaler ADC Critical
CVE-2025-5419 Google Chrome High
CVE-2025-2783 Google Chrome High
CVE-2025-6019 Red Hat Red Hat Enterprise Linux 10 Medium
CVE-2025-33073 Microsoft Windows 10 Version 1809 High
CVE-2025-6543 NetScaler ADC Critical
CVE-2015-2051 D-Link DIR-645 Critical
CVE-2017-18368 ZyXEL P660HN-T1A Critical

Evolution of sightings per week

Top 10 Weaknesses of the Month

| CWE | Number of vulnerabilities | |


| -------------------------------------------------------- |

| CWE-79 | 659 | | CWE-89 | 411 | | CWE-74 | 342 | | CWE-119 | 190 | | CWE-862 | 157 | | CWE-352 | 157 | | CWE-120 | 105 | | CWE-94 | 94 | | CWE-22 | 86 | | CWE-98 | 74 |

Insights from Contributors

CitrixBleed 2
Citrix patched a critical vulnerability in its NetScaler ADC and NetScaler Gateway products that is already being compared to the infamous CitrixBleed flaw exploited by ransomware gangs and other cyber scum, although there haven't been any reports of active exploitation. Yet.

Security analyst Kevin Beaumont dubbed the vulnerability "CitrixBleed 2." As The Register's readers likely remember, that earlier flaw (CVE-2023-4966) allowed attackers to access a device's memory, find session tokens, and then use those to impersonate an authenticated user while bypassing multi-factor authentication — which is also possible with this new bug.

GCVE-1-2025-0002: Cl0p Ransomware Data Exfiltration Vulnerable to RCE Attacks A newly identified security vulnerability in the Cl0p ransomware group’s data exfiltration utility has exposed a critical remote code execution (RCE) flaw that security researchers and rival threat actors could potentially exploit.

The vulnerability, designated as GCVE-1-2025-0002, was published on July 1, 2025, and carries a high severity rating of 8.9 on the CVSS:4.0 scale.

Stuxnet-related CVEs

CVE-2025-31022: More details about PayU wordpress extension
"This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website."

CVE-2025-4517: Additional information
RISK : Multiple vulnerabilities affect the standard TarFile library for CPython. Currently, there is no indication that the vulnerability is actively exploited, but because it is a zero-day with a substantial install base, attackers can exploit it at any moment. An attacker could exploit flaws to bypass safety checks when extracting compressed files, allowing them to write files outside intended directories, create malicious links, or tamper with system files even when protections are supposedly enabled. Successful exploitation could lead to unauthorised access, data corruption, or malware installation, especially if your systems or third-party tools handle untrusted file uploads or archives RECOMMENDED ACTION: Patch Source: ccb.be

Continuous Exploitation

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

[–] [email protected] 2 points 1 hour ago

It's by Sako Asko, https://www.instagram.com/sakoasko but the original doesn't have any words to it, it looks just like a template already lol

It's the artist's thing, they also made the crying guy in shallow water meme

[–] [email protected] 4 points 2 hours ago

I...I need the template for that meme :o

[–] [email protected] 6 points 2 hours ago (1 children)

Drumpy has been promoting their brand new "rapidly assembled" ICE "detention facility" (read: concentration camp) that they (themselves) nicknamed "Alligator Alcatraz" in the middle of the Florida Everglades (middle-of-no-where swamp land)

[–] [email protected] 12 points 3 hours ago* (last edited 3 hours ago)

I hope all their kids/grandkids see this and never talk to them again, at the minimum

 
52
submitted 5 hours ago* (last edited 5 hours ago) by [email protected] to c/[email protected]
 
 
[–] [email protected] 0 points 1 day ago (1 children)

I frequently encounter Kuato, that user is an ardent supporter/defender of the Triad lol

However, it seems like it would limit the influence of that instance if they were to be honest about application of that label so... they refuse.

That's what it's all about, they want to spread their "message" and they take whatever steps needed to make their authoritarian "principles" hidden. Even their "What is Lemmy.ml" link in the side bar leads to a post that makes no mention of their politics, ideologies or the kind of content they truly allow. Just that it's a "niche" instance lol

I wish that I could praise the Lemmy devs for the good they have done, even while also criticizing them for the bad. However, the more that I learn the less ah... "compatible" with democratic principles their authoritarian actions seem to me.

I feel the same, it's hard to praise their good work, when there's just so much...bad vibes surrounding it.

[–] [email protected] 0 points 1 day ago

Is also the only general instance of note to do so, I love it for it, but it doesn't make enough of a statement to the outside rep of the Threadiverse to make a damn for growth purposes. And I don't think the admin of .cafe has the resources to scale either, not like .world does so it's not like we can just massively dump newcomers to it either

59
MeatGPT (meat-gpt.sonnet.io)
 
 
[–] [email protected] 11 points 1 day ago

You don't need to "jack rabbit" out, but you shouldn't be moving like a sloth either, every second of delay delays all other cars behind you and reduces overall traffic flow

[–] [email protected] 0 points 1 day ago (6 children)

Your analogy doesn't work because nobody is talking about shutting their instances down or "taking them over" they are free to have their space and network with aligned instances.

But the rest of the network is also not obligated to federate with them and allow their misinformation to spread.

[–] [email protected] 0 points 1 day ago (8 children)

Thanks, yea I know my solutions are far from perfect, but its the best I could come up with from what a "regular user" could do.

Lemmy's source code problem is a multifaceted issue. Some of it, I'm sure is done intentionally like how blocks barely function as a mute (Remember when Xitter threatened to downgrade their proper blocking to essentially what Lemmy has now? People were up in arms over it, but dessalines does it and not much more the murmurs about it) or like you said how the modlog doesn't display the mod/admin who did it anymore (though it's still available on certain UIs, like photon.lemmy.world/modlog so it's still leagues better than what Reddit has)

But then some of it, like removed posts pointlessly linking in the modlog to something that won't and will never pull up, not sure if it was done with ill intent or just a bug. After all, Rust is a fairly difficult language which leads to slow development and not a whole lot of open source devs focusing on it.

But then, that's the crux of the issue isn't it, because of their politics and behaviors nobody can be really sure whats just a bug or flaw that just hasn't been dealt with yet or done with malicious intent to benefit their own political goals

In any case, Lemmy is going to be an albatross around the Thrediverse for years, for as long as there's continued wide federation with the Triad. I think the wider Fediverse will be mostly fine because Mastodon et all will be unique enough to the average user.

But I want to see the Threadiverse grow to take on Reddit one day. And to do that we need to take care of the Tankie problem

Like I did in making a petition to defederate hexbear from Discuss.Online, perhaps you would like to petition PieFed.social to defederate Lemmy.ml? Lemmy.World never will, and likely discuss.online and all the others too, because of the software considerations - although PieFed.World might? (it has not yet: I still see lemmy.ml communities listed on it) You would be a good person to list out the references and make a cogent argument for the need to do so? [email protected] might be the best place to send it.

Oh don't worry, I've got things cooking, I just don't have unlimited time to dedicate to it. But things are in the pipeline rest assured :)

 

Tags:

  • 2025070300 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, emulator, generic, other targets)

Changes since the 2025070100 release:

  • increase virtual memory reserved for Binder buffers from 1MiB to 8MiB due to Android 16 having a very large Binder transaction scaling up based on the number of apps and profiles which can go beyond the total size limit and break fully booting the OS, which occurred for a tiny number of our Alpha testers (if you were one of the tiny number of Alpha channel testers running into this, you can sideload this release to resolve the issue)
  • fix issues with display of the end session button to avoid it being wrongly displayed for Owner or not displayed for secondary users (we may remove this part of the upstream end session UI or make it optional since the functionality is also in the power menu)
  • update Pixel USB HAL to Android 16 (this was omitted in the initial port due to needing special handling for our USB-C port and pogo pins control feature)
  • always use UTC as the time zone for build date properties
  • kernel (6.6): update to latest GKI LTS branch revision
[–] [email protected] 0 points 1 day ago (11 children)

Maybe, I'll ponder it, maybe experiment a bit. But I have not achieved my goals yet, so it's too early to end it out right

I personally blocked literally all users from lemmy.ml 9 months ago - going so far as to move to PieFed where I could actually accomplish that aim - and I have enjoyed the Threadiverse much better since then! :-) We'll be fine then, methinks.

Just blocking .ml on an individual basis, while good for individuals to not see their crap, doesn't really fix the problem. The continued spread of misinformation and attempts to enforce the narrative as "truth" by making it appear as though there's no dissent about it (on .ml).

This is harming the overall growth of the Threadiverse IMHO. New users come, aren't aware they need to block .ml and miss the threads talking about it, and then get scared off when inevitably they start going on one of their rants about how NK isn't a dictatorship. Or maybe they never come back after commenting in support of Ukraine or something (Which they continue to push the Russia narrative is being entirely run by "Nazis" and Russia was justified to invade), get dunked on and then catch a ban for it.

Russia has been talked about for having mis/disinformation campaigns for the purpose of furthering their goals for at least a decade now. We should not be a party to allowing that to spread. And I see a crap ton of various untrustworthy news sites they pass off as highly credible and will viciously defend it and censor anyone who calls it out.

[–] [email protected] 25 points 2 days ago* (last edited 2 days ago)

Yea, I truly believe that's one of the biggest blockers.

We can fix a lot of things ourselves or just with time like, lack of content, engagement etc. but without a hard-line against the tankies like wide defederation of .ml (or at least just the big ones like .world) fixing the outside reputation is going to be a tall order. Even with PieFed

view more: next ›