This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-1045.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-1047.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-1046.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S24. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-49413.
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Samsung Galaxy S24. An attacker must first obtain the ability to perform activities on the target device. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2024-49421.
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Samsung Galaxy S24. An attacker must first obtain the ability to perform activities on the target device. The ZDI has assigned a CVSS rating of 5.3.
This vulnerability allows local attackers to escalate privileges on affected installations of Samsung Galaxy S24. An attacker must first obtain the ability to execute low-privileged script on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2024-49420.
What is the Vulnerability?FortiGuard Labs has observed in-the-wild attack attempts targeting CVE-2025-31161, an authentication bypass vulnerability in CrushFTP managed file transfer (MFT) software. Successful exploitation may grant attackers administrative access to the application, posing a serious threat to enterprise environments.The vulnerability is remotely exploitable, and a proof-of-concept (PoC) exploit is now publicly available. This increases the risk of rapid adoption by threat actors, including ransomware groups who have historically targeted MFT platforms like MOVEit Transfer and Cleo MFT.According to the Shadowserver Foundation, approximately 1,800 unpatched, internet-exposed CrushFTP instances remain vulnerable globally, heightening the urgency for immediate mitigation.What is the recommended Mitigation?FortiGuard Labs recommends users to apply the fix provided by the vendor and follow any instructions as mentioned on the vendor`s advisory. Limit internet exposure of MFT services wherever possible, or use CrushFTP DMZ function, and further monitor for suspicious activity or unauthorized access attempts.Affected versions include 10.0.0 to 10.8.3 and 11.0.0 to 11.3.0. Users should immediately patch to 10.8.4 or 11.3.1 and later. https://www.crushftp.com/crush11wiki/Wiki.jsp?page=UpdateWhat FortiGuard Coverage is available? FortiGuard Labs has available IPS protection for CVE-2025-31161 which detects and block attack attempts targeting CrushFTP Authentication Bypass vulnerability.FortiGuard Labs has blocked all the known Indicators of Compromise (IOCs) linked to the campaigns targeting the CrushFTP vulnerability (CVE-2025-31161).The FortiGuard Incident Response team can be engaged to help with any suspected compromise.
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Multiple vulnerabilities have been discovered Fortinet Products, the most severe of which could allow for remote code execution.
FortiAnalyzer is a log management, analytics, and reporting platform that provides organizations with a single console to manage, automate, orchestrate, and respond, enabling simplified security operations, proactive identification and remediation of risks, and complete visibility of the entire attack landscape.FortiClient Endpoint Management Server (EMS) is a centralized platform for managing and deploying FortiClient software on endpoints, providing visibility, policy enforcement, and compliance management for organizations using FortiClient for endpoint security. FortiIsolator is a browser isolation solution from Fortinet designed to protect users from zero-day malware and phishing threats delivered over the web and email by creating a visual “air gap” between the user’s browser and the web content.FortiManager is a comprehensive network management solution designed to streamline the administration, configuration, and monitoring of Fortinet devices across complex network environments.FortiOS is the Fortinet’s proprietary Operation System which is utilized across multiple product lines. FortiProxy is a secure web proxy solution that enhances network security by filtering web traffic and providing advanced threat protection.FortiSwitch Manager enables network administrators to cut through the complexities of non-FortiGate-managed FortiSwitch deployments.FortiVoice is a robust communication solution that integrates voice, conferencing, and messaging services to enhance business collaboration and productivity.FortiWeb is a web application firewall (WAF) that protects web applications and APIs from attacks that target known and unknown exploits and helps maintain compliance with regulations.
Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the affected service account. Depending on the privileges associated with the service account an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Service accounts that are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
