Cyber alerts - NHS England Digital

Published Wednesday 12 February 2025 (04:41) (updated 12 February 2025)

Ivanti Releases February 2025 Security Updates

Three advisories cover vulnerabilities and weaknesses in Ivanti Cloud Services Application (CSA), Ivanti Neurons for MDM, Ivanti Connect Secure, Policy Secure, and Secure Access Client.

CC-4623 Medium

Published Friday 14 February 2025 (02:03) (updated 14 February 2025)

Active Exploitation of Critical Vulnerability Chain in SimpleHelp

CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 can be exploited in a chain to allow full compromise of a SimpleHelp server

CC-4619 High

Published Wednesday 12 February 2025 (03:30) (updated 14 February 2025)

SonicOS SSL VPN Authentication Bypass Vulnerability (CVE-2024-53704)

A proof-of-concept exploit has been published for CVE-2024-53704, which affects SonicWall NGFWs

CC-4624 Medium

Published Wednesday 19 February 2025 (12:59) (updated 19 February 2025)

Juniper Networks Releases Out-of-Cycle Security Bulletin for Critical Vulnerability

API authentication bypass vulnerability CVE-2025-21589 affects Session Smart Router, Conductor, and WAN Assurance Managed Routers

CC-4621 Medium

Published Thursday 13 February 2025 (03:14) (updated 20 February 2025)

Palo Alto Networks Releases Security Updates for PAN-OS

Attack chain using CVE-2025-0108 and CVE-2025-0111 has been observed in the wild

CC-4622 Medium

Published Friday 14 February 2025 (03:17) (updated 21 February 2025)

Security updates released for PostgreSQL

Proof-of-concept exploit code released for SQL injection vulnerability CVE-2025-1094

CC-4617 Medium

Published Monday 24 February 2025 (01:31) (updated 24 February 2025)

F5 Releases Quarterly Security Notification (February 2025) Affecting BIG-IP Products

One of the 13 high impact advisories addresses the command injection vulnerability CVE-2025-20029, which could lead to arbitrary system command execution

CC-4625 Medium

Published Monday 24 February 2025 (03:20) (updated 24 February 2025)

Medixant Releases Security Update for RadiAnt DICOM Viewer

Successful exploitation of CVE-2025-1001 could allow an attacker to perform a machine-in-the-middle attack (MITM)

CC-3989 High

Published Friday 10 December 2021 (09:41) (updated 13 February 2025)

Log4Shell RCE Vulnerability

A critical remote code execution vulnerability in Apache Foundation Log4j 2 library

CC-4612 Medium

Published Friday 31 January 2025 (02:34) (updated 26 February 2025)

Potential Backdoor Embedded in Contec Health CMS8000 Patient Monitor Firmware

CISA has found evidence of Contec CMS8000 and re-labelled Epsimed MN-120 devices beaconing to a public IP address