May 1, 2025

Started

• ClosedCritical✓Patched

  Apache HTTP Server: HTTP Server Improper Escaping of Output Vulnerability

  Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Added to CISA KEV on 2025-05-01.

  Apache HTTP Server·Closed May 1, 2025·updated May 1, 2025

• ClosedHigh✓Patched

  SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability

  SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. Added to CISA KEV on 2025-05-01.

  SonicWall SMA100 Appliances·Closed May 1, 2025·updated May 1, 2025