May 15, 2025
2 new incidents, 2 with updates.
Started
- ClosedPatched
SAP NetWeaver: NetWeaver Deserialization Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. Added to CISA KEV on 2025-05-15.
SAP NetWeaverClosed May 15, 2025
- ClosedPatched
DrayTek Vigor Routers: Vigor Routers OS Command Injection Vulnerability
DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface. Added to CISA KEV on 2025-05-15.
DrayTek Vigor RoutersClosed May 15, 2025
Updated
- ClosedHighNo fix needed
Coinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refused
Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.
Coinbase customer support systemsClosed May 30, 2025
- ClosedPatched
SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)
A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.
SAP NetWeaver Visual ComposerClosed Apr 29, 2025
