Published: 2025-11-24T18:15:49.830 Overview A high-severity vulnerability, identified as CVE-2025-13609, has been discovered in Keylime, a key establishment and attestation system. This flaw allows an attacker to register a new agent with a different Trusted Platform Module (TPM) device while claiming the UUID of an existing, legitimate agent. Successfully exploiting this vulnerability leads to agent impersonation, potentially bypassing crucial security controls and granting unauthorized access. Technical Details The vulnerability stems from insufficient validation during the agent registration process within Keylime. An attacker can leverage this by registering a new agent with a manipulated registration request. This request includes the UUID of…

Overview A critical security vulnerability, identified as CVE-2025-63958, has been discovered in MILLENSYS Vision Tools Workspace version 6.5.0.2585. This vulnerability allows unauthenticated attackers to access a sensitive configuration endpoint, exposing highly sensitive information that could lead to full system compromise. This endpoint reveals plaintext database credentials, file share paths, internal license server configuration details, and software update parameters. Technical Details The vulnerability lies in the lack of proper access controls on the /MILLENSYS/settings endpoint. This endpoint, intended for administrative purposes, is accessible without any authentication. By simply navigating to this URL, an attacker can retrieve a configuration file containing sensitive…

Overview CVE-2025-63953 describes a Cross-Site Request Forgery (CSRF) vulnerability found in the Magewell Pro Convert device, specifically in version 1.2.213. This vulnerability allows a remote attacker to arbitrarily create user accounts without the victim’s knowledge or consent by crafting a malicious GET request to the /usapi?method=add-user component. Successful exploitation can lead to unauthorized access and potential compromise of the device. Technical Details The Magewell Pro Convert device exposes an API endpoint /usapi?method=add-user that is susceptible to CSRF. The application fails to properly validate the origin of the request, allowing an attacker to forge a request on behalf of an authenticated…

Overview CVE-2025-63952 details a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Magewell Pro Convert device, specifically affecting version 1.2.213. This vulnerability resides in the /mwapi?method=add-user component and allows a remote attacker to arbitrarily create user accounts on the device. Due to the lack of proper CSRF protection, a malicious actor can craft a GET request that, when triggered by an authenticated user, will create a new account without the user’s knowledge or consent. Technical Details The vulnerability stems from the absence of CSRF tokens or other sufficient protections on the /mwapi?method=add-user endpoint. An attacker can craft a malicious HTML…

Overview CVE-2025-63435 identifies a critical security vulnerability in the Xtooltech Xtool AnyScan Android Application version 4.40.40. The vulnerability stems from a missing authentication mechanism for the server-side endpoint responsible for delivering application update packages. This lack of authentication allows any unauthenticated remote attacker to download official update packages for the application. This poses a significant security risk as it could be leveraged to deliver malicious updates to unsuspecting users. Technical Details The Xtool AnyScan application, used for vehicle diagnostics and related functions, retrieves updates from a server-side endpoint. Due to the absence of authentication requirements on this endpoint, anyone can…

Overview A severe vulnerability, identified as CVE-2025-63434, has been discovered in the Xtooltech Xtool AnyScan Android Application, versions 4.40.40 and prior. This vulnerability stems from an insecure update mechanism that allows attackers to potentially execute arbitrary code on affected devices. The application fails to properly validate the integrity and authenticity of update packages, making it susceptible to malicious updates. Technical Details The Xtool AnyScan application’s update process lacks crucial security measures. Specifically, it downloads and extracts update packages containing executable code without performing cryptographic integrity checks, such as verifying a digital signature. This absence of verification allows a malicious actor…

Overview CVE-2025-63433 identifies a critical security vulnerability affecting the Xtooltech Xtool AnyScan Android Application, specifically versions 4.40.40 and prior. This flaw stems from the use of a hardcoded cryptographic key and Initialization Vector (IV) for decrypting update metadata. This practice introduces a significant risk, allowing attackers to potentially inject malicious code into the update process, potentially compromising connected vehicles. Technical Details The Xtool AnyScan application utilizes a hardcoded key and IV to decrypt the update manifest, which dictates the source and integrity of application updates. The key is embedded directly within the application’s code as a static value. This means…

Overview CVE-2025-63432 identifies a critical security vulnerability affecting the Xtooltech Xtool AnyScan Android Application version 4.40.40 and prior. This flaw stems from a failure to properly validate the TLS certificate from the application’s update server. This lack of validation creates a significant risk, allowing attackers on the same network to conduct Man-in-the-Middle (MITM) attacks. Successfully exploiting this vulnerability can enable attackers to intercept, decrypt, and modify traffic between the app and the update server, potentially leading to Remote Code Execution (RCE) on the affected device. Technical Details The core issue lies in the Xtool AnyScan application’s inability to adequately verify…

Overview A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Openatlas, an open-source platform widely used in archaeological research. This vulnerability, tracked as CVE-2025-60917, affects versions prior to v8.12.0. It allows attackers to inject malicious scripts into the user’s browser through a crafted URL, potentially leading to unauthorized access or data compromise. Specifically, the vulnerability resides in the /overview/network/ endpoint. Technical Details The vulnerability is a reflected XSS, meaning the malicious script is embedded in a request to the server and reflected back to the user’s browser without proper sanitization. In this case, the color parameter within the /overview/network/…

Overview CVE-2025-60916 is a medium-severity reflected Cross-Site Scripting (XSS) vulnerability affecting Openatlas, an open-source platform used in archaeological research. Specifically, versions prior to v8.12.0 are susceptible. This vulnerability allows a remote attacker to inject arbitrary JavaScript code into a user’s browser session, potentially leading to data theft, session hijacking, or defacement of the application. Technical Details The vulnerability exists in the /overview/network/ endpoint of Openatlas. By crafting a malicious payload and injecting it into the charge parameter of the URL, an attacker can trigger the execution of arbitrary JavaScript code when a user clicks on the crafted link. Because the…