NVD disclosure day
CVE-2025-54875
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in FreshRSS allows an unprivileged attacker to create a new administrator user if registration is enabled. This could lead to unauthorized control over the application. Readers should care because self-hosted RSS aggregators may be exposed to the internet, and this flaw could grant an attacker full admi
CVE-2025-34235
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in Vasion Print software could allow an attacker to execute malicious code with high privileges by intercepting traffic and injecting harmful drivers if a specific setting is enabled that bypasses security certificate checks. The issue is confirmed to be fixed, but the patch introduction timing is uncer
CVE-2025-34234
Halo Surface Signal: 3 out of 5 — possibly public-facing.
Vasion Print's virtual appliance and application contain hardcoded private keys used for encrypting a "SaaS Id." If an attacker can access the application's filesystem or Docker image, they can recover these keys and decrypt sensitive identifiers. While the issue is remediated, the exact patch introduction date is unco
CVE-2025-34224
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Vasion Print's virtual appliance and application, allowing unauthenticated remote attackers to reconfigure networked printers and modify device settings. This could lead to unauthorized changes to connected devices.
CVE-2025-34223
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Vasion Print Virtual Appliance contains an unauthenticated installation-time endpoint that allows an attacker to replace default administrator credentials with their own. This grants an unauthenticated remote attacker full administrative control of the system during initial setup, bypassing password policies due to har
CVE-2025-34222
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
This vulnerability in Vasion Print virtual appliances and applications allows unauthenticated attackers to manipulate TLS/SSL certificates, potentially replacing trusted root certificates or disrupting services by deleting existing ones. This could undermine the security and trust of your printing infrastructure.
CVE-2025-34221
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in Vasion Print's virtual appliance allows unauthenticated remote access to internal services by exposing Docker containers to the network. This bypasses authentication, potentially enabling credential theft, configuration changes, and code execution.
CVE-2025-34218
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
Vasion Print virtual appliances and applications expose internal Docker containers without authentication, allowing attackers to enumerate services, interact with APIs, and potentially cause information disclosure, privilege escalation, or denial-of-service. The root cause is the lack of authentication and network rest
CVE-2025-34216
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Unauthenticated REST API endpoints in Vasion Print Virtual Appliance can expose configuration files, clear-text passwords, and a cryptographic key. If an attacker obtains this key, they could craft malicious payloads to achieve remote code execution on the appliance, potentially disrupting print operations.
CVE-2025-34215
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Vasion Print Virtual Appliances allows unauthenticated attackers to upload and execute malicious firmware, leading to remote code execution. This is concerning because the appliance's private signing key is extractable, and a signed token can be obtained from a public page, enabling a full system com
CVE-2025-34211
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Vasion Print's virtual appliance and application store a hardcoded private SSL key in cleartext. Attackers with container-level access can obtain this key to decrypt TLS traffic, perform man-in-the-middle attacks, or impersonate the appliance's web UI, leading to credential interception and unauthorized access to trust
CVE-2025-34209
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability exists in Vasion Print's virtual appliance technology where a hardcoded GPG private key and passphrase, stored in cleartext, can be extracted by an attacker with administrative access. This allows the attacker to decrypt files and sign malicious firmware updates, leading to full control of the virtual a
CVE-2025-30247
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An OS command injection vulnerability in the user interface of Western Digital My Cloud NAS devices allows unauthenticated remote attackers to execute arbitrary system commands via a crafted HTTP POST request. This could lead to unauthorized system access and data modification on the affected network-attached storage p
CVE-2025-34196
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Vasion Print's virtual appliance and Windows client deployments contain hardcoded credentials that allow an attacker to impersonate the certificate authority. This can lead to man-in-the-middle attacks, enabling the interception or decryption of sensitive network communications.
CVE-2025-41244
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A local privilege escalation vulnerability affects VMware Aria Operations and VMware Tools. A local attacker with non-administrative access to a virtual machine with specific configurations could gain root privileges, potentially impacting data confidentiality and integrity. This presents a business risk by allowing un