Aggregator

在这个问题上，想必很多同业人员都会遇到。其中最理想的就是把修复开源组件漏洞定位为公司级要求，避免陷入与业务方证明漏洞危害性的对抗局面。 然而要推动成为公司标准，也绝非易事，此处我将介绍自己亲身推动的、较为理想的过程 - - 客户驱动或业务驱动。在我们服务的客户里面，有漏洞修复标准非常高的客户，曾要求CVSS≥4.0都需要修复或给出不修的理由。从侧面来看，客户的要求帮我们在内部推动产线修漏洞。 另外还可以借助公司的大事件来推动漏洞修复，又一例子是我们进行冬奥网络安全保障时，要求所有部署到现场的产品都要足够安全。于是我们趁机将SCA的扫描结果修复，安排成为其中一个专项，在大事件面前产线配合的非常好，此后我们就把这个专项纳入到日常安全测试流程中、并写成规范常态化运行。 ------------更多内容，请访问------------- 1、SDL 100问 SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 大家都有哪些SDL运营指标？ 业务系统是否可以带漏洞上线？ 日常的漏洞运营，也应该是SDL团队来做吗？ 关于开发安全BP，对开展SDL有哪些帮助？ SDL 87/100问：哪个厂商做SDL咨询服务和建设比较强？ SDL 88/100问：源代码扫描，是做仓库的全量扫描还是增量扫？ 2、SDL创新实践 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 DevSecOps实施关键：研发安全工具 从安全视角，看研发安全 数字化转型下研发安全痛点 一个思考：安全测试驱动产品安全？ 3、SDL最初实践 【SDL最初实践】开篇 【SDL最初实践】安全培训 【SDL最初实践】安全需求 【SDL最初实践】安全设计 【SDL最初实践】安全开发 【SDL最初实践】安全测试 【SDL最初实践】安全审核 【SDL最初实践】安全响应 4、安全运营实践 基于实践的安全事件简述 安全事件运营SOP：钓鱼邮件 安全事件运营SOP：网络攻击 安全事件运营SOP：蜜罐告警 安全事件运营SOP：webshell事件 安全事件运营SOP：接收漏洞事件 应急能力提升：实战应急困境与突破 应急能力提升：挖矿权限维持攻击模拟

The vulnerability marks the latest example of threat actors weaponizing exposed ASP.NET machine keys for remote injection and deserialization attacks.

Threat Attack Daily - 4th of September 2025

Ransomware Attack Update for the 4th of September 2025

APT28 hackers deploy NotDoor backdoor via Microsoft Outlook macros, using OneDrive sideloading to steal data and evade detection.

In response to the CISA Advisory (AA25-239A), AttackIQ has updated the assessment template that emulates the various post-compromise Tactics, Techniques, and Procedures (TTPs) associated with the Chinese adversary Salt Typhoon and released a new attack graph emulating the behaviors exhibited during the SparrowDoor and ShadowPad campaign in March 2025.

The post Response to CISA Advisory (AA25-239A): Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System appeared first on AttackIQ.

The post Response to CISA Advisory (AA25-239A): Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System appeared first on Security Boulevard.

secrets-store-sync-controller discloses service account tokens in logs

Osaki Medical Falls Victim to Qilin Ransomware

A vulnerability labeled as critical has been found in AbanteCart 1.4.2. The affected element is an unknown function of the file index.php. The manipulation of the argument template results in path traversal. This vulnerability is reported as CVE-2025-50971. The attack can be launched remotely. No exploit exists.

A vulnerability described as critical has been identified in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. This vulnerability is registered as CVE-2025-9532. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as critical has been reported in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection. This vulnerability is cataloged as CVE-2025-9531. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql injection. This vulnerability is listed as CVE-2025-9236. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. It has been rated as critical. This impacts the function ipv6cmd of the file /goform/setIpv6. The manipulation of the argument Ipv6PriDns/Ipv6SecDns/Ipv6StaticGateway/LanIpv6Addr/LanPrefixLen/pppoeUser/pppoePass/pppoeIdleTime/pppoeRedialPeriod/Ipv6in4_PrefixLen/LocalIpv6/RemoteIpv4/LanIPv6_Prefix/LanPrefixLen/ipv6to4Relay/ipv6rdRelay/tunrd_PrefixLen/wan_UseLinkLocal/Ipv6StaticIp/Ipv6PrefixLen leads to os command injection. This vulnerability is documented as CVE-2025-8828. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as critical has been discovered in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function um_red of the file /goform/RP_setBasicAuto. The manipulation of the argument hname results in os command injection. This vulnerability is reported as CVE-2025-8829. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as critical has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function sub_3517C of the file /goform/setWan. This manipulation of the argument Hostname causes os command injection. This vulnerability appears as CVE-2025-8830. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function RP_setBasic of the file /goform/RP_setBasic. Executing manipulation of the argument bssid can lead to os command injection. The identification of this vulnerability is CVE-2025-8821. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function wirelessBasic of the file /goform/wirelessBasic. Performing manipulation of the argument submit_SSID1 results in stack-based buffer overflow. This vulnerability was named CVE-2025-8820. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function algDisable of the file /goform/setOpMode. The manipulation of the argument opMode leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2025-8822. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function setDeviceName of the file /goform/setDeviceName. The manipulation of the argument DeviceName results in os command injection. This vulnerability is identified as CVE-2025-8823. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. It has been declared as critical. This affects the function um_inspect_cross_band of the file /goform/RP_setBasicAuto. Executing manipulation of the argument staticGateway can lead to os command injection. This vulnerability is registered as CVE-2025-8827. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.