Dire Wolf
You must login to view this content
Aggregator
Cyberattack on Maryland Transit Agency Disrupts Services for Persons with Disabilities
5 months 3 weeks ago
Authorities in the U.S. state of Maryland are investigating a cyberattack that has compromised information systems used to organize transportation services for people with disabilities. The Maryland Transit Administration (MTA) announced on social media...
The post Cyberattack on Maryland Transit Agency Disrupts Services for Persons with Disabilities appeared first on Penetration Testing Tools.
ddos
CVE-2025-1546 | BDCOM Behavior Management and Auditing System up to 20250210 operate.mds log_operate_clear start_code os command injection
5 months 3 weeks ago
A vulnerability described as critical has been identified in BDCOM Behavior Management and Auditing System up to 20250210. The impacted element is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the argument start_code results in os command injection.
This vulnerability is known as CVE-2025-1546. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com
CVE-2025-0985 | IBM MQ 9.3/9.4 Environment Variable exposure of sensitive information through environmental variables
5 months 3 weeks ago
A vulnerability categorized as problematic has been discovered in IBM MQ 9.3/9.4. This affects an unknown function of the component Environment Variable Handler. Such manipulation leads to exposure of sensitive information through environmental variables.
This vulnerability is listed as CVE-2025-0985. The attack must be carried out locally. There is no available exploit.
It is advisable to upgrade the affected component.
vuldb.com
CVE-2025-27149 | Zulip up to 9.x exposure of sensitive system information to an unauthorized control sphere
5 months 3 weeks ago
A vulnerability, which was classified as problematic, has been found in Zulip up to 9.x. Affected is an unknown function. This manipulation causes exposure of sensitive system information to an unauthorized control sphere.
This vulnerability is handled as CVE-2025-27149. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
vuldb.com
CVE-2025-30368 | Zulip up to 10.0 authorization bypass through user-controlled sql primary key (GHSA-rmhr-5ffq-qcrc)
5 months 3 weeks ago
A vulnerability described as problematic has been identified in Zulip up to 10.0. Affected is an unknown function. The manipulation results in authorization bypass through user-controlled sql primary key.
This vulnerability is reported as CVE-2025-30368. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
vuldb.com
CVE-2025-30369 | Zulip up to 10.0 API authorization bypass through user-controlled sql primary key (GHSA-fcgx-q63f-7gw4)
5 months 3 weeks ago
A vulnerability classified as problematic has been found in Zulip up to 10.0. Affected by this vulnerability is an unknown functionality of the component API. This manipulation causes authorization bypass through user-controlled sql primary key.
This vulnerability appears as CVE-2025-30369. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
vuldb.com
CVE-2025-2339 | otale Tale Blog 2.0.5 /%61dmin/api/logs improper authentication
5 months 3 weeks ago
A vulnerability categorized as problematic has been discovered in otale Tale Blog 2.0.5. Affected is an unknown function of the file /%61dmin/api/logs. Such manipulation leads to improper authentication. This vulnerability only affects products that are no longer supported by the maintainer.
This vulnerability is traded as CVE-2025-2339. The attack may be launched remotely. Furthermore, there is an exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com
CVE-2025-2340 | otale Tale Blog 2.0.5 Site Settings /options/save saveOptions Site Title cross site scripting
5 months 3 weeks ago
A vulnerability identified as problematic has been detected in otale Tale Blog 2.0.5. Affected by this vulnerability is the function saveOptions of the file /options/save of the component Site Settings. Performing manipulation of the argument Site Title results in cross site scripting. This vulnerability only affects products that are no longer supported by the maintainer.
This vulnerability is known as CVE-2025-2340. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com
CVE-2025-2337 | tbeu matio 1.5.28 src/mat.c Mat_VarPrint heap-based overflow (Issue 267 / EUVD-2025-6661)
5 months 3 weeks ago
A vulnerability was found in tbeu matio 1.5.28 and classified as critical. The affected element is the function Mat_VarPrint of the file src/mat.c. Executing manipulation can lead to heap-based buffer overflow.
This vulnerability is registered as CVE-2025-2337. It is possible to launch the attack remotely. Furthermore, an exploit is available.
vuldb.com
微软公布量子安全计划路线图：2033 年全面量子安全，比政府要求提前两年
5 months 3 weeks ago
随着量子计算的发展，当前广泛使用的加密算法（如RSA、ECC）在未来十年内可能被破解。
Hook v3: The Banking Trojan That’s Evolving into a Hybrid Ransomware-Spyware Threat
5 months 3 weeks ago
The Android mobile ecosystem has been struck by a new wave of threats driven by the evolution of the HOOK banking trojan. The latest iteration of this malicious program has gained an expanded arsenal...
The post Hook v3: The Banking Trojan That’s Evolving into a Hybrid Ransomware-Spyware Threat appeared first on Penetration Testing Tools.
ddos
CISA Adds Three Vulnerabilities to Catalog, Urges Immediate Patching
5 months 3 weeks ago
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The list includes two flaws in Citrix Session Recording and one in Git, all...
The post CISA Adds Three Vulnerabilities to Catalog, Urges Immediate Patching appeared first on Penetration Testing Tools.
ddos
The Spy on the Network: How a Chinese APT Group Is Hijacking Wi-Fi to Target Diplomats
5 months 3 weeks ago
The Chinese group UNC6384 has launched a series of attacks against diplomats in Southeast Asia and several other countries, acting in the interests of Beijing. The campaign, observed by Google Threat Intelligence Group in...
The post The Spy on the Network: How a Chinese APT Group Is Hijacking Wi-Fi to Target Diplomats appeared first on Penetration Testing Tools.
ddos
CVE-2025-9533 | TOTOLINK T10 4.1.8cu.5241_B20210927 /formLoginAuth.htm authCode improper authentication
5 months 3 weeks ago
A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to improper authentication.
This vulnerability is documented as CVE-2025-9533. The attack can be initiated remotely. Additionally, an exploit exists.
vuldb.com
Submit #635941: TOTOLINK T10 T10_V4.1.8cu.5241_B20210927 Missing Authentication [Accepted]
5 months 3 weeks ago
Submit #635941 / VDB-321552
aLtEr
CVE-2025-9532 | Portabilis i-Educar up to 2.10 /RegraAvaliacao/view ID sql injection
5 months 3 weeks ago
A vulnerability described as critical has been identified in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection.
This vulnerability is registered as CVE-2025-9532. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com
CVE-2025-9531 | Portabilis i-Educar up to 2.10 Agenda /intranet/agenda.php cod_agenda sql injection
5 months 3 weeks ago
A vulnerability marked as critical has been reported in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection.
This vulnerability is cataloged as CVE-2025-9531. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com
Home Assistant + Ubiquiti + AI = Home Automation Magic
5 months 3 weeks ago
It seems like every manufacturer of anything electrical that goes in the house wants to be part of the IoT story these days. Further, they all want their own app, which means you have to go to gazillions of bespoke software products to control your things. And they're
Troy Hunt
Submit #635801: Portabilis i-Educar 2.10 SQL Injection [Accepted]
5 months 3 weeks ago
Submit #635801 / VDB-321551
karinagante