Aggregator

A vulnerability was found in Datalust Seq. It has been declared as problematic. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. This vulnerability is listed as CVE-2025-27912. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability identified as problematic has been detected in Datalust Seq. This impacts an unknown function. The manipulation leads to resource consumption. This vulnerability is documented as CVE-2025-27911. The attack requires being on the local network. There is not any exploit available. You should upgrade the affected component.

A vulnerability was found in newbee-mall 1.0. It has been declared as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File results in unrestricted upload. This vulnerability is reported as CVE-2025-4259. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0. It has been rated as critical. Affected by this issue is the function impsave of the file m\web\handler\admin\system\TemplateController.java. This manipulation of the argument dataFile causes deserialization. This vulnerability appears as CVE-2025-4260. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0. It has been classified as critical. Affected is the function Upload of the file \youkefu-master\src\main\java\com\ukefu\webim\web\handler\resource\MediaController.java. The manipulation of the argument imgFile leads to unrestricted upload. This vulnerability is documented as CVE-2025-4258. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability categorized as critical has been discovered in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This impacts the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlController.java. Executing manipulation can lead to missing authentication. This vulnerability is registered as CVE-2025-4018. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as critical has been detected in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authentication. This vulnerability is documented as CVE-2025-4019. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as problematic has been found in libzvbi up to 0.2.43. This issue affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. Such manipulation leads to integer overflow. This vulnerability is traded as CVE-2025-2176. The attack may be launched remotely. Furthermore, there is an exploit available. The affected component should be upgraded. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

A vulnerability marked as problematic has been reported in libzvbi up to 0.2.43. Impacted is the function vbi_search_new of the file src/search.c. Performing manipulation of the argument pat_len results in integer overflow. This vulnerability is known as CVE-2025-2177. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is suggested to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.

A vulnerability was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0 and classified as problematic. This vulnerability affects unknown code of the component CORS Handler. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerability was named CVE-2025-1083. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. It has been classified as problematic. This issue affects some unknown processing. This manipulation causes cross-site request forgery. The identification of this vulnerability is CVE-2025-1084. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

AI Actions Bypass Security Tools
Artificial intelligence-powered browsers could expose enterprises to data theft, malware distribution and unauthorized access to corporate apps, new research shows. AI browsers built to complete tasks autonomously lack the security awareness to verify whether an instruction is safe.

Also: Shutdown's Ripple Effects on Healthcare, Mounting Threats to Aging OT Systems
In this week's update, four ISMG editors discussed the fallout from the U.S. federal shutdown and the impact on state and regional cyber offices, the knock-on effects for healthcare, and the growing cyberthreats facing aging operational technology environments.

Akira Ransomware Hackers Targeting SonicWall Devices
Firewall maker SonicWall said Friday all customers who used its cloud backup services are at increased "risk of targeted attacks" following a recent cyberattack. The California firm in September disclosed that unidentified hackers launched brute-force attacks against servers storing backup files.

2 Firms Hit by Separate 2024 Attacks to Pay Total of $6.5M in Class Action Claims
A Nebraska-based revenue cycle management firm and a Swiss-based blood products manufacturer with plasma collection centers in the United States are the latest healthcare sector companies agreeing to pay multimillion dollar lawsuit settlements for two separate 2024 hacks affecting scores of patients.

Why Is Independent Verification of Non-Human Identities Crucial for Cybersecurity? When it comes to cybersecurity, how often do organizations think about their machine identities, often overlooked yet vital for robust security protocols? The management of Non-Human Identities (NHIs) is increasingly essential, emphasizing the importance of independent verification. This process ensures that these machine identities remain […]

The post Independent Verification of NHI Security: Necessary? appeared first on Entro.

The post Independent Verification of NHI Security: Necessary? appeared first on Security Boulevard.

Are You Harnessing the Full Potential of Non-Human Identities in Your Cloud Security Strategy? Non-human identities (NHIs) are revolutionizing the approach to cybersecurity strategy, particularly for organizations navigating the complexities of cloud environments. But what exactly are NHIs, and how do they fit into broaders of cloud security? Understanding Non-Human Identities: A Critical Component of […]

The post How Safe Are Your Non-Human Identities Really? appeared first on Entro.

The post How Safe Are Your Non-Human Identities Really? appeared first on Security Boulevard.

NEWARK, N.J., October 9, 2025, CyberNewswire — Lightship Security, an Applus+ Laboratories company and accredited cryptographic security test laboratory, and the OpenSSL Corporation, the co-maintainer of the OpenSSL Library, announce the submission of OpenSSL version 3.5.4 to the … (more…)

The post News alert: Lightship, OpenSSL submit OpenSSL 3.5.4 — with post-quantum crypto on board first appeared on The Last Watchdog.

The post News alert: Lightship, OpenSSL submit OpenSSL 3.5.4 — with post-quantum crypto on board appeared first on Security Boulevard.