Aggregator

A vulnerability classified as problematic was found in ServiceNow AI Platform. This affects an unknown part. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-11450. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in ServiceNow AI Platform. Affected by this issue is some unknown functionality. This manipulation causes cross site scripting. This vulnerability appears as CVE-2025-11449. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in drupal-pattern-lab unified-twig-extensions up to 0.0.0/1.1.1. Affected by this vulnerability is an unknown functionality. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2025-11570. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in cross-zip. Affected is the function zipSync/unzipSync. The manipulation leads to path traversal. This vulnerability is documented as CVE-2025-11569. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in Buffalo NAS Navigator2 up to 3.11.x on Windows. This impacts an unknown function of the component Service. Executing manipulation can lead to unquoted search path. This vulnerability is registered as CVE-2025-61871. The attack needs to be launched locally. No exploit is available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in better-auth Better Auth up to 1.3.25. This affects an unknown function of the file /api/auth/api-key/create. Performing manipulation results in improper authorization. This vulnerability is cataloged as CVE-2025-61928. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in AVTECH IP Camera, NVR and and DVR Devices. The impacted element is an unknown function of the file CloudSetup.cgi. Such manipulation of the argument exefile leads to os command injection. This vulnerability is listed as CVE-2016-15047. The attack may be performed from remote. In addition, an exploit is available.

A lot of classic software is reaching end-of-life (EOL) this month. Windows 10, Office 2016 and Exchange Server 2016 have survived after nearly a decade of service. Not far behind, after six years in existence, comes the end of Office 2019 and Exchange Server 2019. While this Patch Tuesday may be cause for celebration at Microsoft with the final updates for these products, I hope you’ve been following this closely and have already migrated to … More →

The post October 2025 Patch Tuesday forecast: The end of a decade with Microsoft appeared first on Help Net Security.

A vulnerability was found in ossf allstar. It has been rated as critical. The affected element is an unknown function of the component Reviewbot. This manipulation causes insecure default variable initialization. This vulnerability is tracked as CVE-2025-61926. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

После 14 октября система станет уязвимой, а обновления безопасности прекратятся.

A vulnerability was found in python-social-auth social-app-django up to 5.5.x. It has been declared as problematic. Impacted is the function associate_by_email of the component Authentication Service Handler. The manipulation results in incorrect implementation of authentication algorithm. This vulnerability is identified as CVE-2025-61783. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

文章讨论了HTTP错误代码521的具体情况、原因以及解决方法。

HackerNews 编译，转载请注明出处： SonicWall 公司周三披露，未经授权的第三方访问了所有使用其云备份服务的客户的防火墙配置备份文件。 该公司表示：”这些文件包含加密的凭证和配置数据；虽然加密仍保持有效，但持有这些文件可能会增加遭受定向攻击的风险。” 该公司还指出，正在着手通知所有合作伙伴和客户，并已发布工具协助进行设备评估和补救。同时，公司也在敦促用户登录系统检查自己的设备状况。 几周前，SonicWall 曾因 MySonicWall 账户遭遇安全漏洞导致防火墙配置备份文件泄露，而敦促客户重置凭证。此次事件正是在这之后发生的。 MySonicWall 门户上提供的受影响设备列表已被分配优先级，以帮助客户确定补救工作的先后顺序。标签分类如下： 活跃 – 高优先级：启用了面向互联网服务的设备 活跃 – 低优先级：未启用面向互联网服务的设备 不活跃：90 天内未与服务器通信的设备 最新的事后分析与该公司最初的评估大相径庭。起初，该公司声称威胁行为体仅访问了不到 5% 客户存储在云端的防火墙偏好备份文件。公司当时还表示，虽然这些文件中的凭证已加密，但其中包含 “可能使攻击者更容易潜在利用相关防火墙的信息”。 目前尚不清楚有多少客户使用该云备份服务。SonicWall 尚未透露攻击何时开始，也未指明幕后黑手是谁。不过，该公司表示，此后已 “加固” 了其基础设施，增加了额外的日志记录，并引入了更强的身份验证控制，以防止类似事件再次发生。 建议用户立即采取以下步骤： 登录MySonicWall.com账户，验证已注册的防火墙是否存在云备份 如果相关字段为空，则不受影响 如果字段包含备份详情，验证受影响的序列号是否在账户中列出 如果显示了序列号，用户应按照所列防火墙的遏制和补救指南操作 SonicWall 表示，如果客户使用了云备份功能，但未显示序列号或仅显示部分已注册序列号，公司将在未来几天提供额外指导。   消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability identified as critical has been detected in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument mac leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2025-11549. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability labeled as critical has been found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. This vulnerability was named CVE-2025-11550. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability, which was classified as very critical, has been found in Newforma Project Center 2024.3. This affects an unknown function of the file /ProjectCenter.rem of the component NPCS Endpoint. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2025-35051. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability marked as critical has been reported in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This manipulation of the argument state causes sql injection. This vulnerability is tracked as CVE-2025-11530. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Understand and stop credential harvesting. Explore how attacks happen, the risks to your data, the warning signs, and crucial security steps you can take.

The post What Is Credential Harvesting? Risks and Prevention Tips appeared first on Security Boulevard.

文章介绍了错误代码521的原因及解决方法,常见原因包括服务器过载、配置问题或网络连接不稳定,建议检查网络、联系主机提供商或调整Cloudflare设置以解决问题。

HackerNews 编译，转载请注明出处： 一种名为 ClayRat 的安卓间谍软件攻击活动正迅速演变，该软件通过伪装成 WhatsApp、谷歌相册（Google Photos）、TikTok 和 YouTube 等热门应用，借助 Telegram 频道与仿冒钓鱼网站的组合手段，将俄罗斯用户列为攻击目标。 移动安全公司 Zimperium 的研究员维什努・普拉塔帕吉里在一份提交给《黑客新闻》（The Hacker News）的报告中指出：“一旦激活，该间谍软件可窃取短信、通话记录、通知和设备信息，调用前置摄像头拍照，甚至能直接从受害者设备发送短信或拨打电话。” 该恶意软件还具备自我传播功能 —— 会向受害者手机通讯录中的所有联系人发送恶意链接。这一行为表明，攻击者采用了极具攻击性的策略，将已被入侵的设备用作恶意软件的传播载体。 这家移动安全公司表示，过去 90 天内，他们已检测到不少于 600 个恶意软件样本和 50 个投放器（dropper）。且该恶意软件的每一次迭代都会新增多层混淆技术，以规避安全检测、绕过防护机制。其名称 “ClayRat” 源于可远程操控受感染设备的命令与控制面板（C2 面板）。 此次攻击链的运作流程如下：先将毫无防备的访问者重定向至攻击者控制的仿冒网站，再引导至其掌控的 Telegram 频道；在频道中，攻击者通过人为抬高下载量、发布伪造好评来伪造 “热门” 假象，诱骗用户下载 APK 安装文件。 在另一些案例中，部分仿冒网站声称提供 “YouTube 增强版”（YouTube Plus）及各类高级功能，实则暗藏 APK 文件 —— 这些文件能绕过谷歌为安卓 13 及更高版本系统设置的安全防护，突破 “禁止侧载应用” 的限制。 该公司解释道：“为绕过平台限制及新版安卓系统新增的防护壁垒，部分 ClayRat 样本以‘投放器’形式存在：用户可见的应用仅是一个轻量级安装程序，会显示伪造的谷歌应用商店（Play Store）更新界面，而真正的加密恶意载荷（payload）则隐藏在应用的资源文件中。这种基于会话的安装方式降低了用户的风险感知，从而提高了‘用户访问网页后即安装间谍软件’的成功率。” 一旦完成安装，ClayRat 会通过标准 HTTP 协议与 C2 服务器通信，并请求用户将其设为默认短信应用 —— 借此获取敏感内容的访问权限与消息功能控制权，进而秘密窃取通话记录、短信、通知，并向所有联系人进一步传播恶意软件。 该恶意软件的其他功能还包括：拨打电话、获取设备信息、调用设备摄像头拍照，以及向 C2 服务器发送设备上所有已安装应用的列表。 ClayRat 的威胁性不仅体现在其监控能力上，更在于它能自动将受感染设备转化为传播节点 —— 这使得攻击者无需任何人工干预，就能迅速扩大攻击范围。 与此同时，卢森堡大学与谢赫・安塔・迪奥普大学的学者发现，在非洲销售的经济型安卓智能手机中，部分预装应用拥有过高权限，其中某厂商提供的应用程序竟会向外部第三方传输设备标识符与位置信息。 这项研究对从 7 款非洲市场智能手机中收集的 1544 个 APK 文件进行了分析，结果显示：“145 个应用（占比 9%）会泄露敏感数据，249 个应用（占比 16%）在暴露关键组件时缺乏足够防护措施；此外，许多应用还存在其他风险：226 个应用会执行特权或危险命令，79 个应用会对短信进行操作（读取、发送或删除），33 个应用会执行静默安装操作。”   消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文