Aggregator

Active Directory Cheat Sheet for 2025 | Cyber Codex

不安全
9 months 1 week ago
本文提供一份2025年Ready的Active Directory战术指南，涵盖网络扫描、枚举、域发现、密码喷射攻击等技术，并结合真实实验室案例演示如何利用工具如nmap、CrackMapExec和BloodHound进行渗透测试与防御。

CVE-2025-10709 | Four-Faith Water Conservancy Informatization Platform 1.0 historyDownload.do;otheruserLogin.do;getfile fileName path traversal

VulDB Recent Entries
9 months 1 week ago
A vulnerability classified as critical was found in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. This vulnerability is identified as CVE-2025-10709. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2025-10708 | Four-Faith Water Conservancy Informatization Platform 1.0 historyDownload.do;usrlogout.do fileName path traversal

VulDB Recent Entries
9 months 1 week ago
A vulnerability classified as critical has been found in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /history/historyDownload.do;usrlogout.do. The manipulation of the argument fileName leads to path traversal. This vulnerability is referenced as CVE-2025-10708. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2025-10707 | JeecgBoot up to 3.8.2 sendMsg improper authorization

VulDB Recent Entries
9 months 1 week ago
A vulnerability described as critical has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2025-10707. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

Qilin

Dark Feed IO
9 months 1 week ago

You must login to view this content

cohenido

Valley (Easy) CTF — TryHackMe Writeup

不安全
9 months 1 week ago
文章描述了一次渗透测试中的NMAP扫描过程及其结果。通过命令`nmap -sVC -p- -T4 -v `对目标IP进行全端口扫描，并获取了服务版本和默认脚本输出。结果显示开放端口包括22（SSH）、80（HTTP）和37370（FTP），并提供了各服务的详细信息及NSE脚本结果。

My Journey to OSCP/OSCP+ exam

不安全
9 months 1 week ago
文章描述了一位网络安全爱好者通过系统学习和实践成功获得OSCP认证的经历,分享了备考过程中的策略与心得,强调了实践能力培养的重要性。

LLMs can boost cybersecurity decisions, but not for everyone

Help Net Security
9 months 1 week ago

LLMs are moving fast from experimentation to daily use in cybersecurity. Teams are starting to use them to sort through threat intelligence, guide incident response, and help analysts handle repetitive work. But adding AI into the decision-making process brings new questions: When do these tools actually improve performance, and when might they create blind spots? A new study takes a closer look at this problem. By observing how people make decisions with and without LLM … More →

The post LLMs can boost cybersecurity decisions, but not for everyone appeared first on Help Net Security.

Mirko Zorz

FileFix Campaign Uses Facebook Suspension as Bait

Ransomware DataBreachToday.com
9 months 1 week ago
Users Download Malware in Bid to Placate Meta
A newly surfaced FileFix social engineering campaign puts a new spin on ClickFix attacks by goading users into loading malware under the guise of reporting a wrongful account suspension to social media giant Facebook. Victims likely get sucked into the scam by following a link from a phishing email.

Managed ad