Aggregator

UEFI copycat of Petya/NotPetya exploiting CVE-2024-7344 discovered on VirusTotal

高吞吐量异步编译模式，性能大幅升级！

苹果在本周举行的新闻发布会上推出了新款 AirPods，改进了主动降噪，搭配了定制心率传感器，以及支持实时翻译功能。其中翻译功能需要运行 iOS 26 系统的 iPhone 15 Pro 或更新机型。但在 AirPods 正式发售时，实时翻译功能不会提供给欧盟地区的用户，也不会提供给中国大陆的用户，苹果对此没有给出太多的解释。不过苹果中国表示，中国三大电信运营商将为 iPhone Air 提供 eSIM 支持。

A vulnerability was found in cdevroe unmark up to 1.9.3. It has been rated as problematic. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation of the argument Title results in cross site scripting. This vulnerability is reported as CVE-2025-10332. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in cdevroe unmark up to 1.9.3. It has been declared as problematic. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such manipulation of the argument Title leads to cross site scripting. This vulnerability is documented as CVE-2025-10331. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in cdevroe unmark up to 1.9.3. It has been classified as problematic. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This manipulation of the argument q causes cross site scripting. This vulnerability is registered as CVE-2025-10330. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in cdevroe unmark up to 1.9.3 and classified as critical. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of the argument url results in server-side request forgery. This vulnerability is cataloged as CVE-2025-10329. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #643533 / VDB-323757

Submit #643532 / VDB-323756

Submit #643531 / VDB-323755

Submit #643529 / VDB-167287

A vulnerability has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0 and classified as critical. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. This vulnerability is listed as CVE-2025-10328. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. This vulnerability is tracked as CVE-2025-10327. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/api/playlist/single.php. Performing manipulation of the argument playlist results in os command injection. This vulnerability is identified as CVE-2025-10326. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #643527 / VDB-167287

Submit #643524 / VDB-295659

In a striking evolution of its tactics, the Sidewinder advanced persistent threat (APT) group—also known as APT-C-24 or “Rattlesnake”—has adopted a novel delivery mechanism leveraging Windows shortcut (LNK) files to orchestrate complex, multi-stage intrusions across South Asia. Active since at least 2012 and targeting governments, energy utilities, military installations, and mining operations in Pakistan, Afghanistan, […]

The post Sidewinder Hackers Exploit LNK Files to Deploy Malicious Scripts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Submit #643523 / VDB-193814

A vulnerability was found in Liferay Portal and DXP. It has been declared as problematic. This impacts an unknown function. Such manipulation of the argument remote app title leads to cross site scripting. This vulnerability is referenced as CVE-2025-43775. It is possible to launch the attack remotely. No exploit is available.

Submit #643512 / VDB-323754