Aggregator

全球56%制造商试点智能制造，AI质检应用率50%，网络安全跃升第二大风险。

近日，绿盟科技CERT监测到Gitblit发布安全公告，修复了Gitblit身份验证绕过漏洞（CVE-2024-28080）CVSS评分9.2，目前漏洞细节与PoC已公开，请相关用户尽快采取措施进行防护。

Check Point reports Silver Fox APT using a signed WatchDog driver flaw to disable Windows security and deliver…

A vulnerability described as critical has been identified in ns_backup Backup Plus Extension up to 13.0.2 on TYPO3. The affected element is an unknown function. The manipulation results in os command injection. This vulnerability is reported as CVE-2025-9573. The attack can be launched remotely. No exploit exists.

支持 GNOME 桌面环境项目的非盈利基金会似乎难以找到一位能长期担任执行董事的人。去年执行董事 Holly Million 在任职仅仅 10 个月之后卸任，今年的执行董事 Steven Deobald 在上任 4 个月后卸任。GNOME 基金会对此没有给出详细解释，只是很官方的表态 Steven 取得了很多成绩，但董事会认为他并不适合担任执行董事。

1960 年在希腊北部 Petralona 洞穴发现的神秘人族头骨鉴定至少有 28.6 万年历史。这块头骨是由一名当地村民发现的，它既不像尼安德特人，也不像现代人类。几十年来，所有鉴定和精确测年的尝试都未能成功，它的年龄推测范围从 17 万年到 70 万年前不等。法国古生物学家采用了铀系测年法，这种方法可测量铀同位素衰变为钍的速率。由于铀是由环境不断供应的，因此该方法在露天土壤沉积物中不太可靠。但洞穴是一个封闭的系统：随着水渗透岩石和蒸发，会留下含铀但不含钍的方解石沉积物。方解石层中的铀会随着时间衰变为钍，可用于计算初始形成时间。研究结果表明，覆盖头骨的方解石层至少在 28.6 万年前形成，误差为 9000 年。

“Onze collectieve verdediging rust niet alleen op schouders in uniform. Deze is ook afhankelijk van onder meer bedrijven, universiteiten en lokale infrastructuur.” Minister Ruben Brekelmans benadrukte dit gisteren bij de opening van het academisch jaar 2025-2026 van de TU Eindhoven.

A critical denial-of-service vulnerability in HashiCorp Vault could allow malicious actors to overwhelm servers with specially crafted JSON payloads, leading to excessive resource consumption and rendering Vault instances unresponsive.  Tracked as CVE-2025-6203 and published on August 28, 2025, the flaw affects both Vault Community and Enterprise editions from version 1.15.0 up to several patched releases.  […]

The post HashiCorp Vault Vulnerability Let Attackers to Crash Servers appeared first on Cyber Security News.

A critical flaw in the Mobile Security Framework (MobSF) has been discovered, allowing authenticated attackers to upload and execute malicious files by exploiting improper path validation.  The vulnerability, present in version 4.4.0 and patched in 4.4.1, underscores the importance of rigorous sanitization when handling user‐supplied file paths and archives. Key Takeaways1. MobSF v4.4.0 allowed attackers […]

The post MobSF Security Testing Tool Vulnerability Let Attackers Upload Malicious Files appeared first on Cyber Security News.

Web3 安全事件每月盘点。

A vulnerability marked as problematic has been reported in T-INNOVA Deporsite. Impacted is an unknown function of the file /ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage of the component POST Request Handler. The manipulation of the argument IdPersona/Foto leads to incorrect authorization. This vulnerability is documented as CVE-2025-41031. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in T-INNOVA Deporsite. This issue affects some unknown processing of the file /ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona. Executing manipulation of the argument dni can lead to incorrect authorization. This vulnerability is registered as CVE-2025-41030. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Endress+Hauser Promag 10 with HART, Promag 10 with IO-Link, Promag 10 with Modbus, Promass 10 with HART, Promass 10 with IO-Link and Promass 10 with Modbus. This vulnerability affects unknown code of the component Bluetooth. Performing manipulation results in sensitive information in log files. This vulnerability is cataloged as CVE-2025-41690. The attack must originate from the local network. There is no exploit available. You should upgrade the affected component.

The threat actor known as Silver Fox has been attributed to abuse of a previously unknown vulnerable driver associated with WatchDog Anti-malware as part of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disarming security solutions installed on compromised hosts. The vulnerable driver in question is "amsdk.sys" (version 1.0.600), a 64-bit, validly signed Windows kernel device driver

A sophisticated Windows-based keylogger known as TinkyWinkey began surfacing on underground forums in late June 2025, targeting enterprise and individual endpoints with unprecedented stealth. Unlike traditional keylogging tools that rely on simple hooks or user-mode processes, TinkyWinkey leverages dual components—a Windows service and an injected DLL payload—to remain hidden while harvesting rich contextual data. The […]

The post New TinkyWinkey Stealthily Attacking Windows Systems With Advanced Keylogging Capabilities appeared first on Cyber Security News.

A vulnerability marked as problematic has been reported in vercel next.js up to 15.1.7. This impacts an unknown function. Performing manipulation results in http request smuggling. This vulnerability is cataloged as CVE-2025-49826. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Kubernetes Kubelet. It has been rated as problematic. This issue affects some unknown processing of the component gitRepo Volume Handler. This manipulation causes improper input validation. This vulnerability is tracked as CVE-2025-1767. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Одно приложение – и цепная реакция краха. Последствия будут ощущаться годами.

Zscaler has emerged as the latest corporate victim of a supply chain attack targeting Salesforce data

A vulnerability classified as problematic was found in ImageMagick up to 6.9.13-25/7.1.1. The affected element is the function InterpretImageFilename. The manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2025-53014. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.