Aggregator

索尼发布RX1R III相机，配备6100万像素传感器及新处理器；雷蛇推出兼容NVIDIA和AMD显卡的eGPU坞；掌阅发布iReader Neo 3墨水屏阅读器；荣耀X70主打防摔防水及长续航；HMD推出149元4G手机；《赛博朋克2077》将于7月上线Mac平台。

A vulnerability, which was classified as problematic, has been found in SAP NetWeaver Application Server for ABAP up to 816. Affected by this issue is some unknown functionality. The manipulation leads to missing authorization. This vulnerability is handled as CVE-2025-42961. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in SAP NetWeaver Application Server ABAP up to 816 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to open redirect. This vulnerability was named CVE-2025-42981. The attack can be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as problematic has been found in SAP SAP NetWeaver Application Server ABAP up to 816. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-42956. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Zoom Workplace, Workplace VDI, Rooms, Rooms Controller and Meeting SDK up to 6.3.x on Windows. It has been classified as critical. Affected is an unknown function. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-2025-49465. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Google Chrome. This vulnerability affects unknown code of the component V8. The manipulation leads to integer overflow. This vulnerability was named CVE-2025-7656. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Google Chrome. This issue affects some unknown processing of the component WebRTC. The manipulation leads to use after free. The identification of this vulnerability is CVE-2025-7657. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in LZ4 up to 1.9.1. It has been rated as critical. This issue affects the function LZ4_write32. The manipulation leads to buffer overflow. The identification of this vulnerability is CVE-2019-17543. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Server up to 5.7.34/8.0.25 and classified as critical. This issue affects some unknown processing of the component LZ4. The manipulation leads to out-of-bounds write. The identification of this vulnerability is CVE-2019-17543. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

BinPool is a dataset consisting of vulnerable and patched binaries derived from historical Debian packages, compiled using four different optimization levels. It can be used for vulnerability discovery tasks through various methods, including machine...

The post BinPool: Unlock Deeper Vulnerability Discovery in Binaries with This New Dataset appeared first on Penetration Testing Tools.

複数のマイクロソフト製品には、脆弱性があります。この問題は、Microsoft Updateなどを用いて、更新プログラムを適用することで解決します。詳細は、開発者が提供する情報を参照してください。

美国网络安全和基础设施安全局（CISA）将Wing FTP Server的一个关键漏洞（CVE-2025-47812）加入已知被利用的漏洞目录。该漏洞由MITRE发布，源于空字节处理不当，允许攻击者注入恶意Lua代码并远程执行命令。此漏洞可被匿名或认证用户利用，默认以root或SYSTEM权限运行。CISA要求联邦机构于2025年8月4日前修复受影响版本（7.4.4以下）。

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Wing FTP Server flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Wing FTP Server flaw, tracked as CVE-2025-47812, to its Known Exploited Vulnerabilities (KEV) catalog. Wing FTP Server is a secure and flexible file transfer solution that supports multiple protocols, including FTP, […]

GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4. 

White Star Software Protop v4.4.2 存在本地文件包含漏洞 (LFI)，攻击者可通过 `/pt3upd/` 端点利用 URL 编码遍历序列获取任意文件。该漏洞 CVSS 评分 8.2 分，已向厂商报告并修复。

这篇文章描述了一个针对Node.js 24.x版本的路径遍历漏洞（CVE-2025-27210）的PoC脚本。该脚本通过构造恶意路径利用Windows保留设备文件名（如AUX），允许攻击者访问受限文件。

MikroTik RouterOS 7.19.1 存在反射型 XSS 漏洞（CVE-2025-6563），攻击者可通过构造恶意 URL（如 http:///login?dst=javascript:alert(3)）触发漏洞。该漏洞需用户交互，可用于钓鱼或重定向攻击。MikroTik 已确认此问题并提供修复建议。

WP Publications WordPress插件（版本≤1.2）存在存储型XSS漏洞，因未对文件名进行转义处理。高权限用户可注入JavaScript代码，在管理面板执行恶意脚本，甚至绕过多站点环境的`unfiltered_html`保护。建议更新或禁用该插件以修复漏洞。

TOTOLINK N300RB 8.54固件中存在隐藏远程支持功能漏洞，攻击者可利用静态密钥执行任意OS命令并获取root权限。

SugarCRM 14.0.0及以下版本存在SSRF和代码注入漏洞，攻击者可通过GET参数注入恶意LESS代码，导致服务器读取任意文件或触发SSRF。