Aggregator

A vulnerability labeled as critical has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function strcpy of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in buffer overflow. This vulnerability was named CVE-2025-10120. The attack may be performed from remote. In addition, an exploit is available.

Venezuelan President Nicolás Maduro made bold claims about cybersecurity during a press conference on September 1, 2025, as he showcased a Huawei smartphone gifted to him by Chinese President Xi Jinping. Holding up the device before international media in Caracas, Maduro declared it “the best phone in the world” and asserted that “the Americans can’t […]

The post Maduro Hails Huawei Mate X6 Gift From China as ‘Unhackable’ by U.S. appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Railway systems are the lifeblood of many economies, supporting everything from daily passenger transport to military and industrial operations, so the question arises: how secure are they from a cybersecurity perspective? Like all industries, the railway industry is undergoing its digital transformation. New technologies have improved safety and operational control over trains and tracks, but they have also introduced risks of sabotage that could lead to serious incidents, including collisions. A low-cost hack could bring … More →

The post Attackers test the limits of railway cybersecurity appeared first on Help Net Security.

Два космических аппарата против 500-тонного астероида.

A vulnerability classified as critical was found in MP4v2 2.0.0. This issue affects the function MP4StringProperty of the file mp4property.cpp. The manipulation results in double free. This vulnerability is reported as CVE-2018-14054. The attack can be launched remotely. No exploit exists.

A vulnerability was found in libmp4v2 2.1.0. It has been rated as critical. This affects the function mp4v2::impl::MP4Track::FinishSdtp of the file mp4track.cpp of the component MP4 File Handler. The manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2018-17235. The attack may be initiated remotely. There is no available exploit.

断链劫持指攻击者利用网站失效链接（如过期域名、停用社交媒体账号）获取控制权，用于篡改网站内容、钓鱼攻击或注入恶意脚本。检测时可点击链接查看是否返回404错误。

作者Swetha分享了自己进入开发、道德黑客和漏洞赏金领域的经历，并强调深入理解SQL的重要性。

AspGoat 是一个基于 ASP.NET Core 的故意漏洞 Web 应用程序，旨在帮助开发者、安全研究员和赏金猎人提升技能。它包含 OWASP Top 10 及其他漏洞的练习，并支持 Docker 快速部署。

文章探讨了包含消息体的GET请求如何导致Web缓存中毒。攻击者利用服务器对这类请求的处理漏洞，在缓存中注入恶意内容，引发跨站脚本（XSS）和基于缓存的攻击。

一位安全研究人员在浏览Freshdesk支持页面时发现了一个DOM-XSS漏洞。通过查看页面源代码，他发现一个脚本直接将API返回的tunnel.host和tunnel.ip拼接到DOM中，存在XSS风险。虽然未造成实际损害，但成功触发了alert(document.domain)。

Employees are putting sensitive data into public AI tools, and many organizations don’t have the controls to stop it. A new report from Kiteworks finds that most companies are missing basic safeguards to manage this data. Security control maturity pyramid (Source: Kiteworks) Organizations lack employee AI safeguards Only 17% of companies have technology in place to block or scan uploads to public AI tools. The other 83% depend on training sessions, email warnings, or guidelines. … More →

The post Employees keep feeding AI tools secrets they can’t take back appeared first on Help Net Security.

Microsoft починила уязвимость 2025 года ещё в 2023-м...просто потому, что могла.

Qualys has confirmed that it was recently impacted by a cybersecurity campaign targeting Salesloft and Drift, two third-party SaaS platforms that integrate with Salesforce. The company emphasized that customer data and its own production environments on the Qualys Cloud Platform remain fully secure, with no disruption to operations or services. The incident, which is described […]

The post Qualys Confirms Cyberattack Campaign Targeting Salesforce via Salesloft and Drift appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

一个开放的黑客社区，旨在帮助新手成长为资深地下技能专家，提供问答学习平台，并邀请加入Discord群组进行交流。

Two security researchers, operating under the pseudonyms BobDaHacker and BobTheShoplifter, have claimed to uncover “catastrophic” vulnerabilities in the

The post A “Catastrophic” Flaw in Burger King’s Parent Company Exposed appeared first on Penetration Testing Tools.

A critical vulnerability, CVE-2025-42957, has been identified in SAP S/4HANA, carrying a near-maximum CVSS score of 9.9. The

The post Critical SAP S/4HANA Flaw Exposes Systems to Full Compromise appeared first on Penetration Testing Tools.

On August 20, Apple released an unscheduled security update for all major platforms—iOS, iPadOS, macOS, and others. The

The post Apple Issues Urgent Patch for Zero-Click Image Flaw appeared first on Penetration Testing Tools.

Claude AI 在 8 月 5 日至 9 月 4 日间出现降智问题，影响多个模型版本。尽管开发者早在 8 月就已反馈问题，但 Anthropic 直到上周才开始调查并修复。公司否认故意限制性能，并表示感谢社区帮助解决问题。然而用户对修复延迟及未提供补偿表示不满。