Aggregator

CVE-2024-6731 | SourceCodester Student Study Center Desk Management System 1.0 Master.php?f=save_student ID sql injection

Vuldb Updates
2 months 4 weeks ago
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. This affects an unknown part of the file /Master.php?f=save_student. The manipulation of the argument ID leads to sql injection. This vulnerability is uniquely identified as CVE-2024-6731. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2024-6732 | SourceCodester Student Study Center Desk Management System 1.0 Users.php?f=save ID sql injection

Vuldb Updates
2 months 4 weeks ago
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. This vulnerability affects unknown code of the file /sscdms/classes/Users.php?f=save. The manipulation of the argument ID leads to sql injection. This vulnerability was named CVE-2024-6732. The attack can be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2024-6729 | SourceCodester Kortex Lite Advocate Office Management System 1.0 /control/add_act.php aname sql injection

Vuldb Updates
2 months 4 weeks ago
A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /control/add_act.php. The manipulation of the argument aname leads to sql injection. This vulnerability was named CVE-2024-6729. The attack can be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-1041 | Avaya Call Management System 18.x/19.x/20.x input validation (EUVD-2025-17628)

VulDB Recent Entries
2 months 4 weeks ago
A vulnerability was found in Avaya Call Management System 18.x/19.x/20.x and classified as very critical. This issue affects some unknown processing. The manipulation leads to improper input validation. The identification of this vulnerability is CVE-2025-1041. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-4840 | WP-FeedStats inprosysmedia-likes-dislikes-post Plugin up to 1.0.0 on WordPress sql injection (EUVD-2025-17630)

VulDB Recent Entries
2 months 4 weeks ago
A vulnerability has been found in WP-FeedStats inprosysmedia-likes-dislikes-post Plugin up to 1.0.0 on WordPress and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. This vulnerability was named CVE-2025-4840. The attack can be initiated remotely. There is no exploit available.
vuldb.com

China-linked threat actor targeted +70 orgs worldwide, SentinelOne warns

Security Affairs
2 months 4 weeks ago
China-linked threat actor targeted over 70 global organizations, including governments and media, in cyber-espionage attacks from July 2024 to March 2025. In April 2025, cybersecurity firm SentinelOne warned that a China-linked threat actor, tracked as PurpleHaze, attempted to conduct reconnaissance on its infrastructure and high-value clients. The activity suggests targeted cyberespionage efforts aimed at gathering […]
Pierluigi Paganini

恶意RubyGems冒充Fastlane窃取Telegram API数据

嘶吼
2 months 4 weeks ago

两个恶意的RubyGems包伪装成流行的Fastlane CI/CD插件，将Telegram API请求重定向到攻击者控制的服务器，以拦截和窃取数据。

RubyGems是Ruby编程语言的官方包管理器，用于分发、安装和管理Ruby库（gems），类似于JavaScript的npm和Python的PyPI。

这些软件包拦截敏感数据，包括聊天id和消息内容、附加文件、代理凭证，甚至可用于劫持Telegram机器人的bot令牌。

供应链攻击是由Socket研究人员发现的，他们通过一份报告警告了Ruby开发者社区这一风险。

这两个包在RubyGems上仍然存在，它们的名字如下：

·fastlane-plugin-telegram-proxy：发布于2025年5月30日，有287次下载

·fastlane-plugin-proxy_teleram：发布于2025年5月24日，有133次下载

窃取数据的捷径

Fastlane是一个合法的开源插件，可以作为移动应用开发者的自动化工具。它用于代码签名、编译构建、应用商店上传、通知传递和元数据管理。

“Fastlane -plugin- Telegram”是一个合法的插件，允许Fastlane通过Telegram发送通知，使用在指定频道上发布的Telegram bot。

这对需要实时更新Telegram工作空间中的CI/CD管道的开发人员很有帮助，允许他们跟踪关键事件而不必检查仪表板。

在RubyGems上搜索Fastlane时出现恶意信息

Socket发现的恶意gem几乎与合法插件相同，具有相同的公共API、自述文件、文档和核心功能。唯一的区别（尽管是至关重要的区别）是将合法的Telegram API端点（https://api.telegram.org/）与攻击者的代理控制端点（粗糙微风-0c37[.]buidanhnam95[.]workers[.]dev）交换，以便截获（并且很可能收集）敏感信息。

来自项目描述

被盗数据包括bot令牌、消息数据、任何上传的文件以及配置好的代理凭证。攻击者有充分的机会进行利用和持久化，因为Telegram bot令牌在受害者手动撤销之前一直有效。

Socket注意到gems的登陆页面提到代理“不会存储或修改您的bot令牌”，然而，没有办法验证这一说法。Socket解释说：“Cloudflare Worker脚本是不公开可见的，威胁者保留了记录、检查或修改传输中的任何数据的全部能力。”

使用这个代理，再加上受信任的Fastlane插件的typposquatting，清楚地表明了在正常CI行为的幌子下窃取令牌和消息数据的意图。此外，威胁者没有公布Worker的源代码，使其实现完全不透明。

安全研究人员建议安装了这两个恶意gem的开发人员应该立即删除它们，并重新构建安装日期之后生成的任何移动二进制文件。此外，所有与Fastlane一起使用的bot令牌都应该被旋转，因为它们已被破坏。

胡金鱼

报告称全球生育率普遍下滑

Solidot
2 months 4 weeks ago
联合国人口基金(USFPA)对 14 个国家的 14000 人调查了他们的生育意愿。这 14 个国家包括了韩国、泰国、意大利、匈牙利、德国、瑞典、巴西、墨西哥、美国、印度、印度尼西亚、摩洛哥、南非和尼日利亚，其人口总数占到了全球的三分之一，既有低收入、中等收入和高收入国家，也有低生育率和高生育率的国家。调查显示，大部分人想要两个或更多孩子，而生育率下降是因为很多人认为无法建立他们想要的家庭。报告显示，39% 的人表示经济限制使他们无法生育，其中韩国最高 58%，瑞典最低 19%。USFPA 希望避免因为恐慌而制定人口政策，如因为人口太多而限制生育，比如 40 年前的中国。调查人员称，今天的低生育率、人口老龄化、人口停滞被用于推行民族主义、反移民政策和性别保守政策的借口。

NIST Launches Updated Incident Response Guide

Security Boulevard
2 months 4 weeks ago

The National Institute of Standards and Technology (NIST) has released a long-awaited update to its incident response guidance: Special Publication 800-61 Revision 3 (SP 800-61r3). This new version, titled “Incident Response Recommendations and Considerations for Cybersecurity Risk Management,” aligns closely with the latest Cybersecurity Framework (CSF) 2.0, marking a significant evolution in how organizations should […]

The post NIST Launches Updated Incident Response Guide appeared first on Kratikal Blogs - Information Hub For Cyber Security Experts.

The post NIST Launches Updated Incident Response Guide appeared first on Security Boulevard.

Puja Saikia

AI不是敌人，而是镜子

黑哥说安全
2 months 4 weeks ago
相互提示：AI与人类关系的哲学透视摘要：本文从技术哲学、意识哲学、存在论三个维度，探讨“AI与人类是相互提示（

The legal questions to ask when your systems go dark

Help Net Security
2 months 4 weeks ago

At Span Cyber Security Arena, I sat down with Iva Mišković, Partner at the ISO-certified Mišković & Mišković law firm, to discuss the role of legal teams during cyber incidents. She shared why lawyers should assume the worst, coordinate quickly, and ask the right questions to support IT. Mišković explained that a legal strategy, built on understanding tech workflows, helps lawyers build trust with CISOs and respond to cyber threats. Every cyber incident should be … More →

The post The legal questions to ask when your systems go dark appeared first on Help Net Security.

Mirko Zorz

Patero CryptoQoR mitigates risks associated with quantum attacks

Help Net Security
2 months 4 weeks ago

Patero launched CryptoQoR, a new crypto-agile software module that establishes secure communication channels and proactively mitigates security risks using hybrid post-quantum encryption. The solution can be readily deployed into existing infrastructure to improve current cryptographic protection and immediately remediate risks associated with quantum attacks. The post-quantum cryptography (PQC) market is projected to grow from $302.5 million in 2024 to $1,887.9 million by 2029. The approach to “Q-day,” the day when quantum computers can be used … More →

The post Patero CryptoQoR mitigates risks associated with quantum attacks appeared first on Help Net Security.

Industry News

Managed ad