Aggregator

A vulnerability classified as critical has been found in Huawei HarmonyOS. This affects an unknown part of the component Fingerprint Trusted Application. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2022-41600. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability classified as critical was found in Huawei HarmonyOS. This vulnerability affects unknown code of the component Fingerprint Trusted Application. The manipulation leads to heap-based buffer overflow. This vulnerability was named CVE-2022-41601. The attack needs to be done within the local network. There is no exploit available.

A vulnerability was found in UCMS 1.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Template Management Module. The manipulation leads to file inclusion. This vulnerability is handled as CVE-2022-42234. Access to the local network is required for this attack. There is no exploit available.

A vulnerability, which was classified as critical, has been found in MikroTik RouterOS up to 6.37.4/6.38.4. This issue affects some unknown processing of the component Web Server. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2017-20149. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

三星 Galaxy 智能手机的一大特色是 DeX，模拟桌面 UI 的软件功能。当用户将三星手机连接外接显示器时，DeX 会呈现类似桌面的界面，支持键盘和鼠标控制。Google 正在开发自己的 DeX。该功能目前还在开发中，预计不会包含在今年晚些时候发布的 Android 16 正式版本，也许明年发布 Android 17 前该功能可能会做好准备。

Google has introduced Device Trust from Android Enterprise, a new solution for making sure that private Android devices used for work are secure enough to access corporate resources and data. Device Trust from Android Enterprise (Source: Google) What is Device Trust from Android Enterprise? Android Enterprise is a set of tools and APIs from Google that helps businesses securely manage Android phones and tablets used by employees for work. Key features allow: Management of work … More →

The post Google strengthens secure enterprise access from BYOD Android devices appeared first on Help Net Security.

webpack代码抠取

Willkommen and welcome to the inuaguaral Pwn2Own Berlin! Not only is this our first time at the OffensiveCon conference, but it’s also our first time including an AI category in the event. We’ve assembled some of the finest security researchers in the world to test the security of these systems, and we can’t wait to see what happens. We had our random drawing for the order of events earlier today, and from that, we have put together the following schedule. Please note that all times are local to Berlin and may change at any point.

Jump to:    Day One           Day Two           Day Three

Day One

Thursday, May 15 – 1030

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Thursday, May 15 – 1100

Pumpkin (@u1f383) from DEVCORE Research Team targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for $20000 and 2 Master of Pwn Points.

Thursday, May 15 – 1130

Chen Le Qi (@cplearns2h4ck) of STARLabs SG targeting Microsoft Windows 11 in the Local Escalation of Privilege category for $30000 and 3 Master of Pwn Points.

Thursday, May 15 – 1230

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeting Chroma in the AI category for $20000 and 2 Master of Pwn Points.

Thursday, May 15 – 1300

Hyunwoo Kim (@V4bel) and Wongi Lee (@_qwerty_po) of Theori targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for $20000 and 2 Master of Pwn Points.

Ronen Shustin (@ronenshh) Nir Ohfeld (@nirohfeld) of Wiz Research targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Thursday, May 15 – 1330

Marcin Wiązowski targeting Microsoft Windows 11 in the Local Escalation of Privilege category for $30000 and 3 Master of Pwn Points.

Thursday, May 15 – 1430

Team Prison Break (Best of the Best 13th) targeting Oracle VirtualBox in the Virtualization category for $40000 and 4 Master of Pwn Points.

Billy(@st424204) and Ramdhan(@n0psledbyte) of STAR Labs targeting Docker Desktop in the Cloud/Container category for $60000 and 6 Master of Pwn Points.

Thursday, May 15 – 1500

Viettel Cyber Security (@vcslab) targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Thursday, May 15 – 1530

Hyeonjin Choi (@d4m0n_8) of Out Of Bounds targeting Microsoft Windows 11 in the Local Escalation of Privilege category for $30000 and 3 Master of Pwn Points.

Back to top

Day Two

Friday, May 16 – 1000

Mohand Acherir & Patrick Ventuzelo (@pat_ventuzelo) of FuzzingLabs (@fuzzinglabs) targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Friday, May 16 – 1030

Dinh Ho Anh Khoa (@_l0gg) of Viettel Cyber Security targeting Microsoft SharePoint in the Server category for $100000 and 10 Master of Pwn Points.

Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG targeting VMware ESXi in the Virtualization category for $150000 and 15 Master of Pwn Points.

Friday, May 16 – 1100

Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) from Palo Alto Networks targeting Mozilla Firefox - Renderer Only in the Web Browser category for $50000 and 5 Master of Pwn Points.

Friday, May 16 – 1130

Benny Isaacs (@benny_isaacs), Nir Brakha, Sagi Tzadik (@sagitz_) of Wiz Research targeting Redis in the AI category for $40000 and 4 Master of Pwn Points.

Friday, May 16 – 1200

Ho Xuan Ninh (@Xuanninh1412) and Tri Dang (@trichimtrich) from Qrious Secure targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Friday, May 16 – 1230

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeting Microsoft SharePoint in the Server category for $100000 and 10 Master of Pwn Points.

Friday, May 16 – 1430

Viettel Cyber Security (@vcslab) targeting Oracle VirtualBox in the Virtualization category for $40000 and 4 Master of Pwn Points.

Friday, May 16 – 1500

Gerrard Tai of STAR Labs SG Pte.Ltd. targeting Red Hat Enterprise Linux for Workstations in the Local Escalation of Privilege category for $20000 and 2 Master of Pwn Points.

Friday, May 16 – 1630

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) targeting Oracle VirtualBox in the Virtualization category for $40000 and 4 Master of Pwn Points.

Back to top

Day Three

Saturday, May 17 – 1030

Angelboy (@scwuaptx) from DEVCORE Research Team targeting Microsoft Windows 11 in the Local Escalation of Privilege category for $30000 and 3 Master of Pwn Points.

Nir Ohfeld (@nirohfeld) Shir Tamari (@shirtamari) of Wiz Research targeting NVIDIA Container Toolkit in the AI category for $30000 and 3 Master of Pwn Points.

Saturday, May 17 – 1100

@namhb1 @havancuong000 @HieuTra34558978 of FPT NightWolf targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Saturday, May 17 – 1200

Manfred Paul (@[email protected]) targeting Mozilla Firefox - Renderer Only in the Web Browser category for $50000 and 5 Master of Pwn Points.

Dung and Nguyen (@MochiNishimiya) of STARLabs targeting Oracle VirtualBox with EoP with Windows kernel vulnerability addon in the Virtualization category for $90000 and 9 Master of Pwn Points.

Saturday, May 17 – 1400

Billy(@st4242404) and Bruce(@bruce30262) of STAR Labs targeting NVIDIA Triton Inference Server in the AI category for $30000 and 3 Master of Pwn Points.

Corentin BAYET (@OnlyTheDuck) from @Reverse_Tactics targeting VMware ESXi in the Virtualization category for $150000 and 15 Master of Pwn Points.

Saturday, May 17 – 1600

Thomas Bouzerar (@MajorTomSec) and Etienne Helluy-Lafont from Synacktiv (@Synacktiv) targeting VMware Workstation in the Virtualization category for $80000 and 8 Master of Pwn Points.

Miloš Ivanović (infosec.exchange/@ynwarcs) targeting Microsoft Windows 11 in the Local Escalation of Privilege category for $30000 and 3 Master of Pwn Points. 

Back to top

The Results

We’ll be blogging and tweeting results in real-time throughout the competition. Be sure to keep an eye on the blog for the latest information. We’ll also be posting live results on Twitter, Mastodon, LinkedIn, and Bluesky, so follow us on your favorite social platform for the latest news, and keep an eye on the #P2OBerlin hashtag for continuing coverage.

©2025 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

想象一下，你在求职，但你的简历在人类 HR 查看前就被 AI 拒绝了，你无从辩解。这不是科幻，而是很多人面临的现实生活。AI 正悄然影响我们的生活。随着 AI 日益强大，一个紧迫的问题是：我们是否有权摆脱 AI 的影响？选择退出 AI 不是一件简单的事情。AI 驱动着医保、交通和金融等重要系统，影响着招聘决策、租房申请、贷款、信用评分、社媒信息流、政府服务，甚至搜索时看到的新闻或信息。质疑 AI 的决策可能极其困难——可能只能在法庭上进行。选择完全退出 AI 的生活则更加困难，因为这将需要远离现代生活。很多人仅因为不符合 AI 定义的模型而面临排斥。此种情况下选择退出 AI 不再是个人选择，而是关乎在快速变化的世界中生存的问题。问题不只是关于安全，还关于自由。随着 AI 日益深入生活，问题不仅仅在于它是否有效，而在于我们是否有权决定它在我们生活中的比重。选择和退出的自由，对于在数字时代维护人的自主权至关重要。

The digital frontlines of modern conflict have expanded dramatically in 2025, with state-sponsored hackers from China, Russia, North Korea, and Iran executing sophisticated attacks against energy grids, telecommunications networks, and transportation systems worldwide. These operations, often masked as routine cybercrime, are reshaping national security paradigms while testing the resilience of democracies and allied partnerships. China’s […]

The post Global Powers Intensify Cyber Warfare with Covert Digital Strikes on Critical Systems appeared first on Cyber Security News.

Android Enterprise introduced Device Trust to enhance mobile security on Android devices

cutter: 开源工具让二进制逆向分析 by ourren

更多最新文章，请访问SecWiki

Everything you need to know about the differences between conditional access policies in Microsoft Entra ID and Okta.

A vulnerability was found in Apple QuickTime 7.0/7.0.1/7.0.2/7.0.3. It has been classified as critical. Affected is an unknown function of the component GIF Image Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2005-2340. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Sun Ray Server Software 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to an unknown weakness. This vulnerability is known as CVE-2007-6481. The attack can be launched remotely. There is no exploit available.

A vulnerability classified as critical was found in Sun JRE and JDK 1.5.0/1.6.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper access controls. This vulnerability is known as CVE-2009-2673. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Adobe ColdFusion 7.0/8.0. It has been classified as critical. This affects an unknown part. The manipulation leads to credentials management. This vulnerability is uniquely identified as CVE-2007-5905. It is possible to initiate the attack remotely. There is no exploit available.

Diesen Kuß der ganzen Welt! European Union Vulnerability Database (EUVD) launches this week. And not a moment too soon.

The post As US CVE Database Fumbles, EU ‘Replacement’ Goes Live appeared first on Security Boulevard.