Aggregator
Salesloft Drift compromised en masse, impacting all third-party integrations
3 months 2 weeks ago
Researchers said Google Workspace customers were hit, and noted other platforms are impacted as well. Fresh evidence proves impact was not limited to Salesforce, as Salesloft previously claimed.
The post Salesloft Drift compromised en masse, impacting all third-party integrations appeared first on CyberScoop.
Matt Kapko
Hackers Steal 4M+ TransUnion Customers' Data
3 months 2 weeks ago
The credit reporting agency said the breach was "limited to specific data elements" and didn't include credit reports or core credit information.
Kristina Beek
CVE-2025-58049 | XWiki xwiki-platform up to 16.4.7/16.10.6/17.3.x improper removal of sensitive information before storage or transfer (GHSA-9m7c-m33f-3429 / WID-SEC-2025-1919)
3 months 2 weeks ago
A vulnerability labeled as problematic has been found in XWiki xwiki-platform up to 16.4.7/16.10.6/17.3.x. The affected element is an unknown function. Such manipulation leads to improper removal of sensitive information before storage or transfer.
This vulnerability is referenced as CVE-2025-58049. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
vuldb.com
CVE-2025-57759 | Contao CMS up to 5.3.37/5.6.0 privileges management (GHSA-qqfq-7cpp-hcqj / WID-SEC-2025-1920)
3 months 2 weeks ago
A vulnerability classified as critical was found in Contao CMS up to 5.3.37/5.6.0. Affected is an unknown function. The manipulation results in improper privilege management.
This vulnerability is cataloged as CVE-2025-57759. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
vuldb.com
CVE-2025-57757 | Contao CMS up to 5.3.37/5.6.0 information disclosure (GHSA-w53m-gxvg-vx7p / WID-SEC-2025-1920)
3 months 2 weeks ago
A vulnerability described as problematic has been identified in Contao CMS up to 5.3.37/5.6.0. This affects an unknown function. Executing manipulation can lead to information disclosure.
This vulnerability is tracked as CVE-2025-57757. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
vuldb.com
CVE-2025-57758 | Contao CMS up to 5.3.37/5.6.0 Corresponding access control (GHSA-7m47-r75r-cx8v / WID-SEC-2025-1920)
3 months 2 weeks ago
A vulnerability, which was classified as critical, has been found in Contao CMS up to 5.3.37/5.6.0. Affected by this vulnerability is an unknown functionality of the component Corresponding Module. This manipulation causes improper access controls.
This vulnerability is registered as CVE-2025-57758. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
vuldb.com
CVE-2025-57756 | Contao CMS up to 4.13.55/5.3.37/5.6.0 information disclosure (GHSA-2xmj-8wmq-7475 / WID-SEC-2025-1920)
3 months 2 weeks ago
A vulnerability has been found in Contao CMS up to 4.13.55/5.3.37/5.6.0 and classified as problematic. This affects an unknown part. Performing manipulation results in information disclosure.
This vulnerability is reported as CVE-2025-57756. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
vuldb.com
CISA Adds Citrix and Git Flaws to KEV Catalogue Amid Active Exploitation
3 months 2 weeks ago
CISA has added three actively exploited vulnerabilities in Citrix and Git to its KEV Catalogue. Federal agencies must…
Deeba Ahmed
Safepay
3 months 2 weeks ago
You must login to view this content
cohenido
Windsurf MCP Integration: Missing Security Controls Put Users at Risk
3 months 2 weeks ago
Part of my default test cases for coding agents is to check how MCP integration looks like, especially if the agent can be configured to allow setting fine-grained controls for tools.
Sometimes there are basic security controls missing.
Especially when running an agent on your local computer. Stakes are much higher. And it seems important to empower users to be able to configure which actions an AI should be able to take automatically, and which ones should be suggestions that the user reviews before executing.
Pear
3 months 2 weeks ago
You must login to view this content
cohenido
CVE-2023-20644 | MediaTek MT8797 ril out-of-bounds (ALPS07628603 / EUVD-2023-24823)
3 months 2 weeks ago
A vulnerability classified as problematic was found in MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T and MT8797. This vulnerability affects unknown code of the component ril. Executing manipulation can lead to out-of-bounds read.
The identification of this vulnerability is CVE-2023-20644. The attack can only be executed locally. There is no exploit available.
Applying a patch is advised to resolve this issue.
vuldb.com
CVE-2023-20641 | MediaTek MT6879/MT6895/MT6983/MT8791/MT8791T/MT8797 ril out-of-bounds write (ALPS07629574 / EUVD-2023-24820)
3 months 2 weeks ago
A vulnerability described as critical has been identified in MediaTek MT6879, MT6895, MT6983, MT8791, MT8791T and MT8797. The impacted element is an unknown function of the component ril. The manipulation results in out-of-bounds write.
This vulnerability is known as CVE-2023-20641. Attacking locally is a requirement. No exploit is available.
A patch should be applied to remediate this issue.
vuldb.com
CVE-2023-20642 | MediaTek MT8797 ril out-of-bounds write (ALPS07628586 / EUVD-2023-24821)
3 months 2 weeks ago
A vulnerability classified as critical has been found in MediaTek MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T and MT8797. This affects an unknown function of the component ril. This manipulation causes out-of-bounds write.
This vulnerability is handled as CVE-2023-20642. It is possible to launch the attack on the local host. There is not any exploit available.
To fix this issue, it is recommended to deploy a patch.
vuldb.com
CVE-2023-20643 | MediaTek MT8797 ril out-of-bounds write (ALPS07628584 / EUVD-2023-24822)
3 months 2 weeks ago
A vulnerability, which was classified as critical, has been found in MediaTek MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6781, MT6785, MT6833, MT6853, MT6873, MT6875, MT6877, MT6891, MT6893, MT8321, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T and MT8797. Affected is an unknown function of the component ril. Performing manipulation results in out-of-bounds write.
This vulnerability was named CVE-2023-20643. The attack needs to be approached locally. There is no available exploit.
Applying a patch is the recommended action to fix this issue.
vuldb.com
South Korea Arrests Suspected Chinese Hacker Stolen Tens of Millions of Dollars from Victims
3 months 2 weeks ago
South Korean authorities have successfully extradited a Chinese national suspected of orchestrating one of the most sophisticated hacking operations targeting high-profile individuals and financial institutions. The 34-year-old suspect, identified only as Mr. G, was repatriated from Bangkok, Thailand, on August 22, 2025, following a four-month international manhunt that resulted in his arrest for allegedly stealing […]
The post South Korea Arrests Suspected Chinese Hacker Stolen Tens of Millions of Dollars from Victims appeared first on Cyber Security News.
Tushar Subhra Dutta
US targets North Korean IT worker army with new sanctions
3 months 2 weeks ago
The U.S. Treasury's Office of Foreign Assets Control (OFAC) has sanctioned two individuals and two companies associated with North Korean IT worker schemes that operate at the expense of American organizations. [...]
Bill Toulas
CVE-2025-8290 | List Subpages Plugin up to 1.0.6 on WordPress Title cross site scripting
3 months 2 weeks ago
A vulnerability classified as problematic has been found in List Subpages Plugin up to 1.0.6 on WordPress. Affected by this issue is some unknown functionality. This manipulation of the argument Title causes cross site scripting.
This vulnerability is tracked as CVE-2025-8290. The attack is possible to be carried out remotely. No exploit exists.
vuldb.com
CVE-2025-9441 | iATS Online Forms Plugin up to 1.2 on WordPress order sql injection
3 months 2 weeks ago
A vulnerability described as critical has been identified in iATS Online Forms Plugin up to 1.2 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation of the argument order results in sql injection.
This vulnerability is identified as CVE-2025-9441. The attack can be executed remotely. There is not any exploit available.
vuldb.com