Aggregator

A vulnerability was found in Nagvis up to 1.9.46 and classified as problematic. Affected is an unknown function. Executing manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2024-47090. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

作者为孩子选购学习桌时发现市面上产品各有不足，最终以不到400元的价格DIY了一张电动升降儿童学习桌，并详细记录了组装过程和效果。

非营利搜索引擎Ecosia提出以0美元收购Chrome浏览器控制权，承诺未来10年承担运营责任并将其转变为基金会运作模式。Ecosia将40%利润分给谷歌，并计划将60%用于气候和环境项目。此举旨在改善谷歌公众形象的同时推动环保事业。

光污染使全球鸟类每日鸣叫时间平均延长50分钟，影响23%地球面积，改变其昼夜活动模式。研究首次记录不同品种鸟类在不同时间和季节的变化，健康影响尚不清楚。

根据发表在《科学》期刊上的一项研究，光污染导致世界各地鸟类每天鸣叫时间变长：鸣叫时间平均延长了 50 分钟。研究人员在对 500 多种昼行性鸟类进行分析后指出，那些暴露于更多光线的鸟类（无论其暴露途径是因为眼睛大还是开放式窝巢）会以这种方式受到最大的光污染影响。科学家知道，影响地球面积 23% 的光污染正在影响由昼夜光暗周期所调控物种的个体活动模式。这项新的研究首次记录了不同品种的鸟类在不同空间和季节的这种现象。目前尚不清楚这些冲击对鸟类健康的影响是正面的、负面的还是中性的，但作者写道：“记录这些对健康的影响并遏制光污染是 21 世纪保护鸟类所面临的挑战。”研究人员分析了 260 万个鸟类（早晨）开始鸣叫和 180 万个鸟类（傍晚）停止鸣叫的观测记录。这些数据来自 BirdWeather 计划，该项目包括科学志愿者的录音、生物多样性自动监测和机器学习。

云服务商提供自身SDK和兼容OpenAI的API地址,部分模型需参考文档确认兼容性。

A vulnerability classified as critical has been found in Wavlink AC3000 M33A8.V5030.210505. The affected element is the function qos_settings of the file qos.cgi. The manipulation of the argument sel_mode leads to buffer overflow. This vulnerability is referenced as CVE-2024-39803. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability has been found in goauthentik authentik and classified as critical. Impacted is an unknown function of the component Web Interface/API. The manipulation leads to session fixiation. This vulnerability is referenced as CVE-2025-29928. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability was found in Enalean Tuleap Community Edition and Tuleap Enterprise Edition and classified as problematic. This affects an unknown part of the component FRS REST Endpoint. Executing manipulation can lead to incorrect authorization. The identification of this vulnerability is CVE-2025-30209. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Enalean Tuleap Community Edition and Tuleap Enterprise Edition. It has been classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. This vulnerability is referenced as CVE-2025-29766. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Enalean Tuleap Community Edition and Tuleap Enterprise Edition. It has been declared as problematic. This issue affects some unknown processing. The manipulation results in cross-site request forgery. This vulnerability is identified as CVE-2025-29929. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Enalean Tuleap Community Edition and Tuleap Enterprise Edition. It has been rated as problematic. Impacted is an unknown function of the component RSS Widget. This manipulation causes improper neutralization of encoded uri schemes in a web page. This vulnerability is tracked as CVE-2025-30203. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability marked as problematic has been reported in Enalean Tuleap Community Edition and Tuleap Enterprise Edition. This impacts an unknown function of the component REST API. The manipulation leads to incorrect authorization. This vulnerability is documented as CVE-2025-30155. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Bitdefender GravityZone Update Server. It has been rated as critical. The affected element is an unknown function of the component Outbound Requests Handler. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2025-2245. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability identified as critical has been detected in Checkmk up to 2.1.0p50/2.2.0p38/2.3.0p24. Affected by this issue is some unknown functionality of the component RestAPI. This manipulation causes improper neutralization of delimiters. This vulnerability is tracked as CVE-2024-38865. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability labeled as critical has been found in taisan tarzan-cms up to 1.0.0. This impacts the function Upload of the file /admin#themes of the component Add Theme Handler. Executing manipulation can lead to deserialization. This vulnerability appears as CVE-2025-1113. The attack may be performed from a remote location. In addition, an exploit is available.

A vulnerability was found in goauthentik authentik up to 2024.10.3. It has been declared as problematic. The affected element is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2024-11623. The attack may be performed from a remote location. There is no available exploit. It is recommended to upgrade the affected component.

Western Digital Corporationが提供するWestern Digital Kitfox for WindowsはWindowsサービスを登録しますが、登録されるプログラムのファイルパスは引用符で囲まれていません。

错误代码521表示服务器未响应请求,常见于网络连接超时或服务器负载过高,影响用户体验,需排查网络配置或优化服务器性能以解决问题。

HackerNews 编译，转载请注明出处： 美国知名网络犯罪团伙“散裂蜘蛛”（Scattered Spider）一名20岁成员被判处十年监禁，其涉嫌参与系列重大黑客攻击及加密货币盗窃案。诺亚·迈克尔·厄本（Noah Michael Urban）已于2025年4月对电信欺诈和严重身份盗窃指控认罪。该判决由彭博社及杰克逊维尔当地媒体News4JAX率先报道。 除120个月联邦监禁外，厄本还需接受三年监督释放，并向受害者支付1300万美元赔偿金。厄本向安全记者布莱恩·克雷布斯表示，该判决“不公正”。 厄本曾使用“Sosa”“Elijah”“King Bob”“Gustavo Fring”“Anthony Ramirez”等多个化名，于2024年1月在佛罗里达州被捕。美国司法部指出，其在2022年8月至2023年3月期间实施的电信欺诈和严重身份盗窃，造成至少五名受害者损失超80万美元。 检方称，厄本与同伙通过SIM卡劫持攻击劫持受害者加密货币账户，盗取数字资产。2024年11月，美国司法部对厄本及其他四名散裂蜘蛛成员提起刑事指控，指控其利用社会工程学手段针对美国企业员工，入侵公司网络窃取专有数据并转移数百万美元加密货币。其中同伙泰勒·罗伯特·布坎南（Tyler Robert Buchanan）已于2025年4月从西班牙引渡回美国。 当前，散裂蜘蛛已与ShinyHunters、LAPSUS$等黑客组织组成新联盟。该团伙关联更广泛的英语系网络犯罪团体“The Com”，长期从事社会工程学攻击、凭证窃取、SIM卡劫持、初始访问渗透、勒索软件部署、数据盗窃及敲诈勒索。 零狐（ZeroFox）情报副总裁亚当·达拉表示：“散裂蜘蛛惯用制造紧迫感、吸引媒体关注、威胁曝光等手段迫使受害者快速付款。定时泄露信息、倒计时威胁及嘲讽安全公司均是他们的固定策略。与其他团伙的合作使其获得更多工具、数据和基础设施，威胁性成倍放大。执法打击加剧时，这类组织往往通过合并求生，最终形成更具破坏力的联合体。” 网络安全公司Flashpoint近期分析指出，该以牟利为目的的黑客组织采取“波浪式攻击策略”——短期内集中攻击特定行业多家企业。“散裂蜘蛛的战术证明，通过社会工程学手段（如语音钓鱼、短信钓鱼、MFA疲劳攻击）针对人员而非系统漏洞进行攻击，可轻易绕过最先进的技术防御体系。”       消息来源： thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文