Aggregator

Cybercriminals are leveraging Gamma AI, a platform for creating presentations, websites, and documents, to build sophisticated and difficult-to-detect phishing page redirectors. These malicious actors are exploiting Gamma’s advanced capabilities to host phishing redirect pages directly on the legitimate domain, gamma.app, raising concerns about the misuse of AI-powered tools in cyberattacks. The phishing scheme begins with […]

The post Hackers Exploit Gamma AI to Create Sophisticated Microsoft Themed Phishing Redirectors appeared first on Cyber Security News.

最近时间安排比较紧张，整合了各种框架的payload。

A vulnerability, which was classified as problematic, has been found in Simple SA SIMPLE.ERP up to 6.30. This issue affects some unknown processing. The manipulation leads to storing passwords in a recoverable format. The identification of this vulnerability is CVE-2024-8774. The attack may be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file /home.php. The manipulation of the argument page_name leads to cross site scripting. This vulnerability is handled as CVE-2025-1742. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in Simple SA SIMPLE.ERP up to 6.30. This vulnerability affects unknown code of the component MS SQL Protocol Handler. The manipulation leads to algorithm downgrade. This vulnerability was named CVE-2024-8773. The attack can be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

An INTERPOL-led operation, dubbed “Operation Red Card,” has resulted in the arrest of over 306 individuals suspected of involvement in various cyber crimes across seven African countries. This operation, conducted from November 2024 to February 2025, targeted mobile banking, investment, and messaging app scams, among others. The collaborative effort involved law enforcement agencies from Benin, […]

The post Operation Red Card: Authorities Arrest 300+ Linked to Cyber Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability (CVE-2025-29927) in the open source Next.js framework can be exploited by attackers to bypass authorization checks and gain unauthorized access to web pages they should no have access to (e.g., the web app’s admin panel). Vercel – the Cloud platform-as-a-Service company that develops the popular framework – has released security updates fixing it, and has advised users to upgrade as soon as possible. What is Next.js and how does CVE-2025-29927 manifest? Next.js … More →

The post Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927) appeared first on Help Net Security.

A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2025-2733. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Security Week 2025 has officially come to a close. Our updates for the week included a deep dive on our AI offering, a unified navigation experience, and an introduction to our AI Agent Cloudy.

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/wizard/getWifiNeighbour of the component HTTP POST Request Handler. The manipulation leads to command injection. This vulnerability is handled as CVE-2025-2732. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. This vulnerability is known as CVE-2025-2731. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. This vulnerability is traded as CVE-2025-2730. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The identification of this vulnerability is CVE-2025-2729. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. This vulnerability was named CVE-2025-2728. The attack can be initiated remotely. There is no exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2025-2727. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation leads to command injection. This vulnerability is handled as CVE-2025-2726. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. This vulnerability is known as CVE-2025-2725. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #520426 / VDB-300753

特朗普政府的行为降低了全世界对美国科技公司及其产品的信任度，促使越来越多的人寻找替代产品和服务，尤其是来自欧洲的替代。European Alternatives 就是一家介绍欧洲替代数字服务和产品的网站。统计数据显示，该网站至今吸引了约 200 万访客，而今年前三个月的访客人数多达 130 万，2025 年流量激增了 1100%。绝大部分人是直接访问 European Alternatives，还有 31.1 万访客是通过网友在论坛 Reddit 上的讨论过来的，Google 搜索只有 19.3 万为第三大流量来源。访问者平均在网站上停留了 2 分 47 秒，访问最多的类别是电子邮件提供商、搜索引擎、云计算平台、导航应用和网络分析服务。大部分访客来自欧洲，德国人数最多、其次是荷兰、法国和美国（10.2 万）。访客使用的浏览器是 Chrome（38.9%）、Firefox（25.7%）、Safari（22.2%） 、Microsoft Edge（5%）。

Customer success is Akamai’s priority — and our many industry awards highlight how we've empowered our partners to thrive. See what we have planned for 2025.