Aggregator

Tomcat 是一个开源的、轻量级的 Web 应用服务器 和 Servlet 容器。

Speaker: Steven Sheffield

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite []DEF CON 32]2 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Recon Village – OSINT at Clemson: Unmasking John Mark Dougan’s Disinformation Empire appeared first on Security Boulevard.

AI系统正成为生活的重要组成部分，但存在严重漏洞。红队测试通过模拟攻击，发现并修复这些弱点，确保AI安全可靠，防止偏见决策和数据泄露等严重后果。

Cybercriminals are abusing Microsoft's Trusted Signing platform to code-sign malware executables with short-lived three-day certificates. [...]

Cybercriminals are abusing Microsoft's Trusted Signing platform to code-sign malware executables with short-lived three-day certificates. [...]

在 PC 上本地运行大模型日益流行，AMD 也推出了自己的在本地运行大模型项目 Gaia。源代码托管在 GitHub 上，采用 MIT 许可证。Gaia 目前只支持 Windows 11 Pro/Home，不支持 macOS 或 Linux。Gaia 提供了两个安装程序，一个适用于任何 Windows PC 的 Generic Mode，基于 Ollama 后端；另一个为 AMD 的 Ryzen AI 处理器进行优化的 Hybrid Mode，能利用其 NPU 和 iGPU 执行计算，以获得更好的性能。AMD 从 Zen4 APU 开始整合 NPU，但此前很少有程序能直接利用 NPU。

Currently trending CVE - Hype Score: 2 - This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to leak a user's credentials.

A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Affected is an unknown function of the file /home_employee.php. The manipulation of the argument division leads to cross site scripting. This vulnerability is traded as CVE-2025-2673. It is possible to launch the attack remotely. Furthermore, there is an exploit available. Other parameters might be affected as well.

A vulnerability was found in code-projects Payroll Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add_deductions.php. The manipulation of the argument bir leads to sql injection. The identification of this vulnerability is CVE-2025-2672. The attack may be initiated remotely. Furthermore, there is an exploit available. Other parameters might be affected as well.

A vulnerability was found in Yue Lao Blind Box 月老盲盒 up to 4.0. It has been declared as critical. This vulnerability affects the function base64image of the file /app/controller/Upload.php. The manipulation of the argument data leads to unrestricted upload. This vulnerability was named CVE-2025-2671. The attack can be initiated remotely. Furthermore, there is an exploit available.

Submit #521244 / VDB-300690

Submit #521243 / VDB-300689

Ошибка в угле скручивания подарила физикам встречу с легендарной бабочкой.

Submit #521169 / VDB-300688

A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. This vulnerability is uniquely identified as CVE-2025-2665. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in CodeZips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /suadpeted.php. The manipulation of the argument ID leads to sql injection. This vulnerability is handled as CVE-2025-2664. The attack may be launched remotely. Furthermore, there is an exploit available.

Submit #521167 / VDB-300687

Windows 10 即将于 10 月 14 日终止支持，由于微软提高了 Windows 11 的硬件需求，因此绝大多数 Windows 10 用户无法升级到 Windows 11。而根据 StatCounter 的统计，Windows 10 仍然占据了 58.7% 的份额，而 Windows 11 只有 38.13%，意味着半年之后会有数以亿计的 PC 将无法获得安全更新。微软对此有个建议，卖掉旧电脑，换新电脑。微软被发现已开始向 Windows 10 用户发送电子邮件，建议他们升级。微软称，用户的旧电脑可以通过以旧换新或交给本地组织回收；10 月 14 日之后用户的旧电脑仍然能工作，但不再能获得支持。

Submit #520780 / VDB-300686

A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /search-locker-details.php. The manipulation of the argument searchinput leads to sql injection. This vulnerability is known as CVE-2025-2663. The attack can be launched remotely. Furthermore, there is an exploit available.