Aggregator

A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. This vulnerability is known as CVE-2025-1369. The attack needs to be approached locally. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Siber Systems RoboForm Password Manager up to 9.7.3 on Android. It has been classified as critical. Affected is an unknown function. The manipulation leads to authentication bypass using alternate channel. This vulnerability is traded as CVE-2025-26700. It is possible to launch the attack on the physical device. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Learning Digital Orca HCM up to 10.x. It has been declared as very critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak authentication. This vulnerability is known as CVE-2025-1387. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Learning Digital Orca HCM up to 10.x. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. This vulnerability is handled as CVE-2025-1388. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf of the file epsdaemon of the component Autoscan USB. The manipulation leads to os command injection. This vulnerability is handled as CVE-2025-1370. An attack has to be approached locally. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. This vulnerability was named CVE-2025-1371. Attacking locally is a requirement. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2025-1377. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in melapress WP Activity Log Plugin up to 5.2.2 on WordPress. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-0924. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. This vulnerability is known as CVE-2025-1372. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in M-Files Server. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Database Driver. The manipulation leads to uncaught exception. This vulnerability is known as CVE-2025-0648. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in kylephillips Simple Locator Plugin up to 2.0.3 on WordPress. This affects an unknown part of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-12501. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in acewebx IMS Countdown Plugin up to 1.3.4 on WordPress. This vulnerability affects unknown code of the component Countdown Post Setting Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-11755. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Coppermine Photo Gallery and classified as problematic. This issue affects some unknown processing of the file db_input.php. The manipulation leads to information disclosure (Path). The identification of this vulnerability is CVE-2004-1986. An attack has to be approached locally. Furthermore, there is an exploit available.

奥斯卡影后朱丽安·摩尔（Julianne Moore）周日通过其 Instagram 透露，国防部经营的学校下架了她的第一本儿童图书《Freckleface Strawberry》，她对此表达了震惊。《Freckleface Strawberry》出版于 2007 年，带有半自传性质，讲述了一位长雀斑的 7 岁女孩从不喜欢雀斑到与雀斑和解的故事，她认识到每个人都是与众不同的。摩尔说她写这本书是为了告诉她的儿子以及其他儿童，我们都经历挣扎，但人性和社区把我们团结在一起。她是通过美国笔会（Pen America）得知这一消息的，一同被禁的还有 Kathleen Krull 有关已故大法官 Ruth Bader Ginsburg 的图画书《No Truth Without Ruth》以及 Ellis Nutt 的《Becoming Nicole》。

Бюджетный дефицит открывает ворота хакерам.

A vulnerability, which was classified as problematic, was found in Bukza Plugin up to 2.0.0 on WordPress. Affected is the function bukza of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-11759. It is possible to launch the attack remotely. There is no exploit available.

Security researchers have uncovered sophisticated malware targeting WordPress websites, leveraging hidden backdoors to enable remote code execution (RCE). These attacks exploit vulnerabilities in WordPress core features and plugins, allowing hackers to gain unauthorized access, execute arbitrary code, and maintain control over compromised sites. The findings highlight the critical need for robust security measures in WordPress […]

The post Stealthy Malware in WordPress Sites Enables Remote Code Execution by Hackers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Currently trending CVE - hypeScore: 1 - EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.

A critical security vulnerability in Xerox’s Versalink C7025 Multifunction Printer (MFP) has been uncovered, exposing enterprise networks to credential theft and lateral attacks. The flaw, discovered by Rapid7 Principal IoT Researcher Deral Heiland, enables malicious actors to intercept Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) authentication data through pass-back attacks. The vulnerabilities, […]

The post Xerox Printer Vulnerability Exposes Authentication Data Via LDAP and SMB appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft Threat Intelligence has identified a new variant of the XCSSET macOS malware, marking its first update since 2022. This sophisticated malware continues to target macOS users by infecting Xcode projects, a critical tool for Apple developers. The latest variant introduces advanced obfuscation techniques, updated persistence mechanisms, and novel infection strategies, making it more challenging […]

The post New XCSSET Malware Targets macOS Users Through Infected Xcode Projects appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.