Aggregator

Apple has released emergency security updates to patch a zero-day vulnerability that the company says was exploited in targeted and "extremely sophisticated" attacks. [...]

Submit #497357 / VDB-295147

Submit #497356 / VDB-295146

Submit #497355 / VDB-295145

A vulnerability was found in phjounin TFTPD64 4.64. It has been declared as problematic. This vulnerability affects unknown code of the component DNS Handler. The manipulation leads to denial of service. This vulnerability was named CVE-2025-1207. The attack needs to be done within the local network. Furthermore, there is an exploit available.

Submit #497249 / VDB-295144

A Threat Actor Claims to be Selling the Data of Cin Learn

Submit #497045 / VDB-196788

Submit #497043 / VDB-196788

A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/viewdetailroutine.php. The manipulation of the argument id leads to sql injection. This vulnerability is uniquely identified as CVE-2025-1206. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in OPC UA .NET Standard Stack and classified as critical. Affected by this issue is some unknown functionality of the component HTTPS Endpoint Handler. The manipulation leads to improper authentication. This vulnerability is handled as CVE-2024-42513. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in OPC UA .NET Standard Stack and classified as critical. Affected by this vulnerability is an unknown functionality of the component Basic128Rsa15 Security Policy. The manipulation leads to improper authentication. This vulnerability is known as CVE-2024-42512. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Amiro.CMS up to 5.4.0.0. This affects an unknown part of the component Error Message Handler. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2009-3802. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Today, an Alabama man pleaded guilty to hijacking the U.S. Securities and Exchange Commission (SEC) account on X in a January 2024 SIM swapping attack. [...]

Submit #496961 / VDB-295143

We’re just getting started down the road to the Internet of Everything (IoE.)

Related: IoT growing at a 24% clip

To get there – to fully tap the potential of a hyper-interconnected ecosystem where devices, data, AI and humans converge … (more…)

The post MY TAKE: Securing the Internet of Everything: why self-healing devices are the next frontier first appeared on The Last Watchdog.

The post MY TAKE: Securing the Internet of Everything: why self-healing devices are the next frontier appeared first on Security Boulevard.

A vulnerability, which was classified as critical, was found in cool-admin-java 1.0. Affected is an unknown function of the file /comm/upload of the component File Handler. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2024-57408. It is possible to launch the attack remotely. Furthermore, there is an exploit available.