Aggregator

Crooks exploit Meta malvertising to target Android users with Brokewell

Security Affairs
2 months ago
Cybercriminals spread Brokewell via fake TradingView Premium ads on Meta, stealing crypto and data with remote control since July 2024. Bitdefender warns threat actors are abusing Meta ads to spread fake TradingView Premium apps for Android, delivering Brokewell malware to steal crypto and data. “Bitdefender researchers recently uncovered a wave of malicious ads on Facebook […]
Pierluigi Paganini

SUSE Fleet: Plain Text Storage of Vulnerability Exploit Helm Values

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
2 months ago

A high-severity vulnerability in SUSE’s Fleet, a GitOps management tool for Kubernetes clusters, has been disclosed by security researcher samjustus via GitHub Security Advisory GHSA-6h9x-9j5v-7w9h. The vulnerability, tracked as CVE-2024-52284, allows Helm chart values—often containing sensitive credentials—to be stored inside BundleDeployment resources in plain text, exposing them to any user with GET or LIST permissions. […]

The post SUSE Fleet: Plain Text Storage of Vulnerability Exploit Helm Values appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Mayura Kathir

CVE-2025-9799 | Langfuse up to 3.88.0 Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery (Issue 8522 / EUVD-2025-26361)

VulDB Recent Entries
2 months ago
A vulnerability, which was classified as critical, has been found in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. This vulnerability was named CVE-2025-9799. The attack may be initiated remotely. In addition, an exploit is available.
vuldb.com

Google Web Designer Vulnerability Lets Hackers Take Over Client Systems

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
2 months ago

A critical client-side remote code execution (RCE) vulnerability in Google Web Designer exposed Windows users to full system compromise, according to a detailed write-up by security researcher Balint Magyar. Affecting versions prior to 16.4.0.0711 (released July 29, 2025), the flaw allowed attackers to inject malicious CSS into a configuration file and leverage an internal API […]

The post Google Web Designer Vulnerability Lets Hackers Take Over Client Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

CVE-2025-36133 | IBM App Connect Enterprise Certified Container up to 11.6.0/12.0.14/12.14.0 Installation log file (EUVD-2025-26340 / WID-SEC-2025-1939)

VulDB Recent Entries
2 months ago
A vulnerability classified as problematic was found in IBM App Connect Enterprise Certified Container up to 11.6.0/12.0.14/12.14.0. Affected is an unknown function of the component Installation Handler. Such manipulation leads to sensitive information in log files. This vulnerability is uniquely identified as CVE-2025-36133. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is advised.
vuldb.com

Hackers Threaten Google Following Data Exposure

Security Boulevard
2 months ago

A recent breach involving a third-party Salesforce system used by Google has sparked an unusual escalation. Although no Gmail inboxes, passwords, or internal Google systems were accessed, attackers gained entry to a sales database that included names, phone numbers, email addresses, and internal notes related to small business clients. This type of data is often […]

The post Hackers Threaten Google Following Data Exposure appeared first on Centraleyes.

The post Hackers Threaten Google Following Data Exposure appeared first on Security Boulevard.

Rebecca Kappel

Phishing Campaign Exploits Ads to Breach Hotel Property Management Systems

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
2 months ago

A sophisticated malvertising campaign has emerged that specifically targets hoteliers and vacation rental operators by impersonating well-known service providers. Okta Threat Intelligence reports that attackers have used malicious search engine advertisements—particularly sponsored ads on Google Search—to lure unsuspecting hospitality professionals to counterfeit login portals. The ultimate goal: harvesting credentials for cloud-based property management and guest […]

The post Phishing Campaign Exploits Ads to Breach Hotel Property Management Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Mayura Kathir

When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider

The Hackers News
2 months ago
As enterprises continue to shift their operations to the browser, security teams face a growing set of cyber challenges. In fact, over 80% of security incidents now originate from web applications accessed via Chrome, Edge, Firefox, and other browsers. One particularly fast-evolving adversary, Scattered Spider, has made it their mission to wreak havoc on enterprises by specifically targeting
The Hacker News

1st September – Threat Intelligence Report

Check Point Research
2 months ago

For the latest discoveries in cyber research for the week of 1st September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES American consumer credit reporting agency TransUnion has suffered a data breach that resulted in the exposure of sensitive personal information for over 4.4 million individuals in the United States. The leaked data […]

The post 1st September – Threat Intelligence Report appeared first on Check Point Research.

[email protected]

CVE-2025-9797 | mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0 Edit Product Page /admin/product/edit/ injection (Issue 288 / EUVD-2025-26362)

VulDB Recent Entries
2 months ago
A vulnerability classified as problematic has been found in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. This vulnerability is handled as CVE-2025-9797. The attack can be initiated remotely. Additionally, an exploit exists. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
vuldb.com

CVE-2025-9796 | thinkgem JeeSite up to 5.12.1 EncodeUtils.java decodeUrl2 cross site scripting (Issue 33 / EUVD-2025-26363)

VulDB Recent Entries
2 months ago
A vulnerability described as problematic has been identified in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. This vulnerability is known as CVE-2025-9796. It is possible to launch the attack remotely. Furthermore, an exploit is available. Upgrading the affected component is recommended.
vuldb.com

Managed ad