Aggregator

Submit #623100 / VDB-319375

Submit #622621 / VDB-319374

Submit #622573 / VDB-319374

Submit #622569 / VDB-319373

A vulnerability was found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. It has been declared as critical. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. This vulnerability was named CVE-2025-8838. The attack can be initiated remotely. Furthermore, there is an exploit available. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page."

Today we have another post about OpenHands from All Hands AI. It is a popular agent, initially named “OpenDevin”, and recently the company also provides a cloud-based service. Which is all pretty cool and exciting.

Prompt Injection to Full System Compromise

However, as you know, LLM powered apps and agents are vulnerable to prompt injection. That also applies to OpenHands and it can be hijacked by untrusted data, e.g. from a website. That impacts Confidentiality, Integrity, and Availability of the system.

Submit #622421 / VDB-319372

A vulnerability was found in JasPer up to 4.2.5. It has been classified as critical. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2025-8837. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in JasPer up to 4.2.5 and classified as problematic. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. This vulnerability is handled as CVE-2025-8836. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in JasPer up to 4.2.5 and classified as problematic. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2025-8835. It is possible to launch the attack on the local host. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

Submit #630488 / VDB-319371

Submit #630487 / VDB-319371

Submit #622409 / VDB-319370

Submit #622408 / VDB-319369

Submit #622353 / VDB-319343

关键词安全漏洞近日，安全研究人员披露，联想部分型号的内置摄像头在运行Linux系统时存在严重安全漏洞，攻击者可

关键词安全漏洞欧洲网络安全公司 Modat 发布的最新研究显示，全球超过 120 万台联网医疗设备和系统正暴露

关键词网络诈骗一家网络安全机构的深入调查揭露了一个规模空前的网络诈骗集团，他们运营着超过5,000个虚假在线药

关键词数据泄露有网友发现，沉浸式翻译扩展程序的部分用户生成快照数据被搜索引擎直接索引并公开在互联网上，其中包含