Aggregator

行业迎来强监管时代，能源企业必看。

A vulnerability classified as critical was found in Linux Kernel up to 6.12.27/6.14.5/6.15-rc4. Affected by this vulnerability is the function __handle_signal_outputs of the component ptp. Executing manipulation can lead to uninitialized pointer. The identification of this vulnerability is CVE-2025-37910. The attack needs to be done within the local network. There is no exploit available. Upgrading the affected component is advised.

A vulnerability was found in Linux Kernel. It has been declared as critical. This impacts the function memcpy of the component bnxt_en. The manipulation results in memory corruption. This vulnerability is cataloged as CVE-2025-37911. The attack must originate from the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in Linux Kernel up to 6.12.27/6.14.5. This impacts the function ivpu_jobs_abort_all. Such manipulation leads to deadlock. This vulnerability is uniquely identified as CVE-2025-37907. The attack can only be initiated within the local network. No exploit exists. Upgrading the affected component is recommended.

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.27/6.14.5/6.15-rc4. This affects the function shutdown_mem_profiling. Executing manipulation can lead to allocation of resources. This vulnerability appears as CVE-2025-37908. The attacker needs to be present on the local network. There is no available exploit. The affected component should be upgraded.

A vulnerability was found in Linux Kernel up to 6.15-rc4. It has been classified as critical. This affects an unknown function of the component net. The manipulation leads to memory leak. This vulnerability is listed as CVE-2025-37909. The attack must be carried out from within the local network. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability identified as problematic has been detected in PivotX CMS 3.0.0 RC3. Affected by this vulnerability is an unknown functionality. This manipulation of the argument subtitle causes cross site scripting. The identification of this vulnerability is CVE-2025-52367. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in zhuimengshaonian wisdom-education up to 1.0.4 and classified as problematic. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoController.java. Such manipulation of the argument subjectId leads to improper authorization. This vulnerability is referenced as CVE-2025-11080. It is possible to launch the attack remotely. Furthermore, an exploit is available.

后来，我们军区继续负责把这个建筑面积达六千多平方米的工程全部搞完，做到善始善终，连同地皮一起无偿地交给了地方。省里用这个地方建立了“云南省博物馆”。

软件的安全需求是其自身安全性的源头，但往往由于客户没有足够的输入、对相关法律法规或行规不重视，所以可能做得并不好，对于不出海的产品、问题尤为突出。 在SDL运营过程中，最普遍的矛盾就是：业务设计如此、不修复，但在安全看来很危险。若是产生这种矛盾，一般都是由于设计或需求没有考虑安全性导致的，改起来很麻烦，所以最开始提出安全需求并跟进落地是十分必要的。 安全需求除了来自客户明确要求、法律法规、行业行规外，还可以结合公司的技术栈、常见安全问题来做要求，比如要求使用公司私有源中的开源组件、使用公司的开发框架进行开发、使用安全函数组件进行功能实现等。 ------------更多内容，请访问------------- 1、SDL 100问 SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 大家都有哪些SDL运营指标？ 开发安全左移和右移，哪一个更好？ SDL 97/100问：关于白盒测试，应该知道哪些正确观念？ SDL 98/100问：针对业务部门外采购的产品，要求做安全测试吗？ 2、SDL创新实践 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 DevSecOps实施关键：研发安全工具 数字化转型下研发安全痛点 一个思考：安全测试驱动产品安全？ 3、SDL最初实践 【SDL最初实践】开篇 【SDL最初实践】安全培训 【SDL最初实践】安全需求 【SDL最初实践】安全设计 【SDL最初实践】安全开发 【SDL最初实践】安全测试 【SDL最初实践】安全审核 【SDL最初实践】安全响应 4、安全运营实践 基于实践的安全事件简述 安全事件运营SOP：钓鱼邮件 安全事件运营SOP：网络攻击 安全事件运营SOP：蜜罐告警 安全事件运营SOP：webshell事件 安全事件运营SOP：接收漏洞事件

Name: FAUST CTF 2025 (an FAUST CTF event.)
Date: Sept. 27, 2025, noon — 27 Sept. 2025, 21:00 UTC  [add to calendar]
Format: Attack-Defense
On-line
Offical URL: https://2025.faustctf.net/
Rating weight: 92.50
Event organizers: FAUST

Name: DFIR Labs Digital Forensics Challenge by The DFIR Report (an DFIR Labs CTF event.)
Date: Sept. 27, 2025, 4:30 p.m. — 27 Sept. 2025, 20:30 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://dfirlabs.thedfirreport.com/dfirchallenge
Rating weight: 0
Event organizers: The DFIR Report

A ransomware attack resulted in the theft of Social Security and financial data from Union County, Ohio, impacting 45,487 people. A ransomware attack hit Union County, Ohio, and crooks stole Social Security and financial data. Officials notified 45,487 residents and staff after the security breach that occurred on May 18, 2025. After discovering the security […]

记“漏斗式”防御方法