Aggregator

Microsoft Copilot Rooted to Gain Unauthorized Root Access to its Backend System

Cyber Security News
8 months 4 weeks ago

A critical security vulnerability has been discovered in Microsoft Copilot Enterprise, allowing unauthorized users to gain root access to its backend container. This vulnerability poses a significant risk, potentially allowing malicious users to manipulate system settings, access sensitive data, and compromise the application’s integrity. The issue originated from an April 2025 update that introduced a […]

The post Microsoft Copilot Rooted to Gain Unauthorized Root Access to its Backend System appeared first on Cyber Security News.

Guru Baran

15 Best Bandwidth Monitoring Tools in 2025

Cyber Security News
8 months 4 weeks ago

Bandwidth monitoring tools are essential for managing and optimizing network performance. These tools help IT administrators track and analyze network traffic, identify potential bottlenecks, and ensure efficient bandwidth utilization. By providing real-time data on network usage, bandwidth monitoring tools enable proactive management and quick resolution of issues that could impact network performance. They offer detailed […]

The post 15 Best Bandwidth Monitoring Tools in 2025 appeared first on Cyber Security News.

CISO Advisory

CVE-2025-8133 | yanyutao0402 ChanCMS up to 3.1.2 gather.js getArticle targetUrl server-side request forgery (ICLP1K / EUVD-2025-22573)

Vuldb Updates
8 months 4 weeks ago
A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file app/modules/api/service/gather.js. The manipulation of the argument targetUrl leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2025-8133. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-8135 | itsourcecode Insurance Management System 1.0 /updateAgent.php agent_id sql injection (EUVD-2025-22577)

Vuldb Updates
8 months 4 weeks ago
A vulnerability, which was classified as critical, has been found in itsourcecode Insurance Management System 1.0. This issue affects some unknown processing of the file /updateAgent.php. The manipulation of the argument agent_id leads to sql injection. The identification of this vulnerability is CVE-2025-8135. The attack may be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-8139 | TOTOLINK A702R 4.0.0-B20230721.1521 HTTP POST Request /boafrm/formPortFw service_type buffer overflow (EUVD-2025-22581)

Vuldb Updates
8 months 4 weeks ago
A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. This vulnerability is uniquely identified as CVE-2025-8139. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-8131 | Tenda AC20 16.03.08.05 SetStaticRouteCfg list stack-based overflow (EUVD-2025-22570)

Vuldb Updates
8 months 4 weeks ago
A vulnerability was found in Tenda AC20 16.03.08.05. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. This vulnerability is known as CVE-2025-8131. The attack can be launched remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-8132 | yanyutao0402 ChanCMS up to 3.1.2 app/extend/utils.js delfile path traversal (ICLOT8 / EUVD-2025-22569)

Vuldb Updates
8 months 4 weeks ago
A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/extend/utils.js. The manipulation leads to path traversal. This vulnerability is handled as CVE-2025-8132. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

Qilin

Dark Feed IO
8 months 4 weeks ago

You must login to view this content

cohenido

微软 CEO 轻淡的回应公司裁员之谜

Solidot
8 months 4 weeks ago
微软 CEO 纳德拉（Satya Nadella）周四在给员工的备忘录中简单回应了大规模裁员引发员工担忧一事。微软在股价创新高利润创纪录向 AI 大规模投资的同时进行了大规模裁员，今年至今裁员逾 1.5 万人，其中 7 月初裁掉了 9 千人。为什么公司状况如此之好却仍然进行裁员？纳德拉使用了标准的模糊语言，没有正面回应，只是说裁员给员工带来了压力，但是进步不是沿着一条直线，是动态的，有时候不协调，但总是苛刻的，我们还是来谈谈使命吧。这是高管或政客在不愿意正面回应时使用的话术，没什么意义，他不愿意告诉员工他的薪酬是与利润和股价挂钩，而不是与员工的忠诚挂钩，裁员能让投资者或股东满意，对投资者有利，对他也有利。

CVE-2022-45442 | Sinatra up to 2.2.2/3.0.3 Header Content-Disposition code download (GHSA-8x94-hmjh-97hq / Nessus ID 242690)

Vuldb Updates
8 months 4 weeks ago
A vulnerability was found in Sinatra up to 2.2.2/3.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Header Handler. The manipulation of the argument Content-Disposition leads to download of code without integrity check. This vulnerability is known as CVE-2022-45442. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

Multiple Vulnerabilities in Tridium Niagara Framework Let Attacker to Collect Sensitive Data from the Network

Cyber Security News
8 months 4 weeks ago

Researchers identified 13 critical vulnerabilities in Tridium’s widely-deployed Niagara Framework that could allow attackers to compromise building automation systems and collect sensitive network data.  The vulnerabilities, affecting versions 4.10u10 and earlier, as well as 4.14u1 and earlier, enable attackers with network access to execute sophisticated attack chains resulting in complete system compromise, including root-level remote […]

The post Multiple Vulnerabilities in Tridium Niagara Framework Let Attacker to Collect Sensitive Data from the Network appeared first on Cyber Security News.

Florence

Managed ad