Aggregator

Background Check Point Research (CPR) identified three security vulnerabilities in the Graphics Device Interface (GDI) in Windows. We promptly reported these issues to Microsoft, and they were addressed in the Patch Tuesday updates in May, July, and August 2025. These are the vulnerabilities: Vulnerability disclosures such as these highlight the need for proactive measures to mitigate potential risks. […]

The post Drawn to Danger: Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure appeared first on Check Point Research.

A vulnerability was found in itsourcecode Billing System 1.0. It has been declared as critical. This affects an unknown function of the file /admin/app/login_crud.php. Executing manipulation of the argument Password can lead to sql injection. This vulnerability is registered as CVE-2025-12617. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Пенсионерка поверила телефонным аферистам и отдала им все свои сбережения.

Submit #678829 / VDB-322043

A vulnerability was found in PHPGurukul News Portal 1.0. It has been classified as problematic. The impacted element is an unknown function of the file /onps/settings.py. Performing manipulation results in insertion of sensitive information into debugging code. This vulnerability is cataloged as CVE-2025-12616. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Submit #678665 / VDB-330911

A vulnerability was found in PHPGurukul News Portal 1.0 and classified as problematic. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . This vulnerability is listed as CVE-2025-12615. The attack may be performed from remote. In addition, an exploit is available.

Submit #678664 / VDB-255375

Submit #678649 / VDB-330910

A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as critical. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. This vulnerability is tracked as CVE-2025-12614. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Submit #678625 / VDB-330909

Submit #678184 / VDB-330908

这篇文章主要介绍了作者整理订阅流的方法及其效果，并分享了多个领域的资源与思考。其中包括用户体验优化的文章、QWERTY键盘布局的历史分析、如何成为博学多才的方法、AI工具隐私问题探讨以及一些工具推荐等。此外还包含了一些摘录与多媒体内容。

Valve 公布的 2025 年 10 月 Steam 硬件和软件调查显示，玩家运行的操作系统中 Linux 比例突破 3% 达到 3.05%（增加 0.41%），Windows 多年来首次跌至 95% 以内占 94.84%，OSX 占 2.11%。上一次 Linux 用户比例接近 3% 还是十年前，Linux 使用增长的趋势主要受到掌机 Steam Deck 的推动。在所有 Linux 操作系统中，Steam Deck 运行的 SteamOS 占 27%，AMD CPU 占 67.1%，英特尔占 32.89%。而在 Windows 平台，英特尔占 57.8%，AMD 占 42%。对于用户使用的语言，简体中文占 24.01%，英文占 37.96%。

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques Uncovering Qilin attack methods exposed through multiple cases     Mem3nt0 mori – The Hacking Team is back!  Insider Threats Loom […]

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government China-linked UNC6384 exploits Windows zero-day […]

“Veiligheid in Europa en het Midden-Oosten zijn nauw met elkaar verbonden.” Dat zei demissionair minister Ruben Brekelmans tijdens de IISS Manama Dialogue in Bahrein, de vooraanstaande internationale veiligheidsconferentie in het Midden-Oosten. De minister maakt momenteel samen met Commandant der Strijdkrachten (CDS) generaal Onno Eichelsheim een rondreis door het gebied. Ze bezoeken Bahrein, Qatar, Jordanië en Libanon. Het aanhalen van de banden met landen in het Midden-Oosten staat in deze reis centraal.

Речь была последним козырем человечества. Но умные машины научились проникать и туда.

CSPT全称是Client-Side Path Traversal ，即客户端路径遍历。 概念说明 CSPT 全称 Client-Side Path Traversal（客户端路径遍历），是一种针对前端应用的漏洞，核心是攻击者通过篡改 URL 参数、请求参数等，让浏览器（客户端）错误地向非预期的服务