Aggregator

Currently trending CVE - Hype Score: 9 - A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device ...

Cybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by the notorious hacker group Storm-1575, also known as “Dadsec.” Since September 2023, this group has been leveraging a Phishing-as-a-Service (PhaaS) platform called Tycoon2FA to target Microsoft 365 users, aiming to harvest credentials through meticulously crafted phishing pages. This campaign, active […]

The post Dadsec Hacker Group Uses Tycoon2FA Infrastructure to Steal Office365 Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability classified as critical was found in Ahhp-Portal. Affected by this vulnerability is an unknown functionality of the file page.php. The manipulation of the argument sc leads to code injection. This vulnerability is known as CVE-2007-2428. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Microsoft Internet Explorer 4.0/4.0.1/5.0/5.0.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Security Zone Handler. The manipulation leads to improper privilege management. This vulnerability is known as CVE-2000-0061. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Agares Media phpAutoVideo 2.21. Affected is an unknown function of the file admin/frontpage_right.php. The manipulation of the argument loadadminpage leads to code injection. This vulnerability is traded as CVE-2007-6614. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

On May 30, 2025, HPE published a security advisory to address vulnerabilities in the following product: HPE OneView – versions prior to v10.00

After Hours-Long Disruption, XDR Vendor Promises Full Root Cause Analysis of Outage
Cybersecurity vendor SentinelOne suffered a major, global outage for about six hours on Thursday that disrupted its monitoring of managed response service customers' endpoints and networks, interrupted software updates and kept administrators from accessing consoles for troubleshooting purposes.

Author/Presenter: Filipi Pires

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – PasswordsCon – Cloud Attack: Dissecting Attack Paths With Graph-Mode appeared first on Security Boulevard.

As digital transformation accelerates, the integrity of authentication and verification systems faces an unprecedented challenge: hyper-realistic deepfakes. These AI-generated forgeries, which manipulate faces, voices, and documents, have evolved from niche curiosities to sophisticated tools for bypassing security protocols. By mid-2025, the global financial sector reported a 393% year-over-year increase in deepfake-enabled phishing attacks, with losses […]

The post Detecting Deepfake Threats in Authentication and Verification Systems appeared first on Cyber Security News.

A vulnerability was found in Totolink NR1800X 9.1.0u.6681_B20230703. It has been classified as critical. This affects the function urldecode. The manipulation of the argument Password leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-35388. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Estatik Mortgage Calculator Plugin up to 2.0.12 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is handled as CVE-2025-48136. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in proxymis Interview Plugin up to 1.01 on WordPress. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2025-48137. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in aptivadadev Aptivada for WP Plugin up to 2.0.0 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2025-48135. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in ShapedPlugin WP Tabs Plugin up to 2.2.11 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to deserialization. This vulnerability is handled as CVE-2025-48134. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in pencilwp X Addons for Elementor Plugin up to 1.0.14 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-48132. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component RETR Command Handler. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2025-5330. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. This vulnerability was named CVE-2025-5331. The attack can be initiated remotely. Furthermore, there is an exploit available.

A vulnerability was found in 1000 Projects Online Notice Board 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument email leads to sql injection. The identification of this vulnerability is CVE-2025-5332. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. This vulnerability affects unknown code of the file /admin/edit-post.php. The manipulation of the argument posttitle/category leads to sql injection. This vulnerability was named CVE-2024-3767. The attack can be initiated remotely. Furthermore, there is an exploit available.