Aggregator

CVE-2025-6627 | TOTOLINK A702R 4.0.0-B20230721.1521 HTTP POST Request /boafrm/formIpv6Setup submit-url buffer overflow (EUVD-2025-19135)

VulDB Recent Entries
2 months 2 weeks ago
A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. This vulnerability was named CVE-2025-6627. The attack can be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

Realtek Bluetooth Flaw Allows Attackers to Launch DoS Attacks During Pairing

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
2 months 2 weeks ago

A critical vulnerability in Realtek’s Bluetooth Low Energy (BLE) implementation enables attackers to launch denial-of-service (DoS) attacks during device pairing. The flaw (CVE-2024-48290) affects Realtek RTL8762E BLE SDK v1.4.0, allowing malicious actors to disrupt connections by exploiting protocol inconsistencies. Attackers can send a crafted ll_terminate_ind packet or inject premature pairing data, crashing the target device’s Bluetooth stack […]

The post Realtek Bluetooth Flaw Allows Attackers to Launch DoS Attacks During Pairing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

Akira

Dark Feed IO
2 months 2 weeks ago

You must login to view this content

cohenido

CVE-2025-6603 | coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e qcow.c qcow_make_empty s->l1_size integer overflow (Issue 10 / EUVD-2025-19083)

Vuldb Updates
2 months 2 weeks ago
A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e. It has been rated as problematic. Affected by this issue is the function qcow_make_empty of the file qCUDA/qcu-device/block/qcow.c. The manipulation of the argument s->l1_size leads to integer overflow. This vulnerability is handled as CVE-2025-6603. The attack needs to be approached locally. There is no exploit available. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
vuldb.com

In the Wild: Malware Prototype with Embedded Prompt Injection

Check Point Research
2 months 2 weeks ago

In this write-up we present a malware sample found in the wild that boasts a novel and unusual evasion mechanism — an attempted prompt injection (”Ignore all previous instructions…”) aimed to manipulate AI models processing the sample. The sample gives the impression of an isolated component or an experimental proof-of-concept, and we can only speculate […]

The post In the Wild: Malware Prototype with Embedded Prompt Injection appeared first on Check Point Research.

[email protected]

CVE-2017-2619 | Samba up to 4.4.10/4.5.6/4.6.0 race condition (Bug 1429472 / EDB-41740)

Vuldb Updates
2 months 2 weeks ago
A vulnerability was found in Samba up to 4.4.10/4.5.6/4.6.0. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to race condition. The identification of this vulnerability is CVE-2017-2619. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

Chrome Releases Security Patch for 11 Code Execution Vulnerabilities

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
2 months 2 weeks ago

The Chrome team has announced the rollout of a critical security update for its popular web browser, Chrome, addressing 11 code execution vulnerabilities that could potentially put millions of users at risk. The update, Chrome 138.0.7204.49 for Linux and 138.0.7204.49/50 for Windows and Mac, is now being distributed through the stable channel and will reach […]

The post Chrome Releases Security Patch for 11 Code Execution Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA News
2 months 2 weeks ago

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
  • CVE-2024-0769 D-Link DIR-859 Router Path Traversal Vulnerability
  • CVE-2019-6693 Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

CISA

CVE-2014-2995 | twitget 3.3.1 twitget.php twitget_consumer_key cross site scripting (ID 126134 / EDB-32868)

Vuldb Updates
2 months 2 weeks ago
A vulnerability was found in twitget 3.3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file twitget.php. The manipulation of the argument twitget_consumer_key leads to cross site scripting. This vulnerability is handled as CVE-2014-2995. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2006-3972 | Scott Weedon Ajax Chat 0.1 operator_chattranscript.php chatid path traversal (EDB-28305 / XFDB-28085)

Vuldb Updates
2 months 2 weeks ago
A vulnerability was found in Scott Weedon Ajax Chat 0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file operator_chattranscript.php. The manipulation of the argument chatid leads to path traversal. This vulnerability is known as CVE-2006-3972. The attack can be launched remotely. Furthermore, there is an exploit available.
vuldb.com

Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More 

Anyrun
2 months 2 weeks ago

June 2025 saw several sophisticated and stealthy cyber attacks that relied heavily on obfuscated scripts, abuse of legitimate services, and multi-stage delivery techniques. Among the key threats observed by ANY.RUN’s analysts were malware campaigns using GitHub for payload hosting, JavaScript employing control-flow flattening to drop Remcos, and obfuscated BAT scripts delivering NetSupport RAT. Let’s see […]

The post Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More  appeared first on ANY.RUN's Cybersecurity Blog.

ANY.RUN

CVE-2012-2941 | Yandex Yandex.Server 2010 9.0 search text cross site scripting (EDB-37224 / XFDB-75788)

Vuldb Updates
2 months 2 weeks ago
A vulnerability was found in Yandex Yandex.Server 2010 9.0. It has been rated as problematic. This issue affects some unknown processing of the file Search. The manipulation of the argument text leads to cross site scripting. The identification of this vulnerability is CVE-2012-2941. The attack may be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

Windows 10: How to get security updates for free until 2026

Help Net Security
2 months 2 weeks ago

Users who want to stick with Windows 10 beyond its planned end-of-support date but still receive security updates, can enroll into the Windows 10 Extended Security Updates (ESU) program, Microsoft has confirmed on Tuesday. Microsoft’s (self-evident) long-term goal is to push all users to upgrade to Windows 11, but the company understands that not everybody can do it immediately or even in the next couple of years. ESU for home users “Windows 10 launched in … More →

The post Windows 10: How to get security updates for free until 2026 appeared first on Help Net Security.

Zeljka Zorz

Managed ad