Aggregator

Троян для Android и iPhone ворует снимки через поддельные приложения.

RoundCube一直以来就是替代商业邮件系统的轻量级解决方案。虽然历史也出现过很多漏洞，但本次CVE-2025-49113是一个长达十年未被发现的严重安全漏洞，造成影响较为广泛。

A vulnerability was found in Oracle Financial Services Basel Regulatory Capital Basic 8.0.4/8.0.5/8.0.6/8.0.7. It has been classified as critical. Affected is an unknown function of the component AntiSamy. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2019-11358. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Apache ActiveMQ up to 5.11.1 on Windows. This affects an unknown part of the component Fileserver Upload/Download. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2015-1830. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Berkeley Boinc Forum up to 5.10.20. It has been declared as problematic. This vulnerability affects unknown code of the file forum_forum.php. The manipulation of the argument search_string leads to cross site scripting. This vulnerability was named CVE-2007-4899. The attack can be initiated remotely. Furthermore, there is an exploit available.

CVSS is not the enemy, so the sooner we stop blaming the tool and start fixing the system around it, the better off we’ll all be. 

The post Stop Blaming CVSS: The Real Problem in Vulnerability Management is Us  appeared first on Security Boulevard.

Остаётся гадать: где же эта технология вспыхнет первой?

A2A协议中的代理卡滥用：攻击者如何通过“中间代理”攻击获取所有任务的控制权？

A vulnerability classified as critical was found in Music Collection 3.0.3 on Joomla. Affected by this vulnerability is an unknown functionality. The manipulation of the argument ID as part of Parameter leads to sql injection. This vulnerability is known as CVE-2018-17375. The attack can be launched remotely. Furthermore, there is an exploit available.

华云安宣布完成数千万元的B+轮融资

81%酒店遭攻击，勒索软件为首害，公共WiFi与IoT成高危入口。

The UK government’s Cyber Essentials scheme hits 10,000 certifications for the first time in a quarter but challenges persist

Not every risk looks like an attack. Some problems start as small glitches, strange logs, or quiet delays that don’t seem urgent—until they are. What if your environment is already being tested, just not in ways you expected? Some of the most dangerous moves are hidden in plain sight. It’s worth asking: what patterns are we missing, and what signals are we ignoring because they don’t match old

Anyone accepting or sending ACH payments should understand common fraud techniques and take appropriate measures to curb them.

The post Securing ACH Against Emerging Authentication Bypass Methods  appeared first on Security Boulevard.

2025年06月16日-2025年06月22日本周漏洞态势研判情况本周信息安全漏洞威胁整体评价级别为中。国家

A vulnerability, which was classified as critical, was found in WHM Autopilot 2.4.5/2.4.6/2.4.6.5. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2004-1422. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

链上行为揭示汇旺支付已成为高效运行的地下支付枢纽。