Aggregator

Also: CISA's Leadership Crisis; Why AI's Confident Errors Demand Urgent Oversight
In this week's update, four editors with ISMG discussed Anubis ransomware's puzzling shift to data wiping malware, the leadership vacuum and budget uncertainty at CISA and growing concerns about how artificial intelligence tools are making confident mistakes that demand human oversight.

点击查看更多本周网络安全大事件。

A vulnerability was found in Apple iOS and iPadOS. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to information disclosure. This vulnerability was named CVE-2023-42937. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in WebCalendar 1.3.0. This vulnerability affects unknown code of the file /WebCalendarvqsmnseug2/edit_entry.php. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-22635. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in kosei entertainment esportsstudioLegends mini-app on Line 13.6.1. Affected is an unknown function of the component Channel Access Token Handler. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2023-48132. The attack can only be done within the local network. There is no exploit available.

A vulnerability was found in Wordpress-users Plugin up to 1.4 on WordPress and classified as problematic. Affected by this issue is some unknown functionality of the component Setting Handler. The manipulation leads to cross-site request forgery. This vulnerability is handled as CVE-2023-6390. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Easy SVG Allow Plugin up to 1.0 on WordPress. This affects an unknown part of the component SVG Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2023-7089. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Moderna Sistemas ModernaNet Hospital Management System 2024. It has been classified as problematic. Affected is an unknown function of the file /Modernanet/LAUDO/LAU0000100/Laudo. The manipulation of the argument ID leads to improper control of resource identifiers. This vulnerability is traded as CVE-2024-23747. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability has been found in GreenCMS 2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /install.php?m=install&c=index&a=step3. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-22570. The attack can be launched remotely. There is no exploit available.

A vulnerability has been found in YahooPOPs 1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component POP3 Service. The manipulation leads to denial of service. This vulnerability is known as CVE-2024-24736. The attack can be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in SourceCodester Math Game with Leaderboard 1.0. This affects an unknown part of the component Score Section. The manipulation of the argument Your Name leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-24136. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Softing TH SCOPE up to 3.70. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2023-37571. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Rapid7 Velociraptor up to 0.74.2. Affected is the function Admin.Client.UpdateClientConfig of the component VQL Query Handler. The manipulation leads to incorrect default permissions. This vulnerability is traded as CVE-2025-6264. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Microsoft Internet Explorer 5.5/6.0. This vulnerability affects unknown code of the component Frame Handler. The manipulation leads to improper privilege management. This vulnerability was named CVE-2002-1217. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Security researchers discovered 16 billion stolen passwords from Apple, Google, Facebook and more. Unlike traditional hacks, malicious software infected millions of personal devices, secretly stealing every login. Here's what this means for your accounts and how to protect yourself immediately.

The post Your passwords are everywhere: What the massive 16 billion login leak means for you appeared first on Security Boulevard.

Currently trending CVE - Hype Score: 1 - A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a ...

Currently trending CVE - Hype Score: 12 - A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue ...

A vulnerability, which was classified as problematic, has been found in DeviceFarmer stf 3.6.6. Affected by this issue is some unknown functionality of the component Cr. The manipulation leads to risky cryptographic algorithm. This vulnerability is handled as CVE-2023-51839. The attack can only be done within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Free Open-Source Inventory Management System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument staff_list leads to cross-site request forgery. This vulnerability is uniquely identified as CVE-2023-51813. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as critical was found in Qiyu iFair up to 23.8_ad0. This vulnerability affects the function uploadimage. The manipulation leads to path traversal. This vulnerability was named CVE-2024-22523. The attack can be initiated remotely. There is no exploit available.