Aggregator

A vulnerability has been found in Oracle Hospitality Materials Control 18.1 and classified as critical. The affected element is an unknown function of the component Receipt. Performing manipulation results in cross site scripting. This vulnerability is known as CVE-2021-41184. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability was found in Oracle JD Edwards EnterpriseOne Tools up to 9.2.6.3. It has been declared as critical. Affected is an unknown function of the component Web Runtime. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2021-41184. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Oracle Policy Automation up to 12.2.25. This issue affects some unknown processing of the component Determinations Engine. Performing manipulation results in cross site scripting. This vulnerability was named CVE-2021-41184. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability categorized as critical has been discovered in Oracle Agile PLM 9.3.6. This affects an unknown function of the component Security. Executing manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2021-41184. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in Oracle SD-WAN Aware 9.0.1.3.0 and classified as critical. Affected is an unknown function of the component Management. Executing manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2021-41184. The attack may be launched remotely. There is no exploit available.

A multinational operation in late October targeted a network that “created dozens of fake cryptocurrency investment platforms that looked like legitimate websites and promised high returns,” but simply took the money and laundered it, Eurojust said.

The nascent collective that combines three prominent cybercrime groups, Scattered Spider, LAPSUS$, and ShinyHunters, has created no less than 16 Telegram channels since August 8, 2025. "Since its debut, the group's Telegram channels have been removed and recreated at least 16 times under varying iterations of the original name – a recurring cycle reflecting platform moderation and the operators'

A critical remote code execution (RCE) vulnerability tracked as CVE-2025-11953 in the @react-native-community/cli NPM package. With nearly 2 million weekly downloads, this package powers the command-line interface for React Native, a JavaScript framework beloved by developers building cross-platform mobile apps. The vulnerability, scored at CVSS 9.8 for its network accessibility, low complexity, and potential for […]

The post Critical RCE Vulnerability in Popular React Native NPM Package Exposes Developers to Attacks appeared first on Cyber Security News.

Корнеллский университет принимает экстренные меры.

Microsoft found a new backdoor, SesameOp, using the OpenAI Assistants API for stealthy command-and-control in hacked systems. Microsoft uncovered a new backdoor, named SesameOp, that abuses the OpenAI Assistants API for command-and-control, allowing covert communication within compromised systems. Microsoft Incident Response – Detection and Response Team (DART) researchers discovered the backdoor in July 2025 while […]

A vulnerability categorized as critical has been discovered in Palo Alto PAN-OS up to 7.1.18/8.0.11/8.1.2. This issue affects some unknown processing of the component GlobalProtect Portal/GlobalProtect Gateway. The manipulation results in format string. This vulnerability is cataloged as CVE-2019-1579. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in PJSIP up to 2.11.0. It has been classified as problematic. This vulnerability affects unknown code of the component SSL Socket Handler. This manipulation causes race condition. This vulnerability is handled as CVE-2021-32686. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in jQuery-UI up to 1.12.x. It has been rated as problematic. Affected is the function position. This manipulation of the argument of causes cross site scripting. This vulnerability is tracked as CVE-2021-41184. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability marked as critical has been reported in Oracle Communications Interactive Session Recorder 6.4. Impacted is an unknown function of the component Dashboard. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2021-41184. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability described as critical has been identified in Oracle Communications Operations Monitor 4.3/4.4/5.0. The affected element is an unknown function of the component Mediation Engine. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2021-41184. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

The Swedish Authority for Privacy Protection (IMY) is investigating a cyberattack on IT systems supplier Miljödata that exposed data belonging to 1.5 million people. [...]

In early November, the Israeli Defense Forces made a decision that sent ripples through defense and cybersecurity circles worldwide: withdraw every Chinese-manufactured vehicle from its senior officer fleet. The IDF marked approximately 700 cars, predominantly the Chery Tiggo 8 Pro model, for removal by the end of the first quarter of 2026. This wasn’t a..

The post Why Israel Just Banned 700 Chinese Cars from Its Military—And What It Means for Security appeared first on Security Boulevard.

Mayhem, which won the 2016 DARPA Cyber Grand Challenge, will have all its employees join Bugcrowd.

The post Bugcrowd acquires Mayhem Security to advance AI-powered security testing appeared first on CyberScoop.

Бэкдор работал у всех на виду, но раскрыть его было не так-то просто.