Aggregator

CVE-2025-31136 | FreshRSS up to 1.26.1 SVG Favicon f.php fetch cross site scripting

VulDB Recent Entries
3 months ago
A vulnerability was found in FreshRSS up to 1.26.1 and classified as problematic. Affected by this issue is the function fetch of the file f.php of the component SVG Favicon Handler. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2025-31136. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-31134 | FreshRSS up to 1.26.1 insertion of sensitive information into sent data

VulDB Recent Entries
3 months ago
A vulnerability has been found in FreshRSS up to 1.26.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to insertion of sensitive information into sent data. This vulnerability is known as CVE-2025-31134. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

From Idea to Outcome: How WWT Is Leading the AI Security Conversation at Scale

Security Boulevard
3 months ago

When it comes to helping the world’s largest enterprises navigate AI, cybersecurity and digital transformation, World Wide Technology (WWT) isn’t just participating, it’s leading. With a global workforce of over 12,000, and a deep bench of trusted technology partners, WWT has positioned itself as a rare blend of scale, security expertise and hands-on innovation. “Our..

The post From Idea to Outcome: How WWT Is Leading the AI Security Conversation at Scale appeared first on Security Boulevard.

John D. Boyle

Vishing Crew Targets Salesforce Data

darkreading
3 months ago
A group that Google is tracking as UNC6040 has been tricking users at many organizations into installing a malicious version of a Salesforce app to gain access and steal data from the platform.
Jai Vijayan, Contributing Writer

CVE-2025-27487 | Microsoft Windows up to Server 2025 Remote Desktop Client heap-based overflow (EUVD-2025-10159 / Nessus ID 234237)

Vuldb Updates
3 months ago
A vulnerability has been found in Microsoft Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component Remote Desktop Client. The manipulation leads to heap-based buffer overflow. This vulnerability is known as CVE-2025-27487. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.
vuldb.com

CVE-2025-27737 | Microsoft Windows up to Server 2025 Security Zone Mapping input validation (EUVD-2025-10150)

Vuldb Updates
3 months ago
A vulnerability classified as critical has been found in Microsoft Windows. This affects an unknown part of the component Security Zone Mapping. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2025-27737. Attacking locally is a requirement. There is no exploit available. It is recommended to apply a patch to fix this issue.
vuldb.com

CVE-2025-24060 | Microsoft Windows up to Server 2025 DWM Core Library input validation (EUVD-2025-10248)

Vuldb Updates
3 months ago
A vulnerability was found in Microsoft Windows. It has been rated as critical. Affected by this issue is some unknown functionality of the component DWM Core Library. The manipulation leads to improper input validation. This vulnerability is handled as CVE-2025-24060. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.
vuldb.com

CVE-2025-21204 | Microsoft Windows up to Server 2025 Process Activation link following (EUVD-2025-10245)

Vuldb Updates
3 months ago
A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part of the component Process Activation. The manipulation leads to link following. This vulnerability is uniquely identified as CVE-2025-21204. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.
vuldb.com

针对 glibc 中 realloc() 函数源码在 2.2x ~ 2.3x 版本的深度解析

先知技术社区
3 months ago
文章主要基于 glibc 2.23 版本的源码对 realloc() 的执行逻辑以及检查措施进行了逐行深度解析，同时给出了针对 glibc 版本更迭中 realloc() 在防护措施与各类功能的标准化进行了简要介绍，最后总结了 realloc() 在执行时针对不同参数情况的完整检查与执行流，帮助大家对于该函数的执行逻辑以及检查手段有更深的了解

java之jdk17反射机制绕过深入剖析

先知技术社区
3 months ago
java之jdk17反射机制绕过深入剖析问题分析先写一个测试代码，通过反射调用 defineclass 方法加载恶意字节码，然后进行运行的时候发现报错，看报错信息不难发现是在 setAccessible 出的问题，跟进该方法调用了 checkCanSetAccessible 方法，继续跟进看着逻辑有点多，但是发现如果满足下面这几种情况是可以返回 true 就可以进行反射调用了。第一个 if：调用者

Zero Networks Lands $55M Series C to Drive Zero Trust Growth

Ransomware DataBreachToday.com
3 months ago
Florida Vendor Set to Reach $100M ARR by 2027 With Identity Segmentation, ZTNA Push
With $55 million in Series C funding led by Highland Europe, Zero Networks aims to expand its zero trust architecture through identity segmentation and zero trust network access. The Orlando, Fla.-based microsegmentation startup aims to double headcount and target a $100 million ARR goal by 2027.

Unpatched Buffer Overflow in Schneider Home Devices

Ransomware DataBreachToday.com
3 months ago
Vulnerability Could Enable Remote Code Injection Attacks
When the lights start flickering in homes equipped with Schneider Electric end-of-life smart switches, it could be hackers, now that the French company disclosed a remotely exploitable vulnerability that won't receive a patch. No hacking has been reported to date.

Managed ad