Aggregator

Qrator Labs blocked a record L7 DDoS attack from a 5.76M-device botnet targeting government systems, showing rapid global growth since March.

A vulnerability described as problematic has been identified in Google Android 11.0/12.0/13.0. This affects an unknown part of the file JobStore.java. The manipulation results in denial of service. This vulnerability is cataloged as CVE-2023-21137. The attack must be initiated from a local position. There is no exploit available. It is advisable to implement a patch to correct this issue.

A vulnerability classified as problematic was found in Google Android 13.0. This issue affects the function bindPlayer of the file MediaControlPanel.java. Such manipulation leads to Local Privilege Escalation. This vulnerability is documented as CVE-2023-21139. The attack needs to be performed locally. There is not any exploit available. It is best practice to apply a patch to resolve this issue.

A vulnerability, which was classified as problematic, was found in Google Android. This affects the function lwis_i2c_device_disable of the file lwis_device_i2c.c. Executing manipulation can lead to use after free. This vulnerability is registered as CVE-2023-21147. The attack needs to be launched locally. No exploit is available. A patch should be applied to remediate this issue.

A vulnerability has been found in Google Android and classified as problematic. This impacts an unknown function. The manipulation leads to use after free. This vulnerability is documented as CVE-2023-21146. The attack needs to be performed locally. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability classified as critical has been found in Google Android 13.0. This affects the function btm_ble_periodic_adv_sync_lost of the file btm_ble_gap.cc. Performing manipulation results in buffer overflow. This vulnerability is reported as CVE-2023-21130. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

A vulnerability identified as problematic has been detected in Google Android 11.0/12.0/13.0. Affected is an unknown function of the file AppStandbyController.java. Performing manipulation results in Local Privilege Escalation. This vulnerability is identified as CVE-2023-21128. The attack is only possible with local access. There is not any exploit available. It is suggested to install a patch to address this issue.

A vulnerability labeled as problematic has been found in Google Android 11.0/12.0/13.0. Affected by this vulnerability is the function onCreate of the file NotificationAccessSettings.java. Executing manipulation can lead to improper input validation. This vulnerability is tracked as CVE-2023-21135. The attack is restricted to local execution. No exploit exists. A patch should be applied to remediate this issue.

在社交媒体的算法优先级中，真正由人类创造的内容正在边缘化。人类内容的互动率比为点击优率化的合成内容和 AI 垃圾要低得多。社交媒体是建立在真实性的浪漫化上，早期的社交媒体都许诺自己是真实连接的媒介。即使是网红文化也承诺光环之后有真实的人。但注意力经济，尤其是 AI 驱动的后注意力经济，打破了这一幻觉。信息流不再以人为主，而是各种内容，平台用户如今是内容的消费者。人类创造的内容和合成内容之间越来越难以区分，而平台也不感兴趣进行监管。我们正淹没在虚无之中。在内容激增的同时，互动率则在下降：Facebook 和 X 帖子的平均互动率仅为 0.15%，Instagram 互动率同比下降 24%，连 TikTok 也进入了停滞期。人类不再像以前那样在社媒上联系或交流，他们只是在消费为点击率优化的内容。社交媒体的死亡不是惊天撼响而只是耸耸肩。今天社交媒体已经不再能爆炸式增长，全球人口的 65% 约 53 亿人已经在使用各种社交媒体。越来越多的人开始转向更私密的小型空间，如群聊、Discord 服务器，或者联邦宇宙微博客平台。用户渴望真实，平台也不得不做出回应，因为无处不在的合成内容正逼近人的容忍极限，用户开始疲惫了：Instagram 开始推 DM，X 推面向订阅用户的圈子，TikTok 则在尝试私人社区。社交媒体到了最后时刻，不是因为缺乏内容，而是注意力经济已经到了极限。

A vulnerability categorized as critical has been discovered in Wavlink WL-WN578W2 221110. This impacts the function sub_404DBC of the file /cgi-bin/wireless.cgi. The manipulation of the argument macAddr results in os command injection. This vulnerability is reported as CVE-2025-10359. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as problematic has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of the argument Email address causes cross site scripting. This vulnerability appears as CVE-2025-10366. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as critical has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_role.php. Executing manipulation of the argument ID can lead to sql injection. This vulnerability is registered as CVE-2025-10396. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability identified as critical has been detected in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. This vulnerability is cataloged as CVE-2025-10395. It is possible to initiate the attack remotely. There is no exploit available.

Submit #645803 / VDB-323831

A vulnerability categorized as critical has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. Affected is an unknown function of the file ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/JobController.java of the component Scheduled Task Module. Such manipulation leads to code injection. This vulnerability is listed as CVE-2025-10394. The attack may be performed from remote. In addition, an exploit is available.

Submit #645798 / VDB-323830

ICS失窃的工艺下载后test.PCZ文件，需要使用力控软件打开。但电脑没有安装这个软件，尝试把后缀名改为.zip，解压后直接搜索flag文本：成功在文件中找到flag：flag{D076-4D7E-92AC-A05ACB788292}。工控协议分析WireShark打开分析，追踪TCP流，flag

A vulnerability was found in miurla morphic up to 0.4.5. It has been rated as critical. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx Handler. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2025-10393. The attack is possible to be carried out remotely. Moreover, an exploit is present.

数据安全1. ds_re_j02解密，第八行的第二列数据是 flag 打开文件后发现所有内容均为编码后的信息，经过仔细观察，发现这些编码字符仅由 A-Z和 2-7组成，由此推测可能是 Base32 编码，于是尝试使用 Base32 进行解码，果然成功还原出可读内容，其中第二列信息即为 flag。2.

Submit #645729 / VDB-323829