Aggregator

Vulnerability / Software SecurityA high-severity security flaw has been disclosed in ProjectDiscov

A high-severity security flaw has been disclosed in ProjectDiscovery's Nuclei, a widely-used open-source vulnerability scanner that, if successfully exploited, could allow attackers to bypass signature checks and potentially execute malicious code. Tracked as CVE-2024-43405, it carries a CVSS score of 7.4 out of a maximum of 10.0. It impacts all versions of Nuclei later than 3.0.0. "The

新年新礼物！

The post Top 5 Mistakes SAQ A-EP Merchants Are Making in 2025 That Will Knock Them Out of PCI 4.0 Compliance appeared first on Feroot Security.

The post Top 5 Mistakes SAQ A-EP Merchants Are Making in 2025 That Will Knock Them Out of PCI 4.0 Compliance appeared first on Security Boulevard.

今天来分享一位全职白帽Abdullah Nawaf的故事， 目前他在BugCrowd中排名前 50，P1 漏洞排名 11，主要挖掘 P1 和 P2 漏洞。本文主要讲述了利用子域Fuzz，将多个漏洞组合

Been camming for a month now, and here’s how it’s going: I’m average-looking, not in shape

A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part of the file /Logs/Annals/downLoad.html. The manipulation of the argument path leads to information disclosure. This vulnerability is uniquely identified as CVE-2025-0227. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. This vulnerability is handled as CVE-2025-0226. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal: '/../filedir'. This vulnerability is known as CVE-2025-0225. The attack can be launched remotely. Furthermore, there is an exploit available.