Aggregator

A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. This vulnerability is known as CVE-2025-5325. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. This vulnerability is handled as CVE-2025-5326. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Instantel Micromate 3.1/9.8. It has been declared as very critical. This vulnerability affects unknown code. The manipulation leads to missing authentication. This vulnerability was named CVE-2025-1907. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Consilium Safety CS5000 Fire Panel. It has been rated as very critical. This issue affects some unknown processing. The manipulation leads to insecure default initialization of resource. The identification of this vulnerability is CVE-2025-41438. The attack may be initiated remotely. There is no exploit available.

Пока ты думаешь, что тебя невозможно заменить, кто-то уже продаёт такую функцию в новой ИИ-модели.

Минцифры внедряет неожиданный подход к безопасности.

美国证券交易委员会（SEC）周四主动撤销了对全球最大加密货币交易所币安的诉讼。与此同时，特朗普政府正在全面拥抱加密货币，特朗普家族也发行了多种模因币，而币安是其合作伙伴。SEC 是在 2023 年指控币安人为夸大交易量、挪用客户资金、未能限制美国客户使用币安平台、在市场监管方面误导投资者。

HackerNews 编译，转载请注明出处： 美国财政部宣布制裁菲律宾科技公司Funnull Technology，该公司通过运营数十万个恶意网站支持网络诈骗活动，造成美国民众损失超2亿美元。Funnull通过批量采购云服务IP地址并向网络罪犯出售这些地址及托管服务，为虚拟货币投资骗局（即“杀猪盘”骗局）提供基础设施支持。 此类骗局中，犯罪分子通过交友网站、社交媒体和即时通讯应用接触受害者，建立信任后诱使其参与虚假投资计划。诈骗者将资金转移至其控制的账户而非实际投资，最终窃取受害人财产。该公司利用域名生成算法（DGA）批量生成独特域名，并为犯罪团伙提供仿冒知名品牌的网站模板，同时协助其快速切换IP地址和域名以规避封禁措施。 “向联邦调查局（FBI）报告的虚拟货币投资诈骗网站中，绝大多数与Funnull存在关联，”美国财政部外国资产控制办公室（OFAC）周四声明指出，“美国受害者因此类诈骗网站造成的损失总额超过2亿美元，人均损失逾15万美元。” 制裁令生效后，美国公民及机构禁止与Funnull进行任何交易，其在美资产将被冻结。与之开展交易的金融机构及外国实体亦可能面临处罚。 FBI同步发布技术警报披露关键指标： 2025年1月至今识别出548个专属Funnull规范名（CNAME） 关联超33.2万个独立域名 2023年2月至2025年4月间，抽样分析的8个域名呈现三种CNAME活动模式 2023年10月至2025年4月期间，使用Funnull基础设施的域名观测到多类IP活动模式 数百个域名在同一时间段内集体迁移IP地址 FBI上月披露数据显示：2024年网络罪犯从美国民众处窃取创纪录的166亿美元，其中投资诈骗造成逾65亿美元损失，较上年激增33%。       消息来源： bleepingcomputer； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Сначала BitLocker, потом IIS, теперь ACPI — кто следующий в списке фейлов компании?

ConnectWise, a leading provider of IT management and remote access software, has confirmed a cyberattack attributed to a sophisticated nation-state actor. The breach, discovered in May 2025, impacted a limited number of customers using the company’s ScreenConnect cloud platform, a tool widely used for remote support and system maintenance. ConnectWise responded by engaging forensic experts […]

The post ConnectWise Hit by Advanced Cyberattack: Internal Data at Risk appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability was found in Ocuco Innovation REPORTSERVER.EXE 2.10.24.13. It has been rated as critical. Affected by this issue is some unknown functionality of the component TCP Packet Handler. The manipulation leads to improper authentication. This vulnerability is handled as CVE-2024-41196. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability classified as critical has been found in Ocuco Innovation INVCLIENT.EXE 2.10.24.5. This affects an unknown part of the component TCP Packet Handler. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2024-41197. The attack can only be done within the local network. There is no exploit available.

A vulnerability classified as critical was found in Ocuco Innovation REPORTS.EXE 2.10.24.13. This vulnerability affects unknown code of the component TCP Packet Handler. The manipulation leads to improper authentication. This vulnerability was named CVE-2024-41198. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Ocuco Innovation JOBMANAGER.EXE 2.10.24.16. This issue affects some unknown processing of the component TCP Packet Handler. The manipulation leads to improper authentication. The identification of this vulnerability is CVE-2024-41199. The attack needs to be done within the local network. There is no exploit available.

A vulnerability was found in Google Android. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Bluetooth Adapter. The manipulation leads to information disclosure. This vulnerability is known as CVE-2024-56193. An attack has to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, was found in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 1480. Affected is an unknown function of the component Wi-Fi. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2024-49197. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability has been found in Samsung Mobile Processor, Wearable Processor and Modem Exynos up to 9110 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GPRS Protocol Handler. The manipulation leads to out-of-bounds write. This vulnerability is known as CVE-2025-22377. The attack needs to be approached within the local network. There is no exploit available.