Aggregator

A vulnerability, which was classified as problematic, has been found in y_project RuoYi 4.7.8. This issue affects some unknown processing of the file /system/notice/. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2023-52048. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlController.java. The manipulation leads to missing authentication. The identification of this vulnerability is CVE-2025-4018. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authentication. This vulnerability is traded as CVE-2025-4019. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument fname leads to sql injection. This vulnerability is handled as CVE-2025-4020. The attack may be launched remotely. Furthermore, there is an exploit available. Other parameters might be affected as well.

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /edit_spatient.php. The manipulation of the argument ID leads to sql injection. This vulnerability is uniquely identified as CVE-2025-4021. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

SAP disclosed a critical zero-day vulnerability, identified as CVE-2025-31324, in its NetWeaver Visual Composer component. This vulnerability, with a maximum CVSSv3 severity score of 10.0, stems from a missing authorization check within the Metadata Uploader module of Visual Composer. When exploited, it allows unauthenticated attackers to upload arbitrary malicious files via specially crafted POST requests to […]

The post SAP NetWeaver 0-Day Flaw Actively Exploited to Deploy Webshells appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

本文介绍了如何运用C++和纯汇编开发Shellcode

最近有花了一些时间看vite任意文件读取相关的一系列漏洞，下面打算以漏洞发现者的视角，讲讲这些漏洞的一些要点

Netskope announced expansion of the Netskope One platform to cover more AI security use cases, including enhanced protections for private applications and data security posture management (DSPM) attributes. While other vendors focus on enabling safe user access to AI applications, Netskope capabilities go much further by managing new risks introduced by the adoption and building of AI applications, providing a deep understanding of sensitive data being fed into large language models (LLMs) and assessing risk … More →

The post Netskope One enhancements cover a broad range of AI security use cases appeared first on Help Net Security.

第二名wp，含全部题解

A vulnerability was found in Loofah. It has been rated as problematic. This issue affects some unknown processing of the component URI Handler. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2022-23515. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Apple tvOS up to 16.1.1. Affected is an unknown function of the component WebKit. The manipulation leads to type confusion. This vulnerability is traded as CVE-2022-42856. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple macOS. It has been rated as critical. This issue affects some unknown processing of the component WebKit. The manipulation leads to type confusion. The identification of this vulnerability is CVE-2022-42856. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Apple Safari up to 16.1. This vulnerability affects unknown code of the component WebKit. The manipulation leads to type confusion. This vulnerability was named CVE-2022-42856. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple Xcode up to 14.0. It has been classified as problematic. This affects an unknown part of the component Git. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2022-39253. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Trend Micro announced new AI-powered threat detection capabilities designed specifically for enterprises embracing AI at scale. This effort brings together Trend’s security expertise with NVIDIA accelerated computing and NVIDIA AI Enterprise software, leveraging AWS infrastructure to support scalable, enterprise-ready deployment. The solution is built to help organizations secure AI-driven workloads and business processes without compromising performance or flexibility. As enterprises scale their AI ambitions from GenAI to agentic AI, new attack surfaces emerge, including threats … More →

The post Trend Micro helps organizations secure AI-driven workloads appeared first on Help Net Security.

使用codeql从0开始hutool 利用链挖掘

JDK 高版本下 JNDI 注入深度剖析JDK 高版本 JNDI 注入限制rmi 协议限制测试 poc直接定位到 RegistryContext#decodeObject 方法，看到在调用 NamingManaget.getObjectInstance 方法前有个 if 条件判断，如果符合这三个 if 条件就会抛出异常，而 jdk 高版本中默认 trustURLCodebase 为 false，然

Парализованный мужчина заговорил через нейроинтерфейс.

A vulnerability was found in Adobe Illustrator up to 26.5.1/27.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to out-of-bounds read. This vulnerability is handled as CVE-2022-44499. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.