Aggregator

University of Texas CISO George Finney on Zero Trust Challenges and His New Book
Enterprises need to mature their zero trust models to recognize how trust is inherently built into artificial intelligence and how to proactively identify vulnerabilities. George Finney, CISO at University of Texas Systems, says security teams need to be trained to spot implicit trust across systems.

Strategic Plan Includes Human Risk Management Platform Expansion, IPO Preparation
Bryan Palma outlines his vision to grow KnowBe4 beyond security awareness training by investing in agentic AI, expanding email and behavioral tools and positioning the company for IPO readiness. He highlights Vista Equity's support and platform depth as key assets.

Also: Cyber IPOs and the Investment Climate, the Urgency of AI Explainability
In this week's update, ISMG editors unpacked Trump's teased "grand cyber plan" amid budget cuts to the Cybersecurity and Infrastructure Security Agency, key business takeaways from RSAC Conference 2025 and why explainability in artificial intelligence is becoming critical to trust and security.

Government Officials Sound 'Wake Up' Alarms
A rash of cyber incidents felt by British businesses add up to a wake-up call that cybersecurity is an absolute priority, top government officials warned during an annual conference hosted by the National Cyber Security Centre. The NCSC unveiled cyber resilience measures timed for the conference.

Submit #566423 / VDB-308279

A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. This vulnerability was named CVE-2025-4533. The attack can be initiated remotely. Furthermore, there is an exploit available.

Новая глава для тех, кто помнит 1985-й.

Submit #566192 / VDB-308278

A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. This vulnerability is uniquely identified as CVE-2025-4532. Local access is required to approach this attack. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template Handler. The manipulation of the argument payrollId leads to code injection. This vulnerability is handled as CVE-2025-4531. The attack may be launched remotely. Furthermore, there is an exploit available.

Submit #566141 / VDB-308277

A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. It has been declared as problematic. Affected by this vulnerability is the function handleFileDownload of the file FileController.java of the component File Handler. The manipulation leads to path traversal. This vulnerability is known as CVE-2025-4530. The attack can be launched remotely. Furthermore, there is an exploit available. This product is distributed under two entirely different names.

Submit #566097 / VDB-308276

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\WEB-INF\lib\seeyon-apps-m3.jar!\com\seeyon\apps\m3\core\controller\M3CoreController.class of the component ZIP File Handler. The manipulation of the argument Name leads to path traversal. This vulnerability is traded as CVE-2025-4529. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

Submit #565380 / VDB-308275

A vulnerability was found in Dígitro NGC Explorer up to 3.44.15 and classified as problematic. This issue affects some unknown processing. The manipulation leads to session expiration. The identification of this vulnerability is CVE-2025-4528. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Dígitro NGC Explorer 3.44.15 and classified as problematic. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to client-side enforcement of server-side security. This vulnerability was named CVE-2025-4527. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as problematic, was found in Dígitro NGC Explorer 3.44.15. This affects an unknown part of the component Configuration Page. The manipulation leads to missing password field masking. This vulnerability is uniquely identified as CVE-2025-4526. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #565379 / VDB-308274

Submit #565309 / VDB-308273