Aggregator

美国网络安全机构CISA将两个高危XXE漏洞加入目录，影响SysAid软件，可致管理员接管和文件读取。补丁已发布但尚未知实际攻击情况。相关机构需于8月前修复。

Microsoft linked SharePoint exploits to China-nexus groups Linen Typhoon, Violet Typhoon, and Storm-2603, active since July 7, 2025. Microsoft confirmed that China-linked groups Linen Typhoon, Violet Typhoon, and Storm-2603 exploited SharePoint flaws for initial access as early as July 7, 2025. “As of this writing, Microsoft has observed two named Chinese nation-state actors, Linen Typhoon […]

Microsoft identified three China-linked cyber groups, Linen Typhoon, Violet Typhoon, and Storm-2603, exploiting SharePoint vulnerabilities to gain unauthorized access and steal sensitive data. The attacks involved sending POST requests to the ToolPane endpoint, bypassing authentication, and using malicious scripts to extract cryptographic keys. Microsoft urges immediate patching and additional security measures to mitigate risks.

Windows 11 24H2 版本因更换 JScript 引擎导致部分软件如 Visual Studio 出现脚本错误（如 0xc000041d 或 JavaScript runtime error），可通过修改注册表恢复旧版引擎解决问题。

A vulnerability classified as problematic has been found in HP Poly Clariti Manager up to 10.12.0. This affects an unknown part. The manipulation leads to use of default password. This vulnerability is uniquely identified as CVE-2025-43021. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

Гуманоид UBTECH живёт 24 часа в сутки и думает о приоритетах.

A vulnerability was found in HP Poly Clariti Manager up to 10.12.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to sensitive information in log files. This vulnerability is handled as CVE-2025-43485. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HP Poly Clariti Manager up to 10.12.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to use of hard-coded cryptographic key . This vulnerability is known as CVE-2025-43483. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HP Poly Clariti Manager up to 10.12.1. It has been classified as critical. Affected is an unknown function of the component sudo Handler. The manipulation leads to execution with unnecessary privileges. This vulnerability is traded as CVE-2025-43487. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HP Poly Clariti Manager up to 10.12.0 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The identification of this vulnerability is CVE-2025-43489. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in HP Poly Clariti Manager up to 10.12.1 and classified as critical. This vulnerability affects unknown code. The manipulation leads to os command injection. This vulnerability was named CVE-2025-43020. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in yt-dlp up to 2025.06.25 on Windows. This affects an unknown part of the component Command Line Handler. The manipulation of the argument --exec leads to os command injection. This vulnerability is uniquely identified as CVE-2025-54072. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in haxtheweb haxcms up to 11.0.12. Affected by this issue is some unknown functionality. The manipulation leads to improper restriction of rendered ui layers. This vulnerability is handled as CVE-2025-54139. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

阿里巴巴发布了其辅助编程工具 Qwen3-Coder。Qwen3-Coder 拥有多个尺寸，最先发布的是最强大的版本 Qwen3-Coder-480B-A35B-Instruct。这是一个总参数量 480B，激活 35B 的 MoE 模型，原生支持 256K token 的上下文并可通过 YaRN 扩展到 1M token，拥有卓越的代码和 Agent 能力。Qwen3-Coder-480B-A35B-Instruct 在 Agentic Coding、Agentic Browser-Use 和 Agentic Tool-Use 上取得了开源模型的 SOTA 效果，可以与 Cluade Sonnet4 媲美。

A vulnerability classified as critical was found in pyLoad 0.5.0b3.dev89. Affected by this vulnerability is an unknown functionality of the file /json/upload of the component Uploaded File Name Handler. The manipulation leads to path traversal. This vulnerability is known as CVE-2025-54140. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Kali Linux has announced the release of two groundbreaking packages that significantly enhance wireless penetration testing capabilities for Raspberry Pi users. The new brcmfmac-nexmon-dkms and firmware-nexmon packages, introduced in Kali Linux 2025.1, enable the onboard Wi-Fi interface on supported Raspberry Pi models to perform monitor mode operations and frame injection without requiring external USB adapters. […]

The post Kali Linux Unveils Two New Tools to Boost Wi-Fi Performance for Raspberry Pi Users appeared first on Cyber Security News.

微软称 Windows 11 24H2 是目前最可靠的版本，死机率较 Windows 10 22H2 降低 24%。新增快速机器恢复功能可自动修复蓝屏问题，并改进黑屏死机界面以提升用户体验。

《关键信息基础设施商用密码使用管理规定》已经2025年4月21日国家密码管理局局务会议审议通过。

研究人员表示，除非用户在开发者选项或可访问性设置中禁用动画，否则最新的Android版本是可以启用动画的，否则会使设备暴露在TapTrap攻击之下。

当前环境出现异常状态，请完成验证操作后方可继续访问相关内容。