Aggregator

Customers of French telecommunications provider Orange might see disruptions related to a cyberattack, the company said, without providing further details about the incident or threat actor.

Security researchers at Tracebit have discovered a critical vulnerability in Google’s Gemini CLI that enables attackers to silently execute malicious commands on developers’ systems through a sophisticated combination of prompt injection, improper validation, and misleading user interface design. The vulnerability, classified as a P1/S1 issue by Google’s security team, has been patched in the latest […]

The post Gemini CLI Vulnerability Allows Silent Execution of Malicious Commands on Developer Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability was found in Insyde InsydeH2O up to 05.70.49. It has been rated as problematic. Affected by this issue is some unknown functionality of the component VariableRuntimeDxe Driver. The manipulation leads to denial of service. This vulnerability is handled as CVE-2024-52880. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in StreamWeasels Kick Integration Plugin up to 1.1.4 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-7810. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in StreamWeasels Twitch Integration Plugin up to 1.9.3 on WordPress. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2025-7809. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in StreamWeasels YouTube Integration Plugin up to 1.4.0 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-7811. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Bricks Builder Plugin up to 1.12.4 on WordPress and classified as critical. This issue affects some unknown processing. The manipulation of the argument p leads to sql injection. The identification of this vulnerability is CVE-2025-6495. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Brizy Plugin up to 2.6.20 on WordPress. It has been classified as critical. Affected is the function store_file of the component TXT File Handler. The manipulation leads to missing authorization. This vulnerability is traded as CVE-2025-4370. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Elementor Plugin up to 3.30.2 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Text Path Widget. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2025-4566. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in z-push and z-push-dev up to 2.7.5. Affected is an unknown function. The manipulation of the argument Username leads to sql injection. This vulnerability is traded as CVE-2025-8264. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Samsung Electronics Data Management Server. It has been classified as critical. Affected is an unknown function. The manipulation leads to execution after redirect. This vulnerability is traded as CVE-2025-53077. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Samsung Electronics Data Management Server. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to path traversal. This vulnerability is known as CVE-2025-53080. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in SwitchBot App up to 9.12 on iOS/Android. Affected is an unknown function of the component User Information Handler. The manipulation leads to sensitive information in log files. This vulnerability is traded as CVE-2025-53649. Local access is required to approach this attack. There is no exploit available.

A vulnerability was found in Samsung Electronics Data Management Server and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to deserialization. This vulnerability is handled as CVE-2025-53078. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Samsung Electronics Data Management Server. It has been classified as problematic. This affects an unknown part. The manipulation leads to absolute path traversal. This vulnerability is uniquely identified as CVE-2025-53079. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Key Points Introduction Following our VIEW8 publication, an open source tool for analysis of Compiled JavaScript files (JSC), we are continuously tracking the usage of such files by threat actors. Among the threats we identified, a significant campaign caught our attention, which we call JSCEAL. The campaign, which impersonates common crypto trading apps, has been active since […]

The post Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal appeared first on Check Point Research.

A vulnerability was found in Google Cloud Classic Application Load Balancer. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to http request smuggling. This vulnerability was named CVE-2025-4600. The attack can be initiated remotely. There is no exploit available. This product is available as a managed service. Users are not able to maintain vulnerability countermeasures themselves.

Niagara Framework трещит по швам. Киберзащита умных зданий под большим вопросом.

A critical security vulnerability in CodeIgniter4’s ImageMagick handler has been discovered that could allow attackers to execute arbitrary commands on affected web applications through malicious file uploads. The vulnerability, tracked as CVE-2025-54418, has been assigned a maximum CVSS score of 10.0, indicating its severe nature and potential for widespread exploitation. Vulnerability Overview and Attack Vectors […]

The post Critical CodeIgniter Flaw Exposes Millions of Web Apps to File Upload Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

AI agents are showing up in more parts of the customer journey, from product discovery to checkout. And fraudsters are also putting them to work, often with alarming success. In response, cyberfraud prevention leader Darwinium is launching two AI-powered features, Beagle and Copilot, that simulate adversarial behavior and help security teams stay ahead of threats. Announced just ahead of Black Hat USA 2025, these features are designed to give defenders their own AI capabilities. Beagle … More →

The post Fighting AI with AI: How Darwinium is reshaping fraud defense appeared first on Help Net Security.