Aggregator

Submit #621527 / VDB-313827

A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. This vulnerability is traded as CVE-2025-8172. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

Submit #621508 / VDB-317587

Chennai, India, July 25th, 2025, CyberNewsWire xonPlus, a real-time digital risk alerting system, officially launches today to help security teams detect credential exposures before attackers exploit them. The platform detects data breaches and alerts teams and systems to respond instantly. Built by the team behind XposedOrNot, an open-source breach detection tool used by thousands, xonPlus […]

The post xonPlus Launches Real-Time Breach Alerting Platform For Enterprise Credential Exposure appeared first on Cyber Security News.

CasaOS 是一个简化开源项目部署的在线应用平台，支持一键安装 135 个常用工具如 Calibre、Emby 等，并提供直观界面和应用商店管理功能。

Microsoft has issued urgent warnings about active exploitation of critical SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771 by multiple threat actors, including the China-based group Storm-2603, which has been deploying Warlock ransomware in compromised environments.  The vulnerabilities affect on-premises SharePoint Server 2016, 2019, and Subscription Edition, with exploitation attempts observed as early as July 7, 2025. Key […]

The post Hackers Exploiting Sharepoint 0-day Vulnerability to Deploy Warlock Ransomware appeared first on Cyber Security News.

Submit #621482 / VDB-317586

Фазовый переход без фотонов приблизил микросхемы, способные считать быстрее и тратить меньше энергии, чем кремний.

A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing of the file /insert.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The identification of this vulnerability is CVE-2025-8171. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow. This vulnerability was named CVE-2025-8170. The attack can be initiated remotely. Furthermore, there is an exploit available.

不知道今天会不会亏钱，牛市真的来了。

针对http/https的beacon的检测工具，适合应急场景，快速定位beacon进程和通信URL

Mitel修复了MiVoice MX-ONE中的严重认证绕过漏洞（CVSS 9.4），该漏洞允许未授权攻击者绕过认证并访问用户或管理员账户。受影响版本为7.3至7.8 SP1，补丁已发布。同时修复了MiCollab中的SQL注入漏洞（CVE-2025-52914，CVSS 8.8）。

Mitel addressed a critical MiVoice MX-ONE flaw that could allow an unauthenticated attacker to conduct an authentication bypass attack. A critical authentication bypass flaw (CVSS score of 9.4) in Mitel MiVoice MX-ONE allows attackers to exploit weak access controls and gain unauthorized access to user or admin accounts. “An authentication bypass vulnerability has been identified […]

日本内阁府的生命伦理专门调查会达成基本共识，允许使用人类 iPS 细胞制作受精卵（胚胎）。培养期限定为 14 天以内。在遵守一定规则的前提下允许进行相关研究，这将有助于查明不孕症及遗传性疾病的病因。使用受精卵的传统研究，大多使用在不孕治疗过程中获得的受精卵。如果能够使用 iPS 细胞等轻松获取受精卵，繁殖相关研究有可能取得进展。在使用 iPS 细胞来调查“繁殖”机制的研究领域，日本一直走在世界前列。已经在小鼠实验中成功使用 iPS 细胞制作卵子和精子，并使其受精后培育出后代。在人类身上实现这一点也只是时间问题，因此需要加紧建立相关规则。京都大学教授斋藤通纪的研究团队于 2011～2012 年首次成功利用小鼠的 iPS 细胞制作出卵子和精子，并使其受精后培育出后代。

Submit #621411 / VDB-317585

Clorox is suing IT giant Cognizant, claiming their help desk handed over employee passwords to hackers — no phishing, no malware… just gave them away.

The post “Bleach Wasn’t Strong Enough: Clorox Sues Cognizant After Help Desk Allegedly Gave Away Passwords to Hackers” appeared first on Security Boulevard.

Clorox起诉Cognizant因IT帮助台泄露员工密码给伪装成员工的黑客，导致3.56亿美元损失。Clorox指控Cognizant在未验证身份的情况下多次提供凭据。Cognizant否认指控。

A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is uniquely identified as CVE-2025-8169. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in D-Link DIR-513 1.10. It has been rated as critical. Affected by this issue is the function websAspInit of the file /goform/formSetWanPPPoE. The manipulation of the argument curTime leads to buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is handled as CVE-2025-8168. The attack may be launched remotely. Furthermore, there is an exploit available.