Aggregator

Submit #811303 / VDB-362607

A vulnerability marked as critical has been reported in Apple iOS and iPadOS up to 15.4.1. Affected by this vulnerability is an unknown functionality of the component WebKit. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2022-26719. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Apple Safari up to 15.4. This affects an unknown part of the component WebKit. The manipulation results in memory corruption. This vulnerability is known as CVE-2022-26719. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as critical, has been found in Apple iTunes up to 12.12.3. This issue affects some unknown processing of the component WebKit. The manipulation leads to use after free. This vulnerability is documented as CVE-2022-26717. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability has been found in Apple tvOS up to 15.4.1 and classified as critical. The impacted element is an unknown function of the component WebKit. This manipulation causes use after free. The identification of this vulnerability is CVE-2022-26717. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability classified as critical was found in Apple macOS up to 12.3. This affects an unknown function of the component WebKit. Such manipulation leads to use after free. This vulnerability is documented as CVE-2022-26717. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Anthropic 上个月宣布的新 AI 模型 Mythos 引发了媒体的广泛关注，它宣传 Mythos 能极其精确的发现源代码中的安全漏洞。它的识别能力如此强大以至于 Anthropic 暂不向公众发布该模型，而是先提供给少数几家公司，以便于它们能优先解决其发现的安全漏洞。curl 维护者 Daniel Stenberg 认为这是一次极其成功的营销噱头。curl 是广泛使用的开源项目，因此他获得了 Mythos 的访问权限。curl 目前包含了 17.6 万行 C 代码，共 66 万个单词。Mythos 最终返回了一份安全报告，声称确认了五个安全漏洞。但 curl 的安全团队在仔细检查后发现其中 3 个是误报，1 个是 Bug，还有 1 个是低危级别的安全漏洞，将会在下个月释出的版本中修复。安全报告还详细纪录了约 20 个 bug，基本上都是正确的。Stenberg 表示他没有看到任何证据表明 Mythos 在发现安全漏洞上比之前的其它工具更胜一筹，Mythos 可能略好一点，但不足以对代码分析产生显著影响。

Submit #811274 / VDB-362606

Submit #811273 / VDB-362605

Romanian national Gavril Sandu faces up to 30 years in a US prison after extradition over a VOIP vishing and fake debit card fraud scheme.

A vulnerability marked as problematic has been reported in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Interface. Performing a manipulation results in observable response discrepancy. This vulnerability is reported as CVE-2026-8242. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as problematic has been found in Industrial Application Software IAS Canias ERP 8.03. The affected element is the function iasGetServerInfoEvent of the component RMI Interface. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-8241. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Researchers at Google Threat Intelligence Group (GTIG) say that a zero-day exploit targeting a popular open-source web administration tool was likely generated using AI. [...]

Google Threat Intelligence Group details how cybercriminals attempted to launch a campaign based around an AI-developed Zero-Day targeting open-source software

Cyber adversaries have long used AI, but now attackers are using large language models to develop exploits and orchestrate complex attacks.

Researchers found artifacts in the code that proved AI was heavily involved. A prominent cybercrime group planned to exploit the zero-day en masse for financial gain.

The post Google spotted an AI-developed zero-day before attackers could use it appeared first on CyberScoop.

На южном полюсе Луны скоро появится 100-килограммовый китайский механик.

A vulnerability was found in Apple Mac OS X 10.8.5/10.9.2. It has been classified as critical. This issue affects some unknown processing of the component SSL Session Handler. This manipulation causes improper authentication (Triple Handshake). The identification of this vulnerability is CVE-2014-1295. It is possible to initiate the attack remotely. There is no exploit available. Due to its background and reception, this vulnerability has an historic impact. It is recommended to apply a patch to fix this issue.

A vulnerability marked as critical has been reported in Apple iOS up to 7.1. Affected is an unknown function of the component SSL Session Handler. This manipulation causes improper authentication (Triple Handshake). This vulnerability is registered as CVE-2014-1295. Remote exploitation of the attack is possible. No exploit is available. This vulnerability is historically significant due to its background and the way it was received. It is suggested to upgrade the affected component.