Aggregator

A vulnerability classified as problematic was found in Euro Information CIC banque et compte en ligne App 12.56.0 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.cic_prod.bad. The manipulation results in improper export of android application components. This vulnerability was named CVE-2025-9097. The attack needs to be approached locally. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #627902 / VDB-320420

Агенты раскрыли ошибки в ПО, где люди и инструменты провалились.

Submit #627899 / VDB-320419

A vulnerability classified as problematic has been found in ExpressGateway express-gateway up to 1.16.10. This impacts an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-9096. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as problematic has been identified in ExpressGateway express-gateway up to 1.16.10. This affects an unknown function in the library lib/rest/routes/users.js of the component REST Endpoint. Executing manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2025-9095. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #627833 / VDB-320418

Submit #627709 / VDB-320417

A vulnerability marked as critical has been reported in ThingsBoard 4.1. The impacted element is an unknown function of the component Add Gateway Handler. Performing manipulation results in improper neutralization of special elements used in a template engine. This vulnerability is known as CVE-2025-9094. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)."

Submit #626292 / VDB-320416

A vulnerability labeled as problematic has been found in BuzzFeed App 2024.9 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.buzzfeed.android. Such manipulation leads to improper export of android application components. This vulnerability is traded as CVE-2025-9093. An attack has to be approached locally. Furthermore, there is an exploit available.

Как технологии потрясли основы веры…

Submit #623584 / VDB-320415

该系列是根据《从Top20开源组件漏洞浅谈开源安全治理困境》中我们梳理的最常见组件漏洞制作的漏洞分析系列。本篇是该系列的第二篇分析报告。

在Apache Hertzbeat<=1.7.1的版本下利用h2 jdbc实现RCE

В системе очередной баг. Без CVE и подробностей…

环境搭建jdk 8u65Commons Collection 3.2.1jdk下载地址：https://www.oracle.com/cn/java/technologies/javase/javase8-archive-downloads.html#license-lightbox由于该链子是在CC1或者CC6的基础上稍稍进行了改变，所以jdk是不受限制的，只不过看是在哪个链子上改变而已。具体环

总结一下SSRF可以获取权限的思路和方法