Aggregator

A vulnerability classified as critical has been found in Kordil EDMS 2.2.60rc3. This affects an unknown part of the file users_add.php. The manipulation leads to unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is uniquely identified as CVE-2013-10066. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

文章介绍了错误代码521的含义及其常见原因。该错误通常由Cloudflare引发，表示其无法连接到目标服务器。可能的原因包括服务器关闭、网络中断或配置问题。用户需检查服务器状态、网络连接及防火墙设置以解决问题。

HackerNews 编译，转载请注明出处： 肾脏透析巨头DaVita今年初遭遇勒索软件攻击，单州超1.3万人受影响。该公司向数千名美国公民发出违规通知，告知其可能已成为网络攻击受害者。2025年4月，勒索软件团伙入侵DaVita实验室服务器，公司向华盛顿州总检察长办公室提交的数据显示，仅该州就有13,000余人信息被泄露。 根据DaVita在2025年4月12日发布的声明：“发现安全事件导致实验室服务器遭未授权访问，当日即启动事件响应协议清除入侵者”。泄露信息包含： 姓名；地址；出生日期；社会安全号码；健康保险信息 临床数据（健康状况、治疗记录、透析实验室检测结果） 部分人员税务识别号及支付给DaVita的支票影像 公司强调并非所有个体均暴露全部数据字段，但攻击者可能利用信息实施身份盗窃、金融欺诈或医疗身份盗用（例如骗取管制药物处方）。此次攻击由Interlock勒索软件团伙发起，该团伙自2024年底活跃，因攻击DaVita及中西部医疗集团Kettering Health而臭名昭著。据监测工具Ransomlooker统计，该团伙过去12个月已侵害至少51个组织。       消息来源：cybernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has issued a critical warning about the exploitation of convertible virtual currency (CVC) kiosks by criminal organizations. Released on August 4, 2025, the advisory highlights how these cryptocurrency ATMs, while designed as convenient access points for legitimate users, have become significant vectors for fraudulent […]

The post U.S. Treasury Warns of Crypto ATMs Fueling Criminal Activity appeared first on Cyber Security News.

OpenAI发布开源GPT-OSS-120B和20B模型，性能媲美o4-mini/o3-mini，在本地设备如MacBook和骁龙芯片上运行良好，并被多家云平台支持快速调用。

A vulnerability was found in Linux Kernel up to 4.14.236/4.19.194/5.4.125/5.10.43/5.12.10. It has been rated as critical. Affected by this issue is the function nfs4_init_client. The manipulation leads to use after free. This vulnerability is handled as CVE-2021-47259. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 5.12.10. Affected by this issue is the function f_ecm/f_eem/f_hid/f_loopback/f_printer/f_rndis/f_serial/f_sourcesink/f_subset/f_tcm. The manipulation leads to null pointer dereference. This vulnerability is handled as CVE-2021-47270. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 5.10.45/5.12.12. It has been rated as critical. Affected by this issue is the function mtk_phy_init of the component phy-mtk-tphy. The manipulation leads to memory leak. This vulnerability is handled as CVE-2021-47234. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 5.4.127/5.10.45/5.12.12. It has been classified as problematic. Affected is an unknown function of the component ll_temac. The manipulation leads to use after free. This vulnerability is traded as CVE-2021-47224. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 4.14.237/4.19.195/5.4.127/5.10.45/5.12.12. It has been rated as critical. This issue affects the function tunnel_dst of the component bridge. The manipulation leads to null pointer dereference. The identification of this vulnerability is CVE-2021-47223. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Ubiquiti UniFi Access Reader Pro, UniFi Access G2 Reader Pro, UniFi Access G3 Reader Pro, UniFi Access Intercom, UniFi Access G3 Intercom and UniFi Access Intercom Viewer. It has been classified as critical. This affects an unknown part. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2025-27212. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

Microsoft has announced the return of its groundbreaking Zero Day Quest, the largest public hacking event in history, offering unprecedented bounty rewards of up to $5 million for high-impact security research. Building upon last year’s successful $4 million initiative, this enhanced program demonstrates Microsoft’s commitment to collaborative security through responsible vulnerability disclosure and community engagement. […]

The post Microsoft Zero Day Quest Hacking Contest – Rewards Up to $5 Million appeared first on Cyber Security News.

文章描述了错误代码521的原因及解决方法。该错误通常由CDN服务器与源站通信失败引起，常见原因包括源站IP异常、防火墙设置不当或网络连接问题。建议检查源站状态、调整防火墙规则并优化网络配置以解决问题。

HackerNews 编译，转载请注明出处： 思科Talos研究人员周二披露，戴尔数百万台笔记本电脑采用的安全芯片存在漏洞，可能使攻击者窃取敏感数据，并在设备重装操作系统后仍维持访问权限。该研究此前未公开，经戴尔6月安全公告确认，影响超100款笔记本型号，涉及存储密码、生物识别数据及安全代码的专用芯片，该芯片同时负责安装指纹/智能卡/NFC驱动及固件。 研究人员表示尚无漏洞野外利用迹象。戴尔已于3月至5月分阶段发布补丁，并于6月13日发布完整安全公告。漏洞专属于戴尔ControlVault安全固件与软件采用的博通BCM5820X芯片。思科Talos高级漏洞研究员Philippe Laulheret指出，受影响的Latitude与Precision等机型广泛用于网络安全行业及政府场景，“需通过智能卡或NFC强化登录安全的敏感行业更易受波及”。 Laulheret在周二发布的博客中透露，相关分析将于8月6日拉斯维加斯黑帽安全大会上展示。思科Talos外联负责人Nick Biasini强调，此发现凸显需加强对处理生物识别等敏感数据的硬件安全研究：“安全飞地、生物识别等技术的应用日益广泛，虽提升设备安全性，却也引入了新攻击面”。 戴尔发言人声明称已“快速透明地解决问题”，并指引用户查阅6月13日公告：“建议客户及时安装我们提供的安全更新并升级至受支持的产品版本，以确保系统安全。”     消息来源：cybernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability was found in Netwin SurgeFTP up to 23c8. It has been classified as critical. This affects an unknown part of the file surgeftpmgr.cgi of the component Web-based Administrative Console. The manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2012-10028. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, was found in Blue Access Cobalt X1 up to 02.000.187. This affects an unknown part. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2025-50454. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Sysax Multi-Server 6.10. This issue affects some unknown processing of the component SSH Daemon. The manipulation leads to uncaught exception. The identification of this vulnerability is CVE-2013-10065. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in PHP-Charts 1.0 and classified as critical. Affected by this vulnerability is the function eval of the file wizard/url.php of the component GET Parameter Handler. The manipulation leads to improper neutralization of directives in dynamically evaluated code. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is known as CVE-2013-10070. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in TurboSoft TurboFTP Server 1.30.823/1.30.826 and classified as critical. Affected by this issue is some unknown functionality of the component PORT Command Handler. The manipulation leads to buffer overflow. This vulnerability is handled as CVE-2012-10035. The attack may be launched remotely. Furthermore, there is an exploit available.