Aggregator

A vulnerability identified as critical has been detected in Siemens TeleControl Server Basic 3.1.2.1. This issue affects the function GetOverview. Performing manipulation results in sql injection. This vulnerability is known as CVE-2025-32872. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability was found in Siemens TeleControl Server Basic 3.1.2.1 and classified as critical. Impacted is the function CreateBackup. Such manipulation leads to sql injection. This vulnerability is listed as CVE-2025-32867. The attack may be performed from a remote location. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in Siemens TeleControl Server Basic 3.1.2.1. Affected is an unknown function. Executing manipulation can lead to improper handling of length parameter inconsistency. This vulnerability is tracked as CVE-2025-29931. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability identified as critical has been detected in Zoom Workplace Desktop App, Workplace App, Workplace VDI Client, Rooms Controller, Rooms Client and Meeting SDK up to 6.3.x. Affected by this vulnerability is an unknown functionality. Performing manipulation results in improper neutralization. This vulnerability was named CVE-2025-46785. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability has been found in IBM Semeru Runtime up to 8.0.442.0/11.0.26.0/17.0.14.0/21.0.6.0 and classified as critical. This impacts an unknown function of the component AES CBC. Performing manipulation results in heap-based buffer overflow. This vulnerability is known as CVE-2025-2900. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Currently trending CVE - Hype Score: 33 - User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

Currently trending CVE - Hype Score: 31 - A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and ...

Currently trending CVE - Hype Score: 31 - VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management ...

Currently trending CVE - Hype Score: 31 - A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series ...

Currently trending CVE - Hype Score: 26 - Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. ...

Currently trending CVE - Hype Score: 1 - Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

Currently trending CVE - Hype Score: 26 - A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

Currently trending CVE - Hype Score: 36 - Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update ...

Currently trending CVE - Hype Score: 38 - An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and below 7.0.10 allows an unauthenticated attacker to execute unauthorized ...

Currently trending CVE - Hype Score: 27 - Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

A vulnerability marked as critical has been reported in Cisco IOS XE. This issue affects some unknown processing of the component IOx Application Hosting Environment. Performing manipulation results in improper access controls. This vulnerability is cataloged as CVE-2023-20065. The attack must be initiated from a local position. There is no exploit available. It is suggested to upgrade the affected component.

从我过往的实践来看，大多数都是测试人员在担任SDL安全对接人，少数是研发骨干、产品经理和安全研究员。他们负责：提安全需求、安全测试、组织开发修复漏洞、组织复盘分析等工作。 回顾最开始设置“产品安全专员”机制时，人选的确定交由业务部门负责人来定，同时建议承担这个角色的人须有一定话语权、熟悉产品及研发过程、最好是对安全感兴趣。其次是在确定人选之后，尽量从组织上来说要正式化、正规化运营，比如召开相关安全培训、持证上岗、发内部IM徽章、轮替也要学习和考试，定期组织开会等。 ------------更多内容，请访问------------- 1、SDL 100问 SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 大家都有哪些SDL运营指标？ 业务系统是否可以带漏洞上线？ 日常的漏洞运营，也应该是SDL团队来做吗？ 关于开发安全BP，对开展SDL有哪些帮助？ 上传图片的API，除了常见web漏洞外，是否还会有风险？ SDL 84/100问：国内是否有做安全基线的厂商或这个方向的专家？ 2、SDL创新实践 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 DevSecOps实施关键：研发安全工具 从安全视角，看研发安全 数字化转型下研发安全痛点 一个思考：安全测试驱动产品安全？ 3、SDL最初实践 【SDL最初实践】开篇 【SDL最初实践】安全培训 【SDL最初实践】安全需求 【SDL最初实践】安全设计 【SDL最初实践】安全开发 【SDL最初实践】安全测试 【SDL最初实践】安全审核 【SDL最初实践】安全响应 4、安全运营实践 基于实践的安全事件简述 安全事件运营SOP：钓鱼邮件 安全事件运营SOP：网络攻击 安全事件运营SOP：蜜罐告警 安全事件运营SOP：webshell事件 安全事件运营SOP：接收漏洞事件 应急能力提升：实战应急困境与突破 应急能力提升：挖矿权限维持攻击模拟