安全动态回顾|65款违法违规收集使用个人信息的移动应用被通报 微软5月补丁星期二修复72个漏洞
快速浏览！5.12—5.18安全动态周回顾。
Aggregator
玛莎百货遭网络攻击重创 客户数据在攻击中被盗
2 months 2 weeks ago
玛莎百货表示，将通知所有受影响的客户，并承诺在有消息时分享更多细节。
CVE-2024-38141 | Microsoft Windows up to Server 2022 23H2 Ancillary Function Driver for WinSock use after free (EUVD-2024-37100)
2 months 2 weeks ago
A vulnerability was found in Microsoft Windows. It has been classified as critical. Affected is an unknown function of the component Ancillary Function Driver for WinSock. The manipulation leads to use after free.
This vulnerability is traded as CVE-2024-38141. Local access is required to approach this attack. There is no exploit available.
It is recommended to apply a patch to fix this issue.
vuldb.com
CVE-2024-38169 | Microsoft Office Visio heap-based overflow (EUVD-2024-37140)
2 months 2 weeks ago
A vulnerability, which was classified as critical, was found in Microsoft Office. Affected is an unknown function of the component Visio. The manipulation leads to heap-based buffer overflow.
This vulnerability is traded as CVE-2024-38169. It is possible to launch the attack remotely. There is no exploit available.
It is recommended to apply a patch to fix this issue.
vuldb.com
CVE-2024-38187 | Microsoft Windows up to Server 2022 23H2 Kernel-Mode Driver untrusted pointer dereference (EUVD-2024-37156)
2 months 2 weeks ago
A vulnerability was found in Microsoft Windows and classified as critical. This issue affects some unknown processing of the component Kernel-Mode Driver. The manipulation leads to untrusted pointer dereference.
The identification of this vulnerability is CVE-2024-38187. Local access is required to approach this attack. There is no exploit available.
It is recommended to apply a patch to fix this issue.
vuldb.com
CVE-2024-38120 | Microsoft Windows Server 2008 R2 SP1 up to Server 2022 Routing/Remote Access Service heap-based overflow (EUVD-2024-37230)
2 months 2 weeks ago
A vulnerability was found in Microsoft Windows. It has been classified as critical. Affected is an unknown function of the component Routing/Remote Access Service. The manipulation leads to heap-based buffer overflow.
This vulnerability is traded as CVE-2024-38120. It is possible to launch the attack remotely. There is no exploit available.
It is recommended to apply a patch to fix this issue.
vuldb.com
CVE-2024-38214 | Microsoft Windows Server 2008 R2 SP1 up to Server 2022 Routing/Remote Access Service out-of-bounds (EUVD-2024-37181)
2 months 2 weeks ago
A vulnerability was found in Microsoft Windows. It has been rated as problematic. This issue affects some unknown processing of the component Routing/Remote Access Service. The manipulation leads to out-of-bounds read.
The identification of this vulnerability is CVE-2024-38214. The attack may be initiated remotely. There is no exploit available.
It is recommended to apply a patch to fix this issue.
vuldb.com
CVE-2025-1308 | Pure Storage PX Backup up to 2.6.0/2.7.3/2.8.1 log file (EUVD-2025-15792)
2 months 2 weeks ago
A vulnerability was found in Pure Storage PX Backup up to 2.6.0/2.7.3/2.8.1 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to sensitive information in log files.
This vulnerability is handled as CVE-2025-1308. Local access is required to approach this attack. There is no exploit available.
vuldb.com
CVE-2024-38166 | Microsoft Dynamics CRM Service Portal Web Resource cross site scripting (EUVD-2024-37139)
2 months 2 weeks ago
A vulnerability was found in Microsoft Dynamics CRM Service Portal Web Resource and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting.
This vulnerability is handled as CVE-2024-38166. The attack may be launched remotely. There is no exploit available.
This product is a managed service. It is not possible for users to maintain vulnerability countermeasures themselves.
vuldb.com
Play
2 months 2 weeks ago
You must login to view this content
cohenido
Kill
2 months 2 weeks ago
You must login to view this content
cohenido
CVE-2025-4980 | Netgear DGND3700 1.1.00.15_1.00.15NA mini_http /currentsetting.htm information disclosure
2 months 2 weeks ago
A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown code of the file /currentsetting.htm of the component mini_http. The manipulation leads to information disclosure.
This vulnerability was named CVE-2025-4980. The attack can be initiated remotely. Furthermore, there is an exploit available.
It is recommended to apply restrictive firewalling.
Other products might be affected as well. The vendor was contacted early about this disclosure.
vuldb.com
CVE-2025-4978 | Netgear DGND3700 1.1.00.15_1.00.15NA Basic Authentication /BRS_top.html improper authentication
2 months 2 weeks ago
A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown part of the file /BRS_top.html of the component Basic Authentication. The manipulation leads to improper authentication.
This vulnerability is uniquely identified as CVE-2025-4978. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
It is recommended to apply restrictive firewalling.
Other products might be affected as well. The vendor was contacted early about this disclosure.
vuldb.com
CVE-2025-4977 | Netgear DGND3700 1.1.00.15_1.00.15NA /BRS_top.html information disclosure
2 months 2 weeks ago
A vulnerability, which was classified as problematic, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this issue is some unknown functionality of the file /BRS_top.html. The manipulation leads to information disclosure.
This vulnerability is handled as CVE-2025-4977. The attack may be launched remotely. Furthermore, there is an exploit available.
It is recommended to apply restrictive firewalling.
Other products might be affected as well. The vendor was contacted early about this disclosure.
vuldb.com
分数量子反常霍尔效应
2 months 2 weeks ago
永远不会出错的量子计算机正是拓扑量子计算的承诺。传统量子比特极易受环境干扰；而拓扑量子比特天生具备容错能力。过去的几十年里，科学家们一直在寻找拓扑量子比特的合适物理载体。2013 年清华大学团队首次在无磁场条件下观测到"量子反常霍尔效应"。如今科学家在这座"量子金矿"中挖掘出新的"宝藏"——分数量子反常霍尔效应。作为量子霍尔家族的新成员，分数量子反常霍尔效应在高填充分数或超导条件下，能够支持Z3仲费米子，从而实现斐波那契任意子统计并实现通用拓扑量子比特。
Submit #564714: Netgear DGND3700v2 V1.1.00.15_1.00.15NA Exposure of Sensitive System Information to an Unauthorized Cont [Accepted]
2 months 2 weeks ago
Submit #564714 / VDB-309640
153528990
Submit #564712: Netgear DGND3700v2 V1.1.00.15_1.00.15NA Backdoor [Accepted]
2 months 2 weeks ago
Submit #564712 / VDB-309639
153528990
Submit #564711: Netgear DGND3700v2 V1.1.00.15_1.00.15NA Exposure of Sensitive System Information to an Unauthorized Cont [Accepted]
2 months 2 weeks ago
Submit #564711 / VDB-309638
153528990
Closing security gaps in multi-cloud and SaaS environments
2 months 2 weeks ago
In this Help Net Security interview, Kunal Modasiya, SVP, Product Management, GTM, and Growth at Qualys, discusses recent Qualys research on the state of cloud and SaaS security. He talks about how siloed visibility, fragmented tools, and a lack of incident response skills leave organizations vulnerable to misconfigurations, account hijacking, and other threats. Modasiya explains that only a unified, context-aware security strategy can consolidate risk insights, close remediation gaps, and align with how businesses build … More →
The post Closing security gaps in multi-cloud and SaaS environments appeared first on Help Net Security.
Mirko Zorz
Microsoft делает шаг в сторону open source — WSL теперь можно разобрать по винтикам
2 months 2 weeks ago
То, что раньше было закулисьем, стало ареной для экспериментов.