Aggregator

A vulnerability labeled as critical has been found in IBM WebSphere Application Server 8.5/9.0. Affected by this vulnerability is an unknown functionality. The manipulation results in server-side request forgery. This vulnerability is known as CVE-2025-27907. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in IBM Sterling Connect:Direct Web Services 6.1.0/6.2.0/6.3.0. This affects an unknown function. Performing manipulation results in session expiration. This vulnerability was named CVE-2024-45651. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability described as critical has been identified in IBM Maximo Asset Management 7.6.1.3. This impacts an unknown function. Executing manipulation can lead to server-side request forgery. This vulnerability is tracked as CVE-2025-2987. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads to unrestricted upload. This vulnerability is traded as CVE-2025-9795. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability described as problematic has been identified in Linux Kernel up to 6.9.9. This vulnerability affects the function ppp_async_encode. Executing manipulation can lead to privilege escalation. The identification of this vulnerability is CVE-2024-41044. The attack needs to be done within the local network. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability has been found in Linux Kernel up to 6.9.9 on UDP and classified as problematic. Affected is the function udp_lib_get_port of the file net/ipv4/udp.c. Performing manipulation results in improper update of reference count. This vulnerability is reported as CVE-2024-41041. The attacker must have access to the local network to execute the attack. No exploit exists. The affected component should be upgraded.

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.1.99/6.6.40/6.9.9. Affected is an unknown function of the component cs_dsp. The manipulation results in buffer overflow. This vulnerability is known as CVE-2024-41039. Access to the local network is required for this attack. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 5.10.221/5.15.162/6.1.99/6.6.40/6.9.9. Affected by this vulnerability is the function tcf_ct_flow_table_process_conn. This manipulation causes use after free. This vulnerability is handled as CVE-2024-41040. The attack can only be done within the local network. There is not any exploit available. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.99/6.6.40/6.9.9. It has been rated as critical. This impacts an unknown function of the component cs_dsp. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-2024-41038. Access to the local network is required for this attack to succeed. There is no exploit available. Upgrading the affected component is advised.

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

Currently trending CVE - Hype Score: 9 - Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with ...

Currently trending CVE - Hype Score: 7 - Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Currently trending CVE - Hype Score: 15 - SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

Currently trending CVE - Hype Score: 15 - When the device is shared, the homepage module are before 2.19.0  in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

The recent mass-theft of authentication tokens from Salesloft, whose AI chatbot is used by a broad swath of corporate America to convert customer interaction into Salesforce leads, has left many companies racing to invalidate the stolen credentials before hackers can exploit them. Now Google warns the breach goes far beyond access to Salesforce data, noting the hackers responsible also stole valid authentication tokens for hundreds of online services that customers can integrate with Salesloft, including Slack, Google Workspace, Amazon S3, Microsoft Azure, and OpenAI.

A vulnerability labeled as critical has been found in IBM Sterling Connect:Direct Web Services 6.1.0/6.2.0/6.3.0. This impacts an unknown function. Executing manipulation can lead to incorrect authorization. The identification of this vulnerability is CVE-2024-49808. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability classified as problematic has been found in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24. This affects an unknown function of the file /index.php. The manipulation of the argument msg leads to cross site scripting. This vulnerability is referenced as CVE-2025-9755. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

A vulnerability classified as problematic was found in Synology RADIUS Server. This vulnerability affects unknown code. Executing manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2024-13987. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.