Aggregator

CVE-2025-30369 | Zulip up to 10.0 API authorization bypass through user-controlled sql primary key (GHSA-fcgx-q63f-7gw4)

Vuldb Updates
4 months ago
A vulnerability classified as problematic has been found in Zulip up to 10.0. Affected by this vulnerability is an unknown functionality of the component API. This manipulation causes authorization bypass through user-controlled sql primary key. This vulnerability appears as CVE-2025-30369. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-2339 | otale Tale Blog 2.0.5 /%61dmin/api/logs improper authentication

Vuldb Updates
4 months ago
A vulnerability categorized as problematic has been discovered in otale Tale Blog 2.0.5. Affected is an unknown function of the file /%61dmin/api/logs. Such manipulation leads to improper authentication. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2025-2339. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2025-2340 | otale Tale Blog 2.0.5 Site Settings /options/save saveOptions Site Title cross site scripting

Vuldb Updates
4 months ago
A vulnerability identified as problematic has been detected in otale Tale Blog 2.0.5. Affected by this vulnerability is the function saveOptions of the file /options/save of the component Site Settings. Performing manipulation of the argument Site Title results in cross site scripting. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is known as CVE-2025-2340. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

The Spy on the Network: How a Chinese APT Group Is Hijacking Wi-Fi to Target Diplomats

Penetration Testing Tools - Metepreter.org
4 months ago

The Chinese group UNC6384 has launched a series of attacks against diplomats in Southeast Asia and several other countries, acting in the interests of Beijing. The campaign, observed by Google Threat Intelligence Group in...

The post The Spy on the Network: How a Chinese APT Group Is Hijacking Wi-Fi to Target Diplomats appeared first on Penetration Testing Tools.

ddos

CVE-2025-9533 | TOTOLINK T10 4.1.8cu.5241_B20210927 /formLoginAuth.htm authCode improper authentication

VulDB Recent Entries
4 months ago
A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to improper authentication. This vulnerability is documented as CVE-2025-9533. The attack can be initiated remotely. Additionally, an exploit exists.
vuldb.com

CVE-2025-9532 | Portabilis i-Educar up to 2.10 /RegraAvaliacao/view ID sql injection

VulDB Recent Entries
4 months ago
A vulnerability described as critical has been identified in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. This vulnerability is registered as CVE-2025-9532. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2025-9531 | Portabilis i-Educar up to 2.10 Agenda /intranet/agenda.php cod_agenda sql injection

VulDB Recent Entries
4 months ago
A vulnerability marked as critical has been reported in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection. This vulnerability is cataloged as CVE-2025-9531. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

Home Assistant + Ubiquiti + AI = Home Automation Magic

Troy Hunt
4 months ago

It seems like every manufacturer of anything electrical that goes in the house wants to be part of the IoT story these days. Further, they all want their own app, which means you have to go to gazillions of bespoke software products to control your things. And they're

Troy Hunt

China linked UNC6384 targeted diplomats by hijacking web traffic

Security Affairs
4 months ago
The China-linked APT group UNC6384 targeted diplomats by hijacking web traffic to redirect it to a website that delivered malware. China-linked cyberespionage group UNC6384 targeted diplomats by hijacking web traffic to redirect to a website used to deliver malware, Google’s Threat Intelligence Group (GTIG) warns. Cyberspies hijacked a network’s captive portal using an advanced adversary-in-the-middle […]
Pierluigi Paganini

CVE-2019-9170 | GitLab Community/Enterprise up to 11.6.9/11.7.5/11.8.0 Access Control access control (ID 51971 / Nessus ID 255091)

Vuldb Updates
4 months ago
A vulnerability categorized as critical has been discovered in GitLab Community and Enterprise up to 11.6.9/11.7.5/11.8.0. This issue affects some unknown processing of the component Access Control. Executing manipulation can lead to improper access controls. This vulnerability is handled as CVE-2019-9170. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.
vuldb.com

CVE-2019-14437 | VideoLAN VLC Media Player 3.0.7.1 OGG File modules/demux/xiph.h xiph_SplitHeaders use after free (USN-4131-1 / Nessus ID 255092)

Vuldb Updates
4 months ago
A vulnerability labeled as critical has been found in VideoLAN VLC Media Player 3.0.7.1. Affected is the function xiph_SplitHeaders of the file modules/demux/xiph.h of the component OGG File Handler. Such manipulation leads to use after free. This vulnerability is traded as CVE-2019-14437. The attack may be launched remotely. There is no exploit available. A patch should be applied to remediate this issue.
vuldb.com

CVE-2016-5303 | IMP Horde Groupware/Horde Groupware Webmail Edition up to 5.2.15 data:text/html action/xlink HTML injection (Nessus ID 255096 / BID-94997)

Vuldb Updates
4 months ago
A vulnerability was found in IMP Horde Groupware and Horde Groupware Webmail Edition up to 5.2.15 and classified as problematic. Impacted is an unknown function of the component data:text/html Handler. Such manipulation of the argument action/xlink leads to HTML injection. This vulnerability is documented as CVE-2016-5303. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.
vuldb.com

Managed ad