Aggregator

我们对肚脑虫组织的持续追踪发现该组织曾使用couldmailauth.com托管恶意软件。近期我们捕获到另一批以该域名为 C&C 服务器的样本，此类样本为摩诃草组织的 Spyder 下载器，并且其中一个样本带有与肚脑虫样本相同的数字签名。

HackerNews 编译，转载请注明出处： 此前曝光的Bumblebee恶意软件SEO投毒攻击活动已扩大攻击面，除此前发现的VMware管理工具RVTools官网仿冒事件外，攻击者正通过更多仿冒知名开源项目的域名实施渗透。安全研究人员发现两起新案例——攻击者分别仿冒网络扫描工具Zenmap（Nmap的图形界面）和网络诊断工具WinMTR的官方网站，这些工具因需要管理员权限运行，成为突破企业网络防御的理想切入点。 仿冒域名zenmap[.]pro和winmtr[.]org被用于传播恶意负载。前者在直接访问时显示与Zenmap相关的AI生成博客内容作为伪装，但当用户通过谷歌、必应等搜索引擎跳转至该域名时，会呈现高度仿真的nmap工具下载页面，提供携带Bumblebee的安装程序“zenmap-7.97.msi”。后者域名当前虽已下线，但攻击链模式如出一辙。 恶意MSI安装包在部署合法软件功能的同时，会植入恶意DLL文件。这种“白加黑”技术与此前RVTools供应链攻击手法完全一致，通过合法程序掩护Bumblebee加载器的运行。该加载器可进行受害者设备指纹采集，并为后续投放勒索软件、信息窃取程序等恶意载荷建立通道。 攻击版图持续扩张，安全团队还发现该活动针对安防领域：仿冒韩华Techwin监控管理软件WisenetViewer，以及视频管理系统Milestone XProtect的官方网站milestonesys[.]org。值得注意的是，正版RVTools下载站点Robware.net和RVTools.com仍处于离线状态，页面仅显示“勿从非官方渠道下载”的警示——这与攻击者通过DDoS攻击瘫痪官网、迫使用户转向恶意站点的策略形成呼应。戴尔科技集团明确否认官方渠道分发过带毒版本，并将官网下线归因于遭受DDoS攻击。 病毒检测数据显示，这些恶意安装包在VirusTotal上的检出率极低：Zenmap相关样本71个引擎中仅33个报毒，WinMTR样本71个引擎中仅28个识别威胁。安全专家建议用户务必通过软件官网或可信包管理器获取工具，安装前需校验文件哈希值与官方发布版本的一致性。       消息来源：bleepingcomputer； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability was found in Rhymix 2.1.22. It has been rated as problematic. This issue affects the function procFileAdminEditImage of the file /file/file.admin.controller.php. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2025-45242. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability classified as critical was found in Netgear RAX5 1.0.2.26. This vulnerability affects the function vif_disable. The manipulation of the argument iface leads to command injection. This vulnerability was named CVE-2024-57233. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Netgear RAX5 1.0.2.26. Affected is the function vif_enable. The manipulation of the argument iface leads to command injection. This vulnerability is traded as CVE-2024-57235. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Netgear RAX5 1.0.2.26. This issue affects the function apcli_cancel_wps. The manipulation of the argument ifname leads to command injection. The identification of this vulnerability is CVE-2024-57234. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in DBSyncer 2.0.6. This affects an unknown part of the file /config/download of the component JSON File Parser. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2025-45237. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability was found in payload DBSyncer 2.0.6 and classified as problematic. Affected by this issue is some unknown functionality of the component Edit Profile Feature. The manipulation of the argument Nickname leads to cross site scripting. This vulnerability is handled as CVE-2025-45236. The attack may be launched remotely. There is no exploit available.

最近闲来无事，突然想到了dvwa中的api模块还没有完成

A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown functionality of the file /hr_soft/admin/Update_User.php. The manipulation of the argument ID leads to sql injection. This vulnerability is handled as CVE-2025-1167. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in svenl77 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Plugin up to 3.4.24 on WordPress. It has been rated as problematic. This issue affects the function wc4bp_delete_page. The manipulation leads to missing authorization. The identification of this vulnerability is CVE-2024-13358. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in svenl77 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Plugin up to 3.4.25 on WordPress. Affected is the function wc4bp_delete_page. The manipulation leads to missing authorization. This vulnerability is traded as CVE-2025-1780. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in techjewel Fluent Support Plugin up to 1.8.5 on WordPress. Affected by this issue is some unknown functionality of the file /wp-content/uploads/fluent-support. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2024-13568. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in wpcalc Counter Box Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument content leads to cross site scripting. This vulnerability is known as CVE-2024-13901. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in wordplus Better Messages Plugin up to 2.6.9 on WordPress. This issue affects some unknown processing of the file /wp-content/uploads/bp-better-messages of the component File Attachment Handler. The manipulation leads to information disclosure. The identification of this vulnerability is CVE-2024-13611. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in wordplus Better Messages Plugin up to 2.7.4 on WordPress and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to server-side request forgery. This vulnerability is handled as CVE-2024-13697. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in zj1983 zz up to 2024-8 and classified as critical. Affected by this issue is the function getUserOrgForUserId of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userID leads to sql injection. This vulnerability is handled as CVE-2025-1821. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /import_data_check. The manipulation of the argument url leads to server-side request forgery. This vulnerability is traded as CVE-2025-1848. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /import_data_todb. The manipulation of the argument url leads to server-side request forgery. This vulnerability is known as CVE-2025-1849. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper authorization. The identification of this vulnerability is CVE-2025-1847. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.