Aggregator

A vulnerability was found in Linux Kernel up to 5.17.0. It has been rated as problematic. Affected by this issue is the function vmalloc. The manipulation leads to allocation of resources. This vulnerability is handled as CVE-2022-49292. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 5.10.110/5.15.33/5.16.19/5.17.2 and classified as problematic. Affected by this issue is the function pm8001_send_abort_all. The manipulation leads to allocation of resources. This vulnerability is handled as CVE-2022-49120. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 5.4.188/5.10.109/5.15.32/5.16.18/5.17.1. It has been classified as critical. This affects the function tcp_bpf_sendmsg of the file net/core/stream.c. The manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2022-49209. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

Vite开发服务器任意文件读取漏洞分析复现（CVE-2025-31486）

原生新链-SPring AOP 原生链挖掘思路分析

Microsoft warns of a malvertising campaign using Node.js to deliver info-stealing malware via fake crypto trading sites like Binance and TradingView. Microsoft has observed Node.js increasingly used in malware campaigns since October 2024, including an ongoing crypto-themed malvertising attack as of April 2025. Threat actors are increasingly using Node.js to deploy malware, shifting from traditional […]

Уязвимость в корне SSH ставит под удар устройства Cisco и Ericsson.

TGctfWP-pwn签到gets函数造成的栈溢出，打ret2libc即可fmt给了栈地址以及一次格式化字符串漏洞，修改printf的返回地址为0x40123d，即可反复利用格式化字符串漏洞，第一次格式化字符串漏洞顺便泄露libc基址，后续把返回地址改为one_gagdet即可overflow看汇编得到，会跳转到ecx-4指向的地址，前面会把栈内容弹栈到rcx，可以完成一次栈迁移的操作静态编译，直

Kubernetes中发现了一个安全问题，在某些情况下，可以访问pod网络的未经身份验证的攻击者可以在ingress nginx控制器的上下文中执行任意代码。

2025数字中国创新大赛-移动互联网（APP）安全积分争夺赛初赛 Writeup

A vulnerability classified as critical has been found in Netgear WNR854T 1.5.2. This affects the function SetDefaultConnectionService. The manipulation leads to stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is uniquely identified as CVE-2024-54808. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability has been found in Netgear WNR854T 1.5.2 and classified as critical. This vulnerability affects the function parse_st_header of the component Header Parameter Handler. The manipulation leads to stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability was named CVE-2024-54809. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Password Protected Plugin up to 2.7.7 on WordPress. It has been declared as critical. This vulnerability affects the function password_protected_cookie. The manipulation leads to improper authentication. This vulnerability was named CVE-2025-3453. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Contact Form Forminator Forms Plugin up to 1.42.0 on WordPress. It has been rated as critical. This issue affects the function handle_stripe_single. The manipulation leads to improper authorization. The identification of this vulnerability is CVE-2025-3479. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Contact Form Forminator Forms Plugin up to 1.42.0 on WordPress. Affected is an unknown function. The manipulation of the argument limit leads to cross site scripting. This vulnerability is traded as CVE-2025-3487. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2025-3015. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. This vulnerability was named CVE-2025-3016. The attack can be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

长风万里，安全无疆

本文讨论软件供应链安全的重要性，并重点关注Python里PyPI生态中的具体风险。然后通过本地实验演示了四种常见的攻击手法：利用 setup.py 在安装时执行恶意代码、利用 __init__.py 在导入时执行恶意代码、通过域名仿冒（Typosquatting）诱导用户安装拼写错误的恶意包，以及利用星标劫持（Star Jacking）在github等托管平台伪造项目流行度以欺骗开发者。

Patients go to the facility where the doctor or treatment care they need is located. It might be a hospital, a medical building, an urgent care facility, or a clinic. Regardless of location, the expectation has always been a quality patient care experience: The medical professional they are dealing with will be able to...