Aggregator

A vulnerability was found in Informática del Este WinPlus 24.11.27. It has been rated as problematic. This issue affects some unknown processing of the file /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post of the component Query Handler. Performing manipulation of the argument descripcion results in cross site scripting. This vulnerability is reported as CVE-2025-41350. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in WSO2 Open Banking AM, Open Banking IAM, Traffic Manager, Universal Gateway, API Control Plane, API Manager, Identity Server, Identity Server as Key Manager, Enterprise Integrator and org.wso2.carbon:org.wso2.carbon.ui. It has been classified as problematic. This affects an unknown part of the component Admin Service. This manipulation causes cross-site request forgery. This vulnerability is registered as CVE-2025-6670. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Informática del Este WinPlus 24.11.27. It has been declared as problematic. This vulnerability affects unknown code of the file /WinplusPortal/ws/sWinplus of the component Query Handler. Such manipulation of the argument descripcion leads to cross site scripting. This vulnerability is documented as CVE-2025-41349. The attack can be executed remotely. There is not any exploit available.

根据发表在《Frontiers in Zoology》期刊上的一项研究，生活在城市的浣熊显示出驯化的早期迹象。城里的残羹剩饭为动物提供了取之不尽的美食，但对动物而言城市和它们生活的野外环境有很大区别，为适应城市生活它们面临巨大的选择适应压力。驯化并非只是人类捕捉野生动物然后选择性繁殖，野生动物适应人类环境也是一种驯化。驯化的动物相比野生动物有些显著差异的生物特征，如脸短、头小、耳朵下垂以及白色皮毛斑块，这些特征被称为驯化综合征。生物学家 Raffaela Lesch 和同事分析了 iNaturalist 上的近两万张浣熊照片，发现城市浣熊的吻部比农村同类短 3.5%。研究人员计划接下来捕捉城市浣熊，观察它们是否比农村浣熊更友善。

Choosing Cloud Monitor Provides Stronger Safety Alerts, Cybersecurity Protection, and Peace of Mind—All Within Budget At Richland County Community Unit School District #1 in Illinois, Technology Coordinator Ryan Roark has spent 17 years ensuring that students have access to safe, effective learning technology. His small but experienced IT team of three manages over 2,100 students ...

The post Richland County CUSD Finds “More Bang for the Buck” with ManagedMethods appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.

The post Richland County CUSD Finds “More Bang for the Buck” with ManagedMethods appeared first on Security Boulevard.

A dangerous scam targeting WhatsApp users has emerged as one of the fastest-growing threats across messaging platforms worldwide. The scheme exploits WhatsApp’s screen-sharing feature, introduced in 2023, to manipulate users into exposing their most sensitive financial and personal information. Reports from the United Kingdom, India, Hong Kong, and Brazil highlight the scam’s global reach, with […]

The post WhatsApp Screen-Sharing Scam Let Attackers Trick Users into Revealing Sensitive Data appeared first on Cyber Security News.

Звук, которого нет, превратился в манифест против цифровой эпохи.

Глобальный инцидент оставил миллионы пользователей без доступа к привычным сервисам.

Cloudflare is investigating an outage affecting its global network services, with users encountering "internal server error" messages when attempting to access affected websites and online platforms. [...]

关于ASIS CTF比赛还是很多好玩的东西，因为最近在研究前端安全的东西，很适合做这类的题，所以如果你也在研究前端安全可以来看看这篇文章

前端安全侧信道获取敏感数据的一些方法。

Селфи, группы поддержки, пресс-релизы — и готова разведсводка.

Social media has been a familiar, even mundane, part of life for nearly two decades. It can be easy to forget it was not always that way.

In 2008, social media was just emerging into the mainstream. Facebook reached 100 million users that summer. And a singular candidate was integrating social media into his political campaign: Barack Obama. His campaign’s use of social media was so bracingly innovative, so impactful, that it was viewed by journalist David Talbot and others as the strategy that enabled the first term Senator to win the White House...

The post AI and Voter Engagement appeared first on Security Boulevard.

Google has shipped an emergency fix for a Chrome vulnerability (CVE-2025-13223) reported as actively exploited in the wild by its Threat Analysis Group (TAG). About CVE-2025-13223 CVE-2025-13223 is a type confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome and Chromium-based browsers. The flaw allows remote attackers to exploit heap corruption via a specially crafted HTML page, and can lead to unauthorized actions such as accessing sensitive data. For the exploit to … More →

The post Google patches yet another exploited Chrome zero-day (CVE-2025-13223) appeared first on Help Net Security.

CISA released six Industrial Control Systems (ICS) Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. 

• ICSA-25-322-01 Schneider Electric EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio
• ICSA-25-322-02 Shelly Pro 4PM
• ICSA-25-322-03 Shelly Pro 3EM
• ICSA-25-322-04 Schneider Electric PowerChute Serial Shutdown
• ICSA-25-322-05 METZ CONNECT EWIO2
• ICSA-25-224-03 Schneider Electric EcoStruxure (Update B) 

CISA encourages users and administrators to review newly released ICS Advisories for technical details and mitigations. 

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2025-58034 Fortinet FortiWeb OS Command Code Injection Vulnerability 

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.  

With recent and ongoing exploitation events Fortinet Releases Security Advisory for Relative Path Traversal Vulnerability Affecting FortiWeb Products, a reduced remediation timeframe of one week is recommended. See BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces for steps to reduce the attack surface created by devices accessible to the public internet. 

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. 

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

ntdll kernel32 模块基址获取新思路

用友U8 Cloud NCCloudGatewayServlet接口任意文件上传漏洞分析

前言上文中我们讲述了直接系统调用技术，它可以不使用ntdll中的Syscall（系统调用）指令，自己在代码中实现、用以绕过针对ntdll中函数的hook，特点是Syscall指令在程序自身的内存空间中，而不是ntdll的内存空间中，由此，AV/EDR也有了相应的检测机制，如果发现Syscall指令不在ntdll内存空间中，则将其视为可疑的IoC，攻击者为了消除这个IoC，间接系统调用技术在此背景下