Aggregator

Submit #691944 / VDB-332764

Submit #691943 / VDB-332763

A vulnerability was found in Icon List Block Plugin up to 1.2.1 on WordPress. It has been rated as critical. This impacts the function fs_api_request. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2025-12376. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in AI Engine Plugin up to 3.1.8 on WordPress. It has been declared as critical. This affects the function rest_helpers_create_images. Executing manipulation can lead to server-side request forgery. This vulnerability appears as CVE-2025-8084. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in WP Migrate Lite Plugin up to 2.7.6 on WordPress. It has been classified as critical. The impacted element is the function wpmdb_flush. Performing manipulation results in server-side request forgery. This vulnerability is reported as CVE-2025-11427. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Element Pack Addons for Elementor Plugin up to 8.3.4 on WordPress and classified as problematic. The affected element is the function render of the component Street Map Widget. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2025-13196. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in WP Duplicate Page Plugin up to 1.7 on WordPress and classified as problematic. Impacted is the function saveSettings. This manipulation causes missing authorization. This vulnerability is registered as CVE-2025-12481. Remote exploitation of the attack is possible. No exploit is available.

Submit #691940 / VDB-332762

A vulnerability, which was classified as problematic, was found in delabon Live Sales Notification for Woocommerce Plugin up to 2.3.39 on WordPress. This issue affects the function getOrders of the component Customer Information Handler. The manipulation results in missing authorization. This vulnerability is cataloged as CVE-2025-12955. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Enable SVG, WebP, and ICO Upload Plugin up to 1.1.2 on WordPress. This vulnerability affects unknown code of the component ICO File Handler. The manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2025-13069. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in Pixel Manager for WooCommerce Plugin up to 1.49.2 on WordPress. This affects the function ajax_pmw_get_product_ids. Executing manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2025-12545. The attack can be launched remotely. No exploit exists.

Submit #691941 / VDB-205673

Submit #691936 / VDB-332761

Submit #691939 / VDB-208134

Take-Two Interactive CEO Strauss Zelnick 在接受采访时表示，游戏行业正转向 PC 从封闭转向开放，但游戏机作为一种体验并不会消失。Zelnick 表示，游戏机和手游的市场份额产不多，但手游增长速度比游戏机更快。索尼 PS 和任天堂 Switch 的游戏机业务取得了成功，而竞争对手拥有 Xbox 的微软则暗示下一代硬件将更面向 PC 游戏。Valve 最近宣布的 Steam Machin 就是游戏机和 PC 的混合设备。

HackerNews 编译，转载请注明出处： 肯尼亚政府本周一上午遭遇网络攻击，多个部委官网被黑客篡改并悬挂种族主义信息长达数小时。攻击者将政府部门网站标记上白人至上主义标语。 包括内政部、卫生部、教育部、能源部、劳工部及水资源部在内的多个政府官网遭黑客接管。肯尼亚内政部发布公告确认此次事件，称多个政府网站因攻击暂时无法访问。 政府声明称：”初步调查显示，此次攻击疑似由自称‘PCP@肯尼亚’的组织实施。事件发生后，我们立即启动事件响应与恢复程序，协同相关各方减轻影响并恢复平台访问。目前局势已得到控制，系统正处于持续监控状态。” 内政部呼吁民众若掌握任何关于此次网络攻击的信息，立即联系国家肯尼亚计算机事件响应小组。 值得注意的是，与肯尼亚接壤的索马里刚于前一天报告其移民与公民事务局遭遇网络攻击。索马里政府表示发现通过电子签证入境人员的资料遭泄露，该机构正在调查事件并确定受影响人数范围。 美国驻索马里使馆指出，此事与11月11日出现的指控相关——当时黑客声称渗透该国电子签证系统，可能泄露”至少3.5万人的个人数据，其中包括数千名美国公民”。使馆补充说明：”泄露数据包含签证申请人的姓名、照片、出生日期与地点、电子邮箱、婚姻状况及家庭住址。虽然摩加迪沙使馆无法确认具体个体数据是否遭泄，但所有申请过索马里电子签证的人员都可能受到影响。” 截至周一下午，尚未有任何黑客组织宣称对这两起事件负责。     消息来源：therecord.media； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability classified as critical has been found in Canva up to 1.117.0 on macOS. Affected by this issue is some unknown functionality. Performing manipulation results in incorrect default permissions. This vulnerability is identified as CVE-2025-12792. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in Gallagher High Sec End of Line Module. Affected by this vulnerability is an unknown functionality. Such manipulation leads to incorrect usage of seeds in prng. This vulnerability is referenced as CVE-2025-52578. The attack can be executed directly on the physical device. No exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in Gallagher T21 Reader. Affected is an unknown function. This manipulation causes missing release of resource. The identification of this vulnerability is CVE-2025-64734. It is feasible to perform the attack on the physical device. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in Gallagher HBUS Devices. This impacts an unknown function. The manipulation results in observable timing discrepancy. This vulnerability was named CVE-2025-52457. An attack on the physical device is feasible. There is no available exploit. The affected component should be upgraded.