Aggregator

VMRay 2025.3版本引入了计算机视觉技术以增强云环境中的钓鱼检测能力。通过分析网页的视觉元素（如登录表单和品牌标志），该技术能够识别钓鱼攻击，即使这些攻击使用了不同的DOM结构或混淆技术。这使得检测更加鲁棒，并减少了漏检的可能性。该功能目前在云环境中可用，并计划在2025.4版本中扩展到本地部署。

​「丐版」Model 车型，在中国可能没有任何竞争力。

CISA бьёт тревогу и рекомендует как можно скорее закрыть уязвимость.

If you think managing cloud security is complex, try doing it across hundreds of satellites orbiting the planet. Each one is a moving endpoint that must stay secure while communicating through long, delay-prone links. A new study explores how AI could automate security for space systems and whether the best approach is to centralize control or spread it out. Space security enters a new era Commercial satellite constellations are changing how the space industry works. … More →

The post Rethinking AI security architectures beyond Earth appeared first on Help Net Security.

A vulnerability was found in itsourcecode Leave Management System 1.0. It has been declared as critical. This affects an unknown function of the file /reset.php. Such manipulation of the argument employid leads to sql injection. This vulnerability is listed as CVE-2025-11432. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability was found in itsourcecode Leave Management System 1.0. It has been rated as problematic. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing manipulation of the argument ID results in cross site scripting. This vulnerability is cataloged as CVE-2025-11433. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability categorized as critical has been discovered in itsourcecode Student Transcript Processing System 1.0. Affected is an unknown function of the file /login.php. Executing manipulation of the argument uname can lead to sql injection. This vulnerability is registered as CVE-2025-11434. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability, which was classified as critical, was found in RegistrationMagic Plugin up to 6.0.6.2 on WordPress. The impacted element is an unknown function. Executing manipulation can lead to sql injection. This vulnerability is tracked as CVE-2025-11204. The attack can be launched remotely. No exploit exists.

Преступники сумели превратить своих последователей в толпу «коллекторов».

A vulnerability described as critical has been identified in varunsardana004 Blood-Bank-And-Donation-Management-System up to dc9e0393d826fbc85fad9755b5bc12cba1919df2. The impacted element is an unknown function of the file /donate_blood.php. Executing manipulation of the argument fullname can lead to sql injection. This vulnerability appears as CVE-2025-11481. The attack may be performed from remote. In addition, an exploit is available. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.

DefectDojo is an open-source tool for DevSecOps, application security posture management (ASPM), and vulnerability management. It helps teams manage security testing, track and remove duplicate findings, handle remediation, and generate reports. Whether you’re a solo security practitioner or a CISO managing multiple teams, DefectDojo helps you organize your security work and report your organization’s security posture. At its core, it functions as a bug tracker for security vulnerabilities. It is designed to collect, organize, and … More →

The post DefectDojo: Open-source DevSecOps platform appeared first on Help Net Security.

Submit #667394 / VDB-327599

A vulnerability was found in Dell PowerProtect Data Domain with Data Domain Operating System of Feature Release, PowerProtect Data Domain with Data Domain Operating System LTS2024 and PowerProtect Data Domain with Data Domain Operating System LTS2023 up to 8.1.0.10. It has been declared as critical. This vulnerability affects unknown code. Executing manipulation can lead to argument injection. This vulnerability is registered as CVE-2025-36565. The attack needs to be launched locally. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability categorized as problematic has been discovered in NASA ION-DTN 4.1.3s. Impacted is an unknown function. The manipulation results in uncontrolled memory allocation. This vulnerability is reported as CVE-2025-61910. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Dell PowerProtect Data Domain with Data Domain Operating System of Feature Release, PowerProtect Data Domain with Data Domain Operating System LTS2024 and PowerProtect Data Domain with Data Domain Operating System LTS2023 up to 8.1.0.10 and classified as critical. This issue affects some unknown processing. Executing manipulation can lead to os command injection. This vulnerability is tracked as CVE-2025-36567. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability classified as problematic has been found in B&R Industrial Automation Automation Runtime up to 6.3. This affects an unknown part. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2025-3448. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in INN 2.2.3. It has been rated as problematic. This affects an unknown function of the file /tmp of the component Configuration Handler. The manipulation leads to symlink following. This vulnerability is documented as CVE-2001-0139. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability marked as problematic has been reported in linuxconf 1.23r. Affected by this issue is some unknown functionality of the file vpop3d. Performing manipulation results in symlink following. This vulnerability is known as CVE-2001-0143. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability was found in ProFTPD 1.2.0rc2 and classified as problematic. Impacted is an unknown function of the component Command Handler. Such manipulation of the argument USER/SIZE leads to improper resource management. This vulnerability is listed as CVE-2001-0136. The attack may be performed from remote. In addition, an exploit is available. It is suggested to upgrade the affected component.

A vulnerability described as critical has been identified in OpenBSD OpenSSH 1.2.2/1.2.3/2.1/2.1.1. This affects an unknown part of the component CRC32 Handler. Executing manipulation can lead to integer coercion error. This vulnerability is handled as CVE-2001-0144. The attack can be executed remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.