Aggregator

A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been classified as critical. Affected by this issue is the function strcpy of the file /goform/formTaskEdit. The manipulation of the argument txtMin2 leads to buffer overflow. This vulnerability is referenced as CVE-2025-11305. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as problematic has been discovered in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulation of the argument Message leads to cross site scripting. This vulnerability is listed as CVE-2025-11308. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as critical has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Impacted is the function doFilter of the file findDeptPage.do. Performing manipulation of the argument sort results in sql injection. This vulnerability is cataloged as CVE-2025-11309. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as critical has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of the file findFileServerPage.do. Executing manipulation of the argument sort can lead to sql injection. This vulnerability is registered as CVE-2025-11310. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as critical has been reported in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenantPage of the file findTenantPage.do. The manipulation of the argument sort leads to sql injection. This vulnerability is documented as CVE-2025-11311. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as critical has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findModulePage.do. The manipulation of the argument sort results in sql injection. This vulnerability is reported as CVE-2025-11312. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

AI-Powered CAPTCHA Solver This project is a Python-based command-line tool that uses large multimodal models (LMMs) like OpenAI’s

The post AI CAPTCHA Solver: New Tool Uses GPT-4o and Gemini to Beat Various Web Security Challenges appeared first on Penetration Testing Tools.

Opera has unveiled a new experimental browser, Neon, described as an “agent browser” — one where the management

The post Opera Unveils Neon: A $19.90/Month Agent Browser That Delegates Web Tasks to AI appeared first on Penetration Testing Tools.

The Raspberry Pi Foundation has released a new version of its operating system — Raspberry Pi OS Trixie,

The post Raspberry Pi OS Trixie Released: Solves the Year 2038 Problem and Unveils New Control Centre appeared first on Penetration Testing Tools.

Following reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild.

Change log

Update October 14: This FAQ blog has been updated to include information on an additional zero-day flaw, CVE-2025-61884, that was reportedly exploited and part of a leaked proof-of-concept exploit referenced in the advisory for CVE-2025-61882 as well as plugin coverage for this new flaw.

Click here to review the change log history

Update October 14: This FAQ blog has been updated to include information on an additional zero-day flaw, CVE-2025-61884, that was reportedly exploited and part of a leaked proof-of-concept exploit referenced in the advisory for CVE-2025-61882 as well as plugin coverage for this new flaw.

Update October 6: This FAQ blog has been updated to include confirmation of public proof-of-concept exploits and clarification around prerequisites for patching CVE-2025-61882.

Background

Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the wild along with other recently patched vulnerabilities part of Oracle’s initial investigation.

FAQ

What is the Oracle zero-day vulnerability?

On October 4, Oracle published a Security Alert Advisory for a new zero-day vulnerability in E-Business Suite (EBS), Oracle’s integrated business application suite for various business functions including order management, logistics, procurement and more.

What is the CVE for this Oracle zero-day vulnerability?

CVEDescriptionAffected ComponentCVSSv3CVE-2025-61882Oracle Concurrent Processing Remote Code Execution VulnerabilityBusiness Intelligence Publisher (BI Publisher) Integration9.8

Was CVE-2025-61882 exploited in the wild as a zero-day?

Yes. As part of its Security Alert Advisory, Oracle included multiple indicators of compromise (IOCs). Additionally, a blog post from Rob Duhart, Chief Security Officer at Oracle, was updated to highlight the discovery of this zero-day during its investigation into reports of these compromises.

What are these reports of Oracle EBS customers being compromised?

On October 2, there were reports that Oracle customers received emails from the ransomware group known as Cl0p claiming to have stolen information from their EBS systems. On October 3, Oracle confirmed the reports of attempted extortion, adding that their preliminary investigation revealed exploitation of EBS vulnerabilities patched in the July 2025 Oracle Critical Patch Update (CPU).

What were the EBS vulnerabilities that were patched in the July 2025 Oracle CPU?

There were nine vulnerabilities patched in the July 2025 Oracle CPU:

CVEDescriptionCVSSv3CVE-2025-30743Oracle Lease and Finance Management8.1CVE-2025-30744Oracle Mobile Field Service8.1CVE-2025-50105Oracle Universal Work Queue8.1CVE-2025-50071Oracle Applications Framework6.4CVE-2025-30746Oracle iStore6.1CVE-2025-30745Oracle MES for Process Manufacturing6.1CVE-2025-50107Oracle Universal Work Queue6.1CVE-2025-30739Oracle CRM Technical Foundation5.5CVE-2025-50090Oracle Applications Framework5.4

Did Oracle originally say that these vulnerabilities were potentially used in these attacks?

Yes, Oracle did highlight these flaws in a previous version of Duhart’s blog post:

Oracle is aware that some Oracle E-Business Suite (EBS) customers have received extortion emails. Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update. Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates.

However, this reference has since been removed from the blog and replaced with a reference to CVE-2025-61882.

Does this removal mean the vulnerabilities from the July 2025 CPU were not used in these attacks?

The removal of the reference would imply the July 2025 CPU vulnerabilities were not utilized in these attacks. However, there are external reports that suggest that the Cl0p ransomware group exploited multiple vulnerabilities, including some from the July 2025 CPU release. This has not been officially confirmed by Oracle.

Who is the Cl0p ransomware group?

Cl0p (or “Clop”) is a notorious ransomware group that has been operating since February 2019. It began as a traditional ransomware group conducting double-extortion attacks, where it would encrypt and exfiltrate files, then extort victims with the threat of publishing them. The group later pivoted to campaigns focused purely on data exfiltration and extortion. Cl0p has a penchant for targeting and exploiting zero-day vulnerabilities in file transfer software including Accellion, MOVEit Transfer, GoAnywhere, and Cleo.

Is Cl0p identified by any other names?

Cl0p is often referred to or linked to TA505 and FIN11, groups that have deployed the Cl0p ransomware and conducted extortion attacks leveraging various zero-day vulnerabilities.

Is there a proof-of-concept (PoC) available for these vulnerabilities?

As of October 6, public proof-of-concept (PoC) exploits for CVE-2025-61882 are available.

Are patches or mitigations available for CVE-2025-61882 and other associated vulnerabilities?

Yes, patches are available. The zero-day vulnerability, CVE-2025-61882, and the nine CVEs from the July 2025 CPU all affect the same versions of Oracle EBS:

Affected ProductAffected VersionsFixed Versions (CVE-2025-61882)Fixed Versions(July 2025 CPU)Oracle E-Business Suite12.2.3 through 12.2.14Patch Availability DocumentPatch Availability Document

Is there a prerequisite to apply the updates CVE-2025-61882?

Yes. In its Security Alert Advisory for CVE-2025-61882, Oracle noted that the October 2023 CPU is a prerequisite in order to apply the latest updates.

Oracle released another out-of-band advisory for CVE-2025-61884. How is this related?

On October 11, Oracle published an out-of-band Security Alert Advisory for CVE-2025-61884, another Oracle EBS vulnerability affecting the Oracle Configurator. While the advisory made no mention of in-the-wild exploitation or a specific connection to CVE-2025-61882, researchers from watchTowr outlined an exploit chain that includes the /configurator/UiServlet via a server-side request forgery (SSRF). This exploitation route was not patched as part of the Security Alert Advisory for CVE-2025-61882. However, CVE-2025-61884 addresses this exploitation route, which has been confirmed by a number of researchers and customers, according to BleepingComputer.

Has Tenable released any product coverage for these vulnerabilities?

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages as they’re released:

Oracle EBS Zero-Day (CVE-2025-61882):

• CVE-2025-61882

Oracle EBS July 2025 CPU vulnerabilities:

• CVE-2025-30743
• CVE-2025-30744
• CVE-2025-50105
• CVE-2025-50071
• CVE-2025-30746
• CVE-2025-30745
• CVE-2025-50107
• CVE-2025-30739
• CVE-2025-50090

Additional Oracle EBS Zero-Day (CVE-2025-61884):

• CVE-2025-61884

These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Get more information

• Oracle Security Alert Advisory - CVE-2025-61882
• Apply Oracle Security Alert CVE-2025-61882 for Oracle E-Business Suite (EBS)

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect and engage with us in the Threat Roundtable group for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

Following reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild.

Background

Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the wild along with other recently patched vulnerabilities part of Oracle’s initial investigation.

FAQ

What is the Oracle zero-day vulnerability?

On October 4, Oracle published a Security Alert Advisory for a new zero-day vulnerability in E-Business Suite (EBS), Oracle’s integrated business application suite for various business functions including order management, logistics, procurement and more.

What is the CVE for this Oracle zero-day vulnerability?

CVE Description Affected Component CVSSv3 CVE-2025-61882 Oracle Concurrent Processing Remote Code Execution Vulnerability Business Intelligence Publisher (BI Publisher) Integration 9.8

Was CVE-2025-61882 exploited in the wild as a zero-day?

Yes. As part of its Security Alert Advisory, Oracle included multiple indicators of compromise (IOCs). Additionally, a blog post from Rob Duhart, Chief Security Officer at Oracle, was updated to highlight the discovery of this zero-day during its investigation into reports of these compromises.

What are these reports of Oracle EBS customers being compromised?

On October 2, there were reports that Oracle customers received emails from the ransomware group known as Cl0p claiming to have stolen information from their EBS systems. On October 3, Oracle confirmed the reports of attempted extortion, adding that their preliminary investigation revealed exploitation of EBS vulnerabilities patched in the July 2025 Oracle Critical Patch Update (CPU).

What were the EBS vulnerabilities that were patched in the July 2025 Oracle CPU?

There were nine vulnerabilities patched in the July 2025 Oracle CPU:

CVE Description CVSSv3 CVE-2025-30743 Oracle Lease and Finance Management 8.1 CVE-2025-30744 Oracle Mobile Field Service 8.1 CVE-2025-50105 Oracle Universal Work Queue 8.1 CVE-2025-50071 Oracle Applications Framework 6.4 CVE-2025-30746 Oracle iStore 6.1 CVE-2025-30745 Oracle MES for Process Manufacturing 6.1 CVE-2025-50107 Oracle Universal Work Queue 6.1 CVE-2025-30739 Oracle CRM Technical Foundation 5.5 CVE-2025-50090 Oracle Applications Framework 5.4

Did Oracle originally say that these vulnerabilities were potentially used in these attacks?

Yes, Oracle did highlight these flaws in a previous version of Duhart’s blog post:

Oracle is aware that some Oracle E-Business Suite (EBS) customers have received extortion emails. Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update. Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates.

However, this reference has since been removed from the blog and replaced with a reference to CVE-2025-61882.

Does this removal mean the vulnerabilities from the July 2025 CPU were not used in these attacks?

The removal of the reference would imply the July 2025 CPU vulnerabilities were not utilized in these attacks. However, there are external reports that suggest that the Cl0p ransomware group exploited multiple vulnerabilities, including some from the July 2025 CPU release. This has not been officially confirmed by Oracle.

Who is the Cl0p ransomware group?

Cl0p (or “Clop”) is a notorious ransomware group that has been operating since February 2019. It began as a traditional ransomware group conducting double-extortion attacks, where it would encrypt and exfiltrate files, then extort victims with the threat of publishing them. The group later pivoted to campaigns focused purely on data exfiltration and extortion. Cl0p has a penchant for targeting and exploiting zero-day vulnerabilities in file transfer software including Accellion, MOVEit Transfer, GoAnywhere, and Cleo.

Is Cl0p identified by any other names?

Cl0p is often referred to or linked to TA505 and FIN11, groups that have deployed the Cl0p ransomware and conducted extortion attacks leveraging various zero-day vulnerabilities.

Is there a proof-of-concept (PoC) available for these vulnerabilities?

As of October 5, there were no public proof-of-concept (PoC) exploits for CVE-2025-61882 or the other nine CVEs patched in the July 2025 Oracle CPU release.

Are patches or mitigations available for CVE-2025-61882 and other associated vulnerabilities?

Yes, patches are available. The zero-day vulnerability, CVE-2025-61882, and the nine CVEs from the July 2025 CPU all affect the same versions of Oracle EBS:

Affected Product Affected Versions Fixed Versions (CVE-2025-61882) Fixed Versions(July 2025 CPU) Oracle E-Business Suite 12.2.3 through 12.2.14 Patch Availability Document Patch Availability Document

Has Tenable released any product coverage for these vulnerabilities?

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages as they’re released:

Oracle Zero-Day:

• CVE-2025-61882

Oracle EBS July 2025 CPU vulnerabilities:

• CVE-2025-30743
• CVE-2025-30744
• CVE-2025-50105
• CVE-2025-50071
• CVE-2025-30746
• CVE-2025-30745
• CVE-2025-50107
• CVE-2025-30739
• CVE-2025-50090

These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Get more information

• Oracle Security Alert Advisory - CVE-2025-61882
• Apply Oracle Security Alert CVE-2025-61882 for Oracle E-Business Suite (EBS)

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect and engage with us in the Threat Roundtable group for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities appeared first on Security Boulevard.

Cl0p 勒索软件团伙利用 Oracle E-Business Suite 的零日漏洞对客户实施攻击，Oracle 发布安全公告修复该漏洞，并提到其他已修补的漏洞。Cl0p 以利用零日漏洞闻名，曾针对文件传输软件发起攻击。

文章描述了Cl0p勒索软件团伙利用Oracle E-Business Suite（EBS）中的零日漏洞CVE-2025-61882进行攻击，导致客户数据泄露和赎金勒索。Oracle已发布安全公告修复该漏洞，并指出其他补丁修复的九个漏洞可能也被利用。Tenable提供了相关插件以检测这些漏洞。

Earlier this week, we reported on a cyberattack targeting the Japanese brewing giant Asahi, which brought nearly all

The post Asahi Super Dry Supply Crisis Looms in Japan After Cyberattack Halts Production appeared first on Penetration Testing Tools.

A vulnerability has been found in Linux Kernel up to 6.11.2 and classified as critical. Affected by this vulnerability is the function commit_planes_for_stream of the component AMD Display. Performing manipulation results in null pointer dereference. This vulnerability was named CVE-2024-49913. The attack needs to be approached within the local network. There is no available exploit. The affected component should be upgraded.

A vulnerability marked as critical has been reported in Linux Kernel up to 6.1.112/6.6.54/6.10.13/6.11.2. This affects the function planes_changed_for_existing_stream of the component AMD Display. This manipulation causes null pointer dereference. This vulnerability appears as CVE-2024-49912. The attacker needs to be present on the local network. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.10.13/6.11.2. This affects the function set_output_gamma of the component AMD Display. The manipulation results in null pointer dereference. This vulnerability is known as CVE-2024-49909. Access to the local network is required for this attack. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.10.13/6.11.2. Affected is the function set_output_gamma of the component AMD Display. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2024-49911. The attack can only be initiated within the local network. No exploit exists. You should upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.11.2. The impacted element is the function amdgpu_dm_update_cursor of the component AMD Display. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2024-49908. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.11.2. The affected element is the function pipe_ctx->plane_state of the component AMD Display. The manipulation results in null pointer dereference. This vulnerability is reported as CVE-2024-49906. The attacker must have access to the local network to execute the attack. No exploit exists. Upgrading the affected component is advised.