Aggregator

Team Cherry 表示正在改进《空洞骑士：丝之歌》的中文翻译

Solidot
10 months ago
《空洞骑士：丝之歌》于本月初发售之后，在 Steam 平台上，简体中文的评分是“多半差评（好评率 39%）”，而英文评分是“特别好评（好评率 91%）”，为何出现如此巨大的差距？一大原因是简体中文翻译。游戏开发商 Team Cherry 表示他们已经注意到了这一问题，正在着手改进简体中文翻译。Team Cherry 的 Matthew Griffin 称，将在未来几周努力改进翻译。

CVE-2025-9489 | WP-Members Membership Plugin up to 3.5.4.2 on WordPress Shortcode code injection

Vuldb Updates
10 months ago
A vulnerability categorized as critical has been discovered in WP-Members Membership Plugin up to 3.5.4.2 on WordPress. Affected by this vulnerability is an unknown functionality of the component Shortcode Handler. Such manipulation leads to code injection. This vulnerability is traded as CVE-2025-9489. The attack may be launched remotely. There is no exploit available.
vuldb.com

Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers

Help Net Security
10 months ago

Researchers have spotted a malvertising (and clever malware delivery) campaign targeting IT workers in the European Union with fake GitHub Desktop installers. “We believe the goal of this campaign was to gain initial access to organizations for the purposes of malicious activity such as credential theft, infostealing and ransomware deployment,” Arctic Wolf researchers noted. Delivering malware without triggering alerts or suspicion The campaign, which has apparently been running for over half a year, involves a … More →

The post Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers appeared first on Help Net Security.

Zeljka Zorz

周下载量逾 20 亿次的 NPM 包被植入恶意代码

Solidot
10 months ago
这可能是历史上影响规模最大的一次供应链攻击：在一位维护者遭到钓鱼攻击导致其账户被攻击者窃取之后，其维护的 20 个 NPM 包被迅速植入了恶意代码，恶意代码旨在窃取加密货币。这些 NPM 包的周下载量超过 20 亿次。维护者 Josh Junon 收到了一封邮件，要求他登录网站更新 2FA 凭证，否则其账户将会被关闭。邮件使用的域名 support.npmjs.help 是在 3 天前创建的，模仿了 npm 官方域名 npmjs.com。在攻击者获得了他的 2FA 凭证之后，立即了更新了其维护的几十个 NPM 包，植入了窃取加密货币的代码，监控涉及以太坊、比特币、Solana、Tron 等加密货币的转账，一旦检测到此类交易，它会将目标钱包地址替换为攻击者控制的钱包地址。受影响的 NPM 包包括了 [email protected]、[email protected]、[email protected]、[email protected] 、[email protected] 等等。

CVE-2025-9111 | AI ChatBot Plugin up to 7.0.x on WordPress Setting cross site scripting

VulDB Recent Entries
10 months ago
A vulnerability, which was classified as problematic, has been found in AI ChatBot Plugin up to 7.0.x on WordPress. Impacted is an unknown function of the component Setting Handler. Performing manipulation results in cross site scripting. This vulnerability was named CVE-2025-9111. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.
vuldb.com

CVE-2025-42923 | SAP Fiori App 700/800/900/UIS4HOP1 600 cross-site request forgery

VulDB Recent Entries
10 months ago
A vulnerability classified as problematic has been found in SAP Fiori App 700/800/900/UIS4HOP1 600. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. This vulnerability is handled as CVE-2025-42923. The attack can be initiated remotely. There is not any exploit available. It is suggested to install a patch to address this issue.
vuldb.com

CVE-2025-42920 | SAP Supplier Relationship Management 701/702/713/714/SRM_SERVER 700 Link cross site scripting

VulDB Recent Entries
10 months ago
A vulnerability described as problematic has been identified in SAP Supplier Relationship Management 701/702/713/714/SRM_SERVER 700. This affects an unknown part of the component Link Handler. The manipulation results in cross site scripting. This vulnerability is known as CVE-2025-42920. It is possible to launch the attack remotely. No exploit is available. Applying a patch is advised to resolve this issue.
vuldb.com

CVE-2025-43774 | Liferay Portal/DXP Style Book Theme Name cross site scripting (WID-SEC-2025-1990)

VulDB Recent Entries
10 months ago
A vulnerability marked as problematic has been reported in Liferay Portal and DXP. Affected by this issue is some unknown functionality of the component Style Book Theme Name Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-43774. It is possible to initiate the attack remotely. There is no exploit available.
vuldb.com

CVE-2025-58746 | VolkovLabs business-links up to 2.3.x cross site scripting (GHSA-93qj-gv4p-mf53)

VulDB Recent Entries
10 months ago
A vulnerability labeled as problematic has been found in VolkovLabs business-links up to 2.3.x. Affected by this vulnerability is an unknown functionality. Executing manipulation can lead to cross site scripting. This vulnerability appears as CVE-2025-58746. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.
vuldb.com

Managed ad