Aggregator

A vulnerability, which was classified as critical, was found in CyberData 011209 SIP Emergency Intercom. This affects an unknown part. The manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2025-30507. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in CyberData 011209 SIP Emergency Intercom and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. This vulnerability was named CVE-2025-30183. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument File leads to buffer overflow. This vulnerability was named CVE-2025-5901. The attack can be initiated remotely. Furthermore, there is an exploit available.

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument slaveIpList leads to buffer overflow. The identification of this vulnerability is CVE-2025-5902. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. This vulnerability is traded as CVE-2025-5903. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to buffer overflow. This vulnerability is known as CVE-2025-5904. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbio_media.sql leads to path traversal: '../filedir'. This vulnerability is traded as CVE-2024-2318. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. What is Wazuh? Wazuh is a popular open-source security information and event management (SIEM) and extended detection and response (XDR) solution that’s widely used for host-based intrusion detection, log analysis, file integrity monitoring, and more. It’s core components are: Wazuh Manager (server component), which analyzes data and triggers alerts. Made to be installed … More →

The post Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016) appeared first on Help Net Security.

Threat actors are leveraging the growing popularity of OpenAI’s Sora, a cutting-edge video generation model, to distribute malicious software. Disguised as a legitimate shortcut file named “SoraAI.lnk,” this information-stealing malware mimics the branding of Sora to trick users into initiating a multi-stage attack chain. Deceptive Tactics Target OpenAI’s Sora Brand First reported on VirusTotal from […]

The post Malicious Actors Exploit SoraAI’s Popularity & GitHub to Distribute Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google has stepped in to address a security flaw that could have made it possible to brute-force an account's recovery phone number, potentially exposing them to privacy and security risks. The issue, according to Singaporean security researcher "brutecat," leverages an issue in the company's account recovery feature. That said, exploiting the vulnerability hinges on several moving parts,

ИИ не просит отпуск. И не требует денег. Тогда зачем вообще нужны джуны…

不仅需要的电力少，而且可扩展、能学习。

大脑的脑脊液会在脑组织间流动，把代谢垃圾“冲洗”出去，沿着特殊通道排到体外。但随着年龄增长，大脑的这套排污系统会逐渐老化。脑脊液流速变慢，垃圾开始堆积。韩国研究团队利用荧光示踪技术追踪脑脊液的流动路径，在小鼠和猴子面部与颈部皮肤下约 5 毫米处发现了一个浅层淋巴管网络。科学家提出一个大胆的想法：能否通过外部刺激，如按摩，把脑脊液“推”下去？他们设计了一种机械刺激装置，其顶端连接着一个小型棉球。当使用机械装置轻柔刺激小鼠的眼周和下颌皮肤时，脑脊液排出量显著提升，最多可达平时的 3 倍，相当于恢复到了幼鼠水平。在猴子身上，也得到了同样效果。然而有趣的是，大力按摩可能会适得其反，因此刺激的强度必须精准控制。

A vulnerability was found in Schneider Electric Modicon Controllers M241, Modicon Controllers M251, Modicon Controllers M258, Modicon Controllers LMC058 and Modicon Controllers M262. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2025-3117. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Schneider Electric Modicon Controllers M241, Modicon Controllers M251, Modicon Controllers M258 and Modicon Controllers LMC058. It has been declared as problematic. This vulnerability affects unknown code of the component PLC Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-3905. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Schneider Electric EVLink WallBox. It has been classified as problematic. This affects an unknown part. The manipulation of the argument configuration leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-5742. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Schneider Electric Modicon Controllers M241 and Modicon Controllers M251 and classified as problematic. Affected by this issue is some unknown functionality of the component Webserver. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2025-3899. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

NHS in England Urging One Million People to Donate Blood to 'Secure' Supply
The National Health System in England is still dealing with blood supply issues one year after a ransomware attack on a British pathology laboratory services provider disrupted patient care and testing services at several London-based hospitals and triggered a nationwide blood shortage.