CVE-2025-6017

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

PT-2025-27605 · Red Hat · Red Hat Advanced Cluster Management

Name of the Vulnerable Software and Affected Versions: Red Hat Advanced Cluster Management versions 2.10 through 2.10.6 Red Hat Advanced Cluster Management versions 2.11 through 2.11.3 Red Hat Advanced Cluster Management versions 2.12 through 2.12.3 Description: A flaw in Red Hat Advanced Cluster...

Xinference 安全漏洞

Xinference is an application by Endeavor's Xiao Yang Personal Developer. A security vulnerability exists in Xinference versions prior to 1.4.0, which stems from improper access control and could lead to unauthorized access to the Web GUI...

MAL-2025-5418 Malicious code in icinga (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 624b17931789ef2a75976d64c2bca71890379a263f31df3d791a382040023d4b Any computer that has this package installed or running should be considered...

Monero Project Forum 安全漏洞

Monero Project Forum is an online forum for Monero Project open source. A security vulnerability exists in Monero Project Forum that stems from unsafe handling of user input resulting in PHP object injection...

Zynq™ UltraScale+™ SoC Overwriting Protected Memory Regions Through PMU Firmware

AMD ID: AMD-SB-8008 Potential Impact: Loss of confidentiality and Integrity Severity: Medium Summary In Zynq™ UltraScale+™ devices, the Platform Management Unit PMU Firmware is designed to implement runtime post boot software services that allow a remote processor to command the PMU to execute...

ZrLog 安全漏洞

ZrLog is a blogging system developed in Java language by xiaochun individual developer. A security vulnerability exists in ZrLog version 3.1.5, which is caused by a server-side request forgery in the downloadUrl parameter...

AVTECH DVR 安全漏洞

AVTECH DVR is a digital video recorder from AVTECH, a Taiwan, China-based company. A security vulnerability exists in AVTECH DVR that originates from a command injection due to uncleaned input in the Search.cgi endpoint...

AT&T to pay compensation to data breach victims. Here’s how to check if you were affected

AT&T is set to pay $177 million to customers affected by two significant data breaches. These breaches exposed sensitive personal information of millions of current and former AT&T customers. For those that have missed the story so far: Back in 2021, an entity named Shiny Hunters a known hacking...

Norwegian Dam Valve Forced Open for Hours in Cyberattack

Unidentified hackers breached a Norwegian dam's control system in April, opening its valve for hours due to a weak password. Learn how simple vulnerabilities threaten critical infrastructure...

Ahold Delhaize Confirms Data Breach of 2.2M amid INC Ransomware Claims

Grocery giant Ahold Delhaize USA faced a major data breach affecting over 2.2 million employees. Learn what sensitive info was stolen and the ransomware group behind the Nov 2024 attack...

A week in security (June 23 – June 29)

Last week on Malwarebytes Labs: Gmail’s multi-factor authentication bypassed by hackers to pull off targeted attacks Thousands of private camera feeds found online. Make sure yours isn’t one of them Sextortion email scammers increase their "Hello pervert" money demands Many data brokers are faili...

Sudo 安全漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands with special privileges in a secure manner. A security vulnerability exists in versions of Sudo prior to 1.9.17p1 that stems from allowing listed users to execute commands on unintended machines...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a DNS rebinding risk in cURL request processing...

CVE-2025-53211

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through = 2.2.3...

DaiCuo 安全漏洞

DaiCuo DaiCuo is an adaptive backend management framework based on ThinkPHP, Bootstrap and Jquery by China-based DaiCuo. A security vulnerability exists in DaiCuo 1.3.13 and earlier versions, which stems from a cross-site request forgery due to incorrect operation of the file /admin.php/addon/ind...

MAL-2025-5369 Malicious code in blurmph (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a388ac1fda2ec8130f5f2e3c7417a6d0c3ad7bc92a9c422c1ce7bafd296e1804 Any computer that has this package installed or running should be considered...

CVE-2024-36347

Summary (CVE-2024-36347) Improper signature verification in the AMD CPU ROM microcode patch loader may allow a local administrator to load unsigned/malicious microcode, risking integrity of x86 instruction execution, and confidentiality/integrity of data in the privileged CPU context and potentia...

The Age of Integrity

We need to talk about data integrity. Narrowly, the term refers to ensuring that data isn’t tampered with, either in transit or in storage. Manipulating account balances in bank databases, removing entries from criminal records, and murder by removing notations about allergies from medical record...

Lychee 安全漏洞

Lychee is a beautiful and easy to use photo management system open-sourced by The Lychee Organisation. It is used to manage and share photos. A security vulnerability exists in Lychee versions prior to 6.6.13, which stems from a server-side request forgery in the /api/v2/Photo::fromUrl endpoint...