Silverstripe Framework has a XSS vulnerability in HTML editor

Impact A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch...

Rockwell Automation Arena

RISK EVALUATION Successful exploitation of these vulnerabilities could disclose information to an attacker or allow execution of arbitrary code on the system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...

Subnet Solutions PowerSYSTEM Center

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this these vulnerabilities, such as: Minimize network...

Protecting Your Business on the Move: A Modern Cybersecurity Guide

Stay secure on the move. Protect your devices, data, and privacy with smart habits, reliable gear, updated software…...

kiman.odesa.in Open Redirect vulnerability OBB-4042970

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

New AkiraBot Abuses OpenAI API to Spam Website Contact Forms

Cybersecurity researchers have identified a new spam campaign driven by 'AkiraBot,' an AI-powered bot that targets small business…...

togo.poho.com.au Cross Site Scripting vulnerability OBB-4042812

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Qt Group Authorized as a CVE Numbering Authority (CNA) by the CVE Program

Qt Group has been authorized by the Common Vulnerabilities and Exposures CVE® Program as a CVE Numbering Authority CNA, covering all Qt products. It is a significant milestone on Qt’s cybersecurity strategy and aligns with our commitment to robust vulnerability management processes and practices...

PT-2025-15809 · Unknown · Anant Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Anant Addons for Elementor versions 1.1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows unauthorized actions to be performed on a user's account without their knowledge or consent. This ca...

Amazon EC2 SSM Agent Flaw Patched After Privilege Escalation via Path Traversal

Cybersecurity researchers have disclosed details of a now-patched security flaw in the Amazon EC2 Simple Systems Manager SSM Agent that, if successfully exploited, could permit an attacker to achieve privilege escalation and code execution. The vulnerability could permit an attacker to create...

CVE-2025-26671

creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 19:48:36+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114304071467930594 2025-04-08 20:07:38+00:00| seen|...

CVE-2025-21222

creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 17:47:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114303593614137081 2025-04-08 19:48:31+00:00| seen|...

Meet the Deputy CISOs who help shape Microsoft’s approach to cybersecurity

Microsoft launched its Cybersecurity Governance Council in 2024, and with it, named a group of deputy chief information security officers that ensure comprehensive oversight of the company's cybersecurity risk, defense, and compliance. These leaders work in tandem with product and engineering...

CVE-2025-3285

Rockwell Automation Arena is affected by local code execution bugs (CVE-2025-3285) caused by improper validation of user-supplied data, enabling a threat actor to read outside the allocated memory buffer. Exploitation requires a legitimate user to open a malicious DOE file, allowing information d...

Arguing Against CALEA

At a Congressional hearing earlier this week, Matt Blaze made the point that CALEA, the 1994 law that forces telecoms to make phone calls wiretappable, is outdated in today's threat environment and should be rethought: In other words, while the legally-mandated CALEA capability requirements have...

Attackers distributing a miner and the ClipBanker Trojan via SourceForge

Recently, we noticed a rather unique scheme for distributing malware that exploits SourceForge, a popular website providing software hosting, comparison, and distribution services. The site hosts numerous software projects, and anyone can upload theirs. One such project, officepackage , on the ma...

CVE-2024-41792

creationtimestamp| type| source ---|---|--- 2025-04-08 08:46:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10884 2025-04-08 11:48:21+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114302183018844167 2025-04-08 12:07:14+00:00| seen|...

Schneider Electric ConneXium Network Manager Software

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

Schneider Electric Trio Q Licensed Data Radio

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

PT-2025-15596

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to April 2025 Patch Tuesday Description A use-after-free vulnerability exists in the Windows Common Log File System CLFS driver. Successful exploitation of this vulnerability allows an authorized attacker to...