executorch 安全漏洞

executorch is an open source PyTorch deployment tool for PyTorch by pytorch. A security vulnerability exists in executorch that stems from a heap buffer overflow when loading a model, which could lead to code execution...

executorch 安全漏洞

executorch is an open source PyTorch deployment tool for PyTorch by pytorch. A security vulnerability exists in executorch that stems from an integer overflow that causes an object to be allocated to the wrong memory region, which could lead to the execution of arbitrary code...

IBM App Connect Enterprise (ACE) Path Traversal (7182418)

IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directories. Note that Nessus has not tested fo...

CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

...

CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

...

CVE-2025-53786

CVE-2025-53786 is a high-severity issue affecting on-premises Microsoft Exchange Server in hybrid deployments. The connected documents confirm a privilege-escalation path tied to Exchange Hybrid configurations that can impact Exchange Online identity integrity. Remediation/mitigation relies on in...

UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities

Update 08/06/2025: CISA released a Malware Analysis Report MAR on six files related to CVE-2025-49704link is external, CVE-2025-49706link is external, CVE-2025-53770link is external, and CVE-2025-53771link is external. For more information see MAR-251132.c1.v1 Exploitation of SharePoint...

CVE-2025-45512

A flaw was found in the bootloader component of DENX Software Engineering Das U-Boot U-Boot. This vulnerability allows arbitrary code execution via installation of crafted firmware files due to missing signature verification. Mitigation Mitigation for this issue is either not available or the...

Microsoft Exchange Server 授权问题漏洞

Microsoft Exchange Server is a set of e-mail service programs from Microsoft. It provides email access, storage, forwarding, voicemail, email filtering and screening, and other features. An authorization issue vulnerability exists in Microsoft Exchange Server, which stems from a mixed deployment...

How to Eliminate Deployment Bottlenecks Without Sacrificing Application Security

Today, organizations increasingly rely on DevOps to accelerate software delivery, improve operational efficiency, and enhance business performance. According to RedGate, 74% have adopted DevOps, and according to Harvard Business Review Analytics, 77% of organizations currently depend on DevOps to...

Introducing DataTrap: A Smarter, More Adaptive Honeypot Framework

Today, we're excited to release DataTrap, a powerful, extensible honeypot system built to simulate realistic web applications, IoT devices, and database behavior across HTTP, HTTPS, SSH, and database protocols e.g., MySQL. What sets DataTrap apart? It goes beyond static honeypots by combining...

Leveraging Machine Learning for Botnet Attack Detection in Edge-Computing Assisted IoT Networks

The increase of IoT devices, driven by advancements in hardware technologies, has led to widespread deployment in large-scale networks that process massive amounts of data daily. However, the reliance on Edge Computing to manage these devices has introduced significant security vulnerabilities, a...

CVE-2025-48071

A heap based-buffer overflow flaw was found in OpenEXR. In affected versions, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep-scan-line EXR files with a maliciously forged chunk header. Mitigation Mitigation for this issue is either not available...

CVE-2025-54388

A firewall state management issue was found in the Moby project. When the firewalld service is reloaded, it removes all iptables rules, including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block...

K000152803: Oracle Java SE vulnerability CVE-2025-50106

Security Advisory Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JD...

BIT-GITLAB-2025-1299 Missing Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by...

Program Analysis for High-Value Smart Contract Vulnerabilities: Techniques

A widespread belief in the blockchain security community is that automated techniques are only good for detecting shallow bugs, typically of small value. In this paper, we present the techniques and insights that have led us to repeatable success in automatically discovering high-value smart...

JetBrains TeamCity Information Disclosure

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to the storage of information in an open manner. Exploiting this vulnerability can allow attackers to disclose confidential information...

JetBrains TeamCity CSRF

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to execute a CSRF attack remotely...

Scattered Spider Launching Ransomware on Hijacked VMware Systems, Google

A new report from Google's GTIG reveals how UNC3944 0ktapus uses social engineering to compromise Active Directory, then exploits VMware vSphere for data theft and direct ransomware deployment. Understand their tactics and learn vital mitigation steps...