GLPI Cross-Site Scripting Vulnerability (CNVD-2025-17793)

GLPI is a free asset and IT management software suite. A phishing attack vulnerability exists in GLPI versions 9.1.0 through 10.0.18, which stems from a planning feature that does not effectively filter malicious links sent by unauthenticated users. An attacker could use this vulnerability to...

UBUNTU-CVE-2025-52897

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

UBUNTU-CVE-2025-52567

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

Microsegmentation in Zero Trust Part One: Introduction and Planning

The Journey to Zero Trust series covers cybersecurity capabilities and architecture supporting organization adoption of modern zero trust ZT principles. ZT’s core concept of never trust and always verify evolved from prior cybersecurity models. This current ZT series supports an organization’s ZT...

GLPI 安全漏洞

GLPI is a free asset and IT management software suite. A phishing attack vulnerability exists in GLPI versions 9.1.0 through 10.0.18, which stems from a planning feature that does not effectively filter malicious links sent by unauthenticated users. An attacker could use this vulnerability to...

Optimal Planning for Enhancing the Resilience of Modern Distribution Systems against Cyberattacks

The increasing integration of IoT-connected devices in smart grids has introduced new vulnerabilities at the distribution level. Of particular concern is the potential for cyberattacks that exploit high-wattage IoT devices, such as EV chargers, to manipulate local demand and destabilize the grid...

The software’s vulnerability regarding access to analytics and planning tools within the IBM Analytics Content Hub, due to deficiencies in the error reporting mechanism, allows a perpetrator to gain access to confidential information.

The vulnerability of the software for accessing analytics and planning tools in the IBM Analytics Content Hub is related to deficiencies in the reporting mechanism for errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to confidential...

The vulnerability of software for accessing analytics and planning tools in the IBM Analytics Content Hub, related to the disclosure of information through source code, allows a perpetrator to disclose protected information.

The vulnerability of the software for accessing analytics and planning tools in the IBM Analytics Content Hub is related to the disclosure of information through the source code. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

jshERP 授权问题漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. An authorization issue vulnerability exists in jshERP 3.5 and earlier versions, which stems from a weak password recovery due to incorrect operation of the file /jshERP-boot/user/updatePwd...

Vulnerability Mitigation System (VMS): LLM Agent and Evaluation Framework for Autonomous Penetration Testing

As the frequency of cyber threats increases, conventional penetration testing is failing to capture the entirety of todays complex environments. To solve this problem, we propose the Vulnerability Mitigation System VMS, a novel agent based on a Large Language Model LLM capable of performing...

ABIS Adjutant Core Accounting ERP 安全漏洞

ABIS Adjutant Core Accounting ERP is an enterprise resource planning software system from ABIS Corporation. A security vulnerability exists in ABIS Adjutant Core Accounting ERP build v.PreBeta250F, which stems from the cid parameter in a GET request that is vulnerable to SQL injection attacks,...

CISA and Partners Urge Critical Infrastructure to Stay Vigilant in the Current Geopolitical Environment

Today, CISA, in collaboration with the Federal Bureau of Investigation FBI, the Department of Defense Cyber Crime Center DC3, and the National Security Agency NSA, released a Fact Sheet urging organizations to remain vigilant against potential targeted cyber operations by Iranian state-sponsored ...

Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics

Summary There are vulnerabilities in Open Source Software OSS components consumed by IBM Planning Analytics. This Security Bulletin relates only to the direct usage of third-party components by IBM Planning Analytics Workspace and not any nested dependencies within the product. Vulnerability...

Axis Communications End-of-Life Devices Detection

The current plugin identifies Axis devices that are end-of-life, i.e., still supported but have a discontinued date announced. Axis Lifecycle Statuses: - Active: Most current offering within a product category. - End of Life: Discontinued date announced - actively execute migrations and last time...

WordPress plugin CRM ERP Business Solution 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An improper access control vulnerability exists in the WordPress CRM ERP Business Solution plugin that stems from a lack of authorization, and no detailed vulnerability details...

Cyber resilience begins before the crisis

In this blog you will hear directly from Microsoft’s Deputy Chief Information Security Officer CISO for Customer Security, Ann Johnson, about the need for proactive planning in cyber incidents, particularly surrounding communications. This blog is part of a new, ongoing series where our Deputy...

Your Agent Can Defend Itself against Backdoor Attacks

Despite their growing adoption across domains, large language model LLM-powered agents face significant security risks from backdoor attacks during training and fine-tuning. These compromised agents can subsequently be manipulated to execute malicious operations when presented with specific...