PT-2025-12215

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0 Description The application contains methods that request data from external servers without defined timeouts. This can cause the server to wait indefinitely for a response, potentially leading to a denial of servic...

PT-2025-12245

Name of the Vulnerable Software and Affected Versions aimhubio/aim version bb76afe Description A vulnerability in the LockManager.release locks function allows for arbitrary file deletion through relative path traversal. The run hash parameter, which is user-controllable, is concatenated without...

PT-2025-12026

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0 Description The ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the...

PT-2025-12186

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0 Description The software contains a Cross-Site Request Forgery CSRF vulnerability in the tracking server. This is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables...

PT-2025-12305

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.25.0 Description The tracking server in aimhubio/aim is vulnerable to a denial of service attack. This occurs because the server overrides the maximum size for websocket messages, allowing very large images to be tracked...

PT-2025-12170

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0 Description The issue concerns the LocalFileManager. cleanup function in the aim tracking server, which accepts a user-specified glob-pattern for deleting files. This function does not verify that the matched files...

CVE-2025-25042

creationtimestamp| type| source ---|---|--- 2025-03-18 19:48:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7980 2025-03-18 20:18:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkoihzz5jf26 2025-03-18 21:55:41+00:00| seen| https://t.me/cvedetector/20606...

CVE-2025-27760

creationtimestamp| type| source ---|---|--- 2025-03-18 02:01:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkml5pgvrs2j...

conntrack-tools bug fix update

An update is available for conntrack-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The conntrack-tools packages enable the user to set up a High...

Cybercriminals Exploit CSS to Evade Spam Filters and Track Email Users' Actions

Malicious actors are exploiting Cascading Style Sheets CSS, which are used to style and format the layout of web pages, to bypass spam filters and track users' actions. That's according to new findings from Cisco Talos, which said such malicious activities can compromise a victim's security and...

A week in security (March 10 – March 16)

Last week on Malwarebytes Labs: Research on iOS apps shows widespread exposure of secrets Don’t let your kids on Roblox if you’re not comfortable, says Roblox CEO Update your iPhone now: Apple patches vulnerability used in "extremely sophisticated attacks" The dark side of sports betting: How...

CVE-2024-54446

creationtimestamp| type| source ---|---|--- 2025-03-14 20:46:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkei5xmcjy2m 2025-03-14 20:53:44+00:00| seen| https://t.me/cvedetector/20334...

GHSA-P3X9-6H7P-CGFC

creationtimestamp| type| source ---|---|--- 2025-03-14 18:23:02+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3lkea5pjd6i23 2025-03-30 06:32:02+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9547...

UBUNTU-CVE-2023-52927

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nfctfindexpectation Currently nfconntrackin calling nfctfindexpectation will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the nfctfindexpectation function not removing exp, which could result in ct's being created that are not...

Abusing with style: Leveraging cascading style sheets for evasion and tracking

Cisco Talos has identified actors abusing Cascading Style Sheets CSS to 1 evade spam filters and detection engines, and 2 track users' actions and preferences. This blog is a follow-up to our previous report on how threat actors could abuse CSS using a technique called "hidden text salting" to...

Android devices track you before you even sign in

Google is spying on Android users, starting from even before they have logged in to their Google account. That's what researchers from Dublin’s Trinity College found after they conducted a measurement study to investigate the cookies, identifiers and other data stored on Android devices by Google...

CVE-2025-28915

creationtimestamp| type| source ---|---|--- 2025-03-11 22:40:20+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lk5552pcq62n 2025-03-12 10:00:05+00:00| published-proof-of-concept| Telegram/YXXAYpim7CTBciEsZ274r31Y5zZFEUA-ADCgFk7JYE3PFkE 2025-03-12 11:00:08+00:00| seen|...

CVE-2025-27440

creationtimestamp| type| source ---|---|--- 2025-03-11 11:28:49+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3lk3xmbkm452f 2025-03-11 19:48:51+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114145527796469293 2025-03-11 20:46:19+00:00| seen|...

CVE-2025-2151

creationtimestamp| type| source ---|---|--- 2025-03-10 13:39:15+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6992 2025-03-10 15:40:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljzv7ipdxd2k 2025-03-10 16:32:01+00:00| seen|...