Marbled Dust leverages zero-day in Output Messenger for regional espionage

Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability CVE-2025-27920 in the messaging app Output Messenger, a multiplatform chat software. These exploits have...

Marbled Dust leverages zero-day in Output Messenger for regional espionage

Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability CVE-2025-27920 in the messaging app Output Messenger, a multiplatform chat software. These exploits have...

CVE-2025-40626

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...

CVE-2025-40627 Reflected Cross-Site Scripting (XSS) in AbanteCart

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...

CVE-2025-40627

CVE-2025-40627 affects AbanteCart v1.4.0. It describes a Reflected Cross‑Site Scripting (XSS) vulnerability in the /eyes? endpoint that lets an attacker deliver JavaScript to a victim’s browser, potentially stealing session cookies or acting on behalf of the user. The vulnerability is documented ...

PT-2025-20793 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.5 Description: An information disclosure issue was addressed with improved privacy controls. This issue may allow an app to access sensitive user data. Recommendations: For versions prior to 15.5, update to macOS...

About the security content of macOS Sequoia 15.5

About the security content of macOS Sequoia 15.5 This document describes the security content of macOS Sequoia 15.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

About the security content of visionOS 2.5

About the security content of visionOS 2.5 This document describes the security content of visionOS 2.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

About the security content of tvOS 18.5

About the security content of tvOS 18.5 This document describes the security content of tvOS 18.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that stems from an application that may access sensitive user data...

Apple macOS和Apple iPadOS 安全漏洞

Apple macOS and Apple iPadOS are both products of Apple Inc. Apple macOS is a specialized operating system developed for Mac computers, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iPadOS and Apple macOS, which stems from the possibility that...

Apple macOS 安全漏洞

Apple macOS is a set of specialized operating systems developed for Mac computers by Apple, Inc. A security vulnerability exists in Apple macOS that stems from a sandboxed application that may access sensitive user data...

PT-2025-20695 · Unknown · Abantecart

Name of the Vulnerable Software and Affected Versions: AbanteCart version 1.4.0 Description: A Reflected Cross-Site Scripting XSS issue allows an attacker to execute JavaScript code in a victim's browser by sending a malicious URL. This can be exploited to steal sensitive user data, such as sessi...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that stems from an application that may access sensitive user data...

PT-2025-20778 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.6 macOS Sequoia versions prior to 15.5 macOS Sonoma versions prior to 14.7.6 Description: A logic issue was addressed with improved checks, which may have allowed a sandboxed app to access sensitive user...

PT-2025-20782 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.5 Description: An information disclosure issue was addressed with improved privacy controls. This issue allows an app to potentially access sensitive user data. Recommendations: For versions prior to 15.5, update to...

PT-2025-20764 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: iPadOS versions 17.7.7 and earlier macOS Ventura versions 13.7.6 and earlier macOS Sequoia versions 15.5 and earlier macOS Sonoma versions 14.7.6 and earlier Description: A logging issue was addressed with improved data redaction, which could...

Apple macOS 安全漏洞

Apple macOS is a set of specialized operating systems developed for Mac computers by Apple, Inc. A security vulnerability exists in Apple macOS that stems from an application that may access sensitive user data...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that stems from a privacy issue and could lead to applications accessing sensitive user data...

CVE-2025-3851

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...