GHSA-26XQ-M8XW-6373 Froxlor has an HTML Injection Vulnerability

Summary An HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has...

Froxlor has an HTML Injection Vulnerability

Summary An HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has...

CVE-2025-2208

CVE-2025-2208 affects aitangbao springboot-manager 3.0, specifically a vulnerability in the Filename Handler that processes the file at /sysFiles/upload. The issue arises from manipulation of the argument name, enabling cross-site scripting. It can be exploited remotely, and public exploits have ...

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow...

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow...

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow...

CVE-2025-24201

CVE-2025-24201 is a WebKit/WebKitGTK issue described in connected advisories as an out-of-bounds write that allowed breaking out of the Web Content sandbox. Root cause: out-of-bounds write in WebKit. Impact: potential sandbox breakout affecting Apple WebKit-based products (Safari, iOS/iPadOS 18.x...

Blind Eagle Hacks Colombian Institutions Using NTLM Flaw, RATs and GitHub-Based Attacks

The threat actor known as Blind Eagle has been linked to a series of ongoing campaigns targeting Colombian institutions and government entities since November 2024. "The monitored campaigns targeted Colombian judicial institutions and other government or private organizations, with high infection...

February 11, 2025—KB5051979 (OS Build 20348.3207)

None None...

What Really Happened With the DDoS Attacks That Took Down X

Elon Musk said a “massive cyberattack” disrupted X on Monday and pointed to “IP addresses originating in the Ukraine area” as the source of the attack. Security experts say that's not how it works...

[SECURITY] [DLA 4083-1] squid security update

Debian LTS Advisory DLA-4083-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof March 11, 2025 https://wiki.debian.org/LTS Package : squid Version : 4.13-10+deb11u4 CVE ID : CVE-2024-25111 CVE-2024-37894 CVE-2024-45802 Debian Bug : Several security vulnerabiliti...

CVE-2025-27912

An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when 1 Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or 2 when username/password or Active Directory authentication is in use and a...

SideWinder APT Targets Maritime, Nuclear, and IT Sectors Across Asia, Middle East, and Africa

Maritime and logistics companies in South and Southeast Asia, the Middle East, and Africa have become the target of an advanced persistent threat APT group dubbed SideWinder. The attacks, observed by Kaspersky in 2024, spread across Bangladesh, Cambodia, Djibouti, Egypt, the United Arab Emirates,...

CVE-2024-22340 IBM Common Cryptographic Architecture information disclosure

IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack...

CVE-2024-41760

CVE-2024-41760 affects IBM Common Cryptographic Architecture (CCA) 7.0.0–7.5.51. The Red Hat advisory and IBM security bulletin confirm a timing-attack-based information disclosure during certain RSA operations, enabling an attacker to obtain sensitive data. Impact is Information Disclosure (CVE-...

springboot-manager 代码注入漏洞

springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by an individual developer in China, liwenbin. A code injection vulnerability exists in springboot-manager version 3.0, which originates from cross-site scripting and...

libzvbi 安全漏洞

libzvbi is a VBI utility in the zapping-vbi open source. A security vulnerability exists in libzvbi version 0.2.43 and earlier, which stems from uninitialized pointers and could lead to remote attacks...

Claro A7600-A1 代码注入漏洞

The Claro A7600-A1 is a wireless router from Claro. A code injection vulnerability exists in the Claro A7600-A1 RNR4-A72T-2x16v2110403CLA32160817 version, which originates from cross-site scripting and could lead to remote attacks...

springboot-manager 代码注入漏洞

springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by an individual developer in China, liwenbin. A code injection vulnerability exists in springboot-manager version 3.0, which originates from cross-site scripting and...

springboot-manager 代码注入漏洞

springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by an individual developer in China, liwenbin. A code injection vulnerability exists in springboot-manager version 3.0, which originates from cross-site scripting and...