PT-2025-30291 · Unknown +1 · Strongswan +1

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-WLC100P version 2.03b03 Description: The i dont care about security and use aggressive mode psk option is enabled in the strongSwan configuration file, allowing IKE Responders to use IKEv1 Aggressive Mode with Pre-Shared Keys. Th...

ROS-20250721-02

A vulnerability in the assert function of the GNU C Library system library is related to incorrect calculations of the the size of the allocated buffer. Exploitation of the vulnerability could allow an attacker acting remotely, affect the availability of protected information...

PT-2025-30347 · Hax Cms +1 · Hax Cms +1

Name of the Vulnerable Software and Affected Versions: HAXiam versions 11.0.4 and below Description: HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. The application returns a 200 response when requesting the data of a valid user and a...

EulerOS 2.0 SP12 : perl (EulerOS-SA-2025-1834)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions...

CVE-2025-7396

In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519...

SquidLoader Malware Campaign Hits Hong Kong Financial Firms

Trellix exposes SquidLoader malware targeting Hong Kong, Singapore, and Australia's financial service institutions. Learn about its advanced evasion tactics and stealthy attacks...

CVE-2025-6023

A Cross-site scripting XSS vulnerability was found in Grafana caused by client path traversal and open redirect. This flaw allows attackers to redirect users to malicious websites that execute arbitrary JavaScript code in scripted dashboards. Unlike many other XSS vulnerabilities, this...

CVE-2025-7862

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnetenabled with the input 1 leads to...

CVE-2025-54316

An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting...

PT-2025-30171 · Portabilis · I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A cross-site scripting issue exists due to the manipulation of the nm tipo argument in the file intranet/educar turma tipo det.php?cod turma tipo=ID of the Turma Module. The attack can be launche...

PT-2025-30207 · Yangzongzhuan · Ruoyi

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A cross-site scripting issue exists due to the addSave function within the com/ruoyi/web/controller/system/SysNoticeController.java file. This allows for remote attacks. The exploit detail...

CVE-2025-54316

An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting...

PT-2025-30178 · Metacrm · Metacrm

Name of the Vulnerable Software and Affected Versions: Metasoft MetaCRM versions through 6.4.2 Description: A critical vulnerability exists in Metasoft MetaCRM. The vulnerability affects the AnalyzeParam function within the download.jsp file. Manipulation of the p argument leads to deserializatio...

CVE-2015-10139

CVE-2015-10139 affects the WPLMS WordPress theme and allows privilege escalation via the wp_ajax_import_data AJAX action in versions 1.5.2–1.8.4.1. Authenticated attackers could modify restricted settings and potentially create a new admin account. The issue is tied to an API/endpoint exposed to ...

Customer guidance for SharePoint vulnerability CVE-2025-53770

Revision Change Date 1.0 Information published 07/19/25 2.0 Clarified affected SharePoint product in summary 07/20/25 Added fix availability guidance Provided additional protections guidance regarding: Upgrade SharePoint products to supported versions if required Install July 2025 Security Update...

PT-2025-30144 · Phpgurukul · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A problematic issue exists in PHPGurukul Complaint Management System 2.0. The issue involves cross-site request forgery due to manipulation of an unknown function. This allows fo...

CVE-2025-7801 BossSoft CRM HNDCBas_customPrmSearchDtl.jsp sql injection

A vulnerability has been found in BossSoft CRM 6.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /crm/module/HNDCBascustomPrmSearchDtl.jsp. The manipulation of the argument cstid leads to sql injection. The attack can be launched remotely. The...

UNG0002 Group Hits China, Hong Kong, Pakistan Using LNK Files and RATs in Twin Campaigns

Multiple sectors in China, Hong Kong, and Pakistan have become the target of a threat activity cluster tracked as UNG0002 aka Unknown Group 0002 as part of a broader cyber espionage campaign. "This threat entity demonstrates a strong preference for using shortcut files LNK, VBScript, and...

Ivanti Flaws Exploited to Drop MDifyLoader and Launch In-Memory Cobalt Strike Attacks

Cybersecurity researchers have disclosed details of a new malware called MDifyLoader that has been observed in conjunction with cyber attacks exploiting security flaws in Ivanti Connect Secure ICS appliances. According to a report published by JPCERT/CC today, the threat actors behind the...

CVE-2025-7789

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...