PT-2025-53440

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.22.2 Description Gitea versions before 1.22.2 contain a cross-site scripting XSS issue. The search input box, used when creating tags and branches, utilizes v-html instead of v-text, which allows for the execution of...

CVE-2025-64677

Improper neutralization of input during web page generation 'cross-site scripting' in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network...

CVE-2023-53958 LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header

LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account...

CVE-2023-53958 LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header

LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account...

LDAP Tool Box Self Service Password 授权问题漏洞

LDAP Tool Box Self Service Password is an open source PHP application for LDAP Tool Box that allows users to change passwords in the LDAP directory. An authorization issue vulnerability exists in LDAP Tool Box Self Service Password version 1.5.2, which stems from an improperly generated password...

PT-2025-52528

Name of the Vulnerable Software and Affected Versions LDAP Tool Box Self Service Password version 1.5.2 Description The software contains a password reset issue where attackers can manipulate HTTP Host headers during token generation. This allows crafting malicious password reset requests that...

CVE-2025-64677

Improper neutralization of input during web page generation 'cross-site scripting' in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-64677

Improper neutralization of input during web page generation 'cross-site scripting' in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-64677 Office Out-of-Box Experience Spoofing Vulnerability

...

CVE-2025-64677

CVE-2025-64677 affects Microsoft Office Out-of-Box Experience. Multiple sources describe an improper neutralization of input during web page generation, enabling cross-site scripting that can lead to network spoofing. The affected component is “Office Out-of-Box Experience” and the root cause is ...

CVE-2025-64677 Office Out-of-Box Experience Spoofing Vulnerability

...

EUVD-2025-204412

Improper neutralization of input during web page generation 'cross-site scripting' in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network...

KLA90826 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, spoof user interface, gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Office...

Microsoft Office Out-of-Box Experience 跨站脚本漏洞

Microsoft Office Out-of-Box Experience is a user experience process software from Microsoft Corporation USA. A cross-site scripting vulnerability exists in Microsoft Office Out-of-Box Experience that stems from improper input neutralization and could lead to a network spoofing attack...

New ClickFix Attack Uses Fake Browser Fix to Install DarkGate Malware

Researchers at Point Wild have discovered a new ClickFix attack campaign that tricks users into manually installing DarkGate malware via fake browser extension alerts. Learn how this attack bypasses security by using the Windows Run box and how you can stay safe...

WuppieFuzz: Coverage-Guided, Stateful REST API Fuzzing

Many business processes currently depend on web services, often using REST APIs for communication. REST APIs expose web service functionality through endpoints, allowing easy client interaction over the Internet. To reduce the security risk resulting from exposed endpoints, thorough testing is...

Behavior-Aware and Generalizable Defense against Black-Box Adversarial Attacks for ML-Based IDS

Machine learning based intrusion detection systems are increasingly targeted by black box adversarial attacks, where attackers craft evasive inputs using indirect feedback such as binary outputs or behavioral signals like response time and resource usage. While several defenses have been proposed...

One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs

Finetuning pretrained large language models LLMs has become the standard paradigm for developing downstream applications. However, its security implications remain unclear, particularly regarding whether finetuned LLMs inherit jailbreak vulnerabilities from their pretrained sources. We investigat...

EUVD-2025-201607

A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub44de0 of the file /goform/aspForm. This manipulation of the argument param causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public...

ThinkTrap: Denial-Of-Service Attacks against Black-Box LLM Services Via Infinite Thinking

Large Language Models LLMs have become foundational components in a wide range of applications, including natural language understanding and generation, embodied intelligence, and scientific discovery. As their computational requirements continue to grow, these models are increasingly deployed as...