CVE-2025-14780 Xiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injection

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dishtradedetailget. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is now...

CVE-2025-14780

CVE-2025-14780 affects Xiongwei Smart Catering Cloud Platform (version 2.1.6446.28761). The vulnerable element is an unknown function in the file /dishtrade/dish_trade_detail_get, where manipulation of the argument filter leads to a SQL injection. The vulnerability is exploitable remotely, and pu...

CVE-2025-14780 Xiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injection

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dishtradedetailget. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is now...

Amazon Exposes Years-Long GRU Cyber Campaign Targeting Energy and Cloud Infrastructure

Amazon's threat intelligence team has disclosed details of a "years-long" Russian state-sponsored campaign that targeted Western critical infrastructure between 2021 and 2025. Targets of the campaign included energy sector organizations across Western nations, critical infrastructure providers in...

Security Bulletin: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data vulnerable to Deserialization of Untrusted Data due to jackson-core

Summary jackson-core is used by IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data in the repo huts-common Vulnerability Details WSID: WS-2022-0468 DESCRIPTION: The jackson-core package is vulnerable to a Denial of Service DoS attack. The methods in the classes listed below fail to...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data version 5.2.2 Vulnerability Details CVEID:CVE-2025-45767 DESCRIPTION: jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim o...

USN-7937-1: Linux kernel (Azure FIPS) vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

CVE-2025-66407

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is...

This Week in Spring – December 16th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it’s been! We’ve got around nine shopping days ’til Christmas, and the New Year is almost here! Things are moving so quickly and the Spring community is no exception! Let's dive into this week's wonderful...

YAOOK Operator 安全漏洞

YAOOK Operator is an automated control component for deploying and managing OpenStack cloud services from YAOOK Germany. A security vulnerability exists in YAOOK Operator, which stems from improperly configured replication security and could lead to the disclosure of database contents...

Cloud Security Leveraging AI: A Fusion-Based AISOC for Malware and Log Behaviour Detection

Cloud Security Operations Center SOC enable cloud governance, risk and compliance by providing insights visibility and control. Cloud SOC triages high-volume, heterogeneous telemetry from elastic, short-lived resources while staying within tight budgets. In this research, we implement an...

PT-2025-51561

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dish trade detail get. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is no...

Sovell Smart Catering Cloud Platform SQL注入漏洞

Sovell Smart Catering Cloud Platform is a catering cloud platform from China's Xiongwei Sovell. An SQL injection vulnerability exists in Sovell Smart Catering Cloud Platform version 2.1.6446.28761, which stems from a misbehavior of the parameter filter in the file /dishtrade/dishtradedetailget,...

CVE-2023-53881

ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by...

CVE-2023-53881 ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP

ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by...

CVE-2023-53881

CVE-2023-53881 affects ReyeeOS 1.204.1614 and stems from unencrypted CWMP communications that enable a man-in-the-middle to intercept and manipulate device traffic. The vulnerability allows an attacker to impersonate a CWMP server and inject/execute arbitrary commands on Ruijie Reyee Cloud device...

CVE-2025-36751

Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipulate communication requests between the inverter and its cloud endpoint...

PT-2025-51337

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.15 Description Weblate is a web-based localization tool. The Create Component functionality allows authorized users to add new translation components by specifying a version control system and a source code reposito...

Cyber Risk Management: Defenders Tell It Like It Is

Based on more than 3,000 responses from cybersecurity professionals in nearly 90 countries, our Trend Micro Defenders Survey Report 2025 shines a bright light on the current state of cyber risk management. From the impact of cloud and AI on IT environments to top technical and human challenges,...

Alibaba Cloud Linux 3 : 0192: abrt (ALINUX3-SA-2025:0192)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0192 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-12744: A flaw was found in the ABRT daemon...