WhatsApp Case Against NSO Group Progressing

Meta is suing NSO Group, basically claiming that the latter hacks WhatsApp and not just WhatsApp users. We have a procedural ruling: Under the order, NSO Group is prohibited from presenting evidence about its customers' identities, implying the targeted WhatsApp users are suspected or actual...

Generative AI in Financial Institution: a Global Survey of Opportunities, Threats, and Regulation

Generative Artificial Intelligence GenAI is rapidly reshaping the global financial landscape, offering unprecedented opportunities to enhance customer engagement, automate complex workflows, and extract actionable insights from vast financial data. This survey provides an overview of GenAI adopti...

The vulnerability of the DNSServer software’s microprogramming system in Wi-Fi amplifiers, subscriber terminals, DSL/Ethernet CPE routers allows a perpetrator to execute arbitrary commands.

The vulnerability of the DNSServer software, a microprogramming-based system for Wi-Fi amplifiers, subscriber terminals, Fiber ONTs, and DSL/Ethernet CPEs exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows an attacker operating remotely to...

CVE-2025-4062

A vulnerability has been found in code-projects Theater Seat Booking System 1.0 and classified as critical. Affected by this vulnerability is the function cancel. The manipulation of the argument cancelcustomername leads to stack-based buffer overflow. It is possible to launch the attack on the...

Malicious code in nsemea-customer-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b783a59591663bb8084e20ad8825f0dea9ab345d0ec0f723be03614c92467e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in nsemea-customer-lib-poc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3533 Malicious code in nsemea-customer-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b783a59591663bb8084e20ad8825f0dea9ab345d0ec0f723be03614c92467e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @baywa-re-lusy/nsemea-customer-lib-poc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-3840

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

Shopify faces privacy lawsuit for collecting customer data

Shopify faces a data privacy class action lawsuit in the US that could change the way globally active companies can be held accountable. The proposed class action is a revival of a case that had been dismissed by a lower court judge and a three-judge 9th Circuit Court of Appeals panel. But now it...

Meon KYC 安全漏洞

Meon KYC is a solution from Meon India. A security vulnerability exists in Meon KYC that stems from insufficient server-side validation of CAPTCHA by certain API endpoints, which could lead to bypassing the CAPTCHA validation mechanism...

Meon KYC 授权问题漏洞

Meon KYC is a solution from Meon India. Meon KYC suffers from an authorization issue vulnerability that stems from the mishandling of access and refresh tokens by certain API endpoints during the authentication process, which could lead to unauthorized access to other user accounts...

Men Salon Management System /admin/edit-customer-detailed.php File SQL Injection Vulnerability

Men Salon Management System a men's salon management system. The Men Salon Management System suffers from a SQL injection vulnerability that originates from insufficient input validation of the editid parameter in the /admin/edit-customer-detailed.php file. An attacker can use this vulnerability ...

Helping Our Customers Develop a Sustainability Strategy

...

CVE-2025-3837

An improper input validation vulnerability is identified in the End of Life EOL OVA based connect component which is deployed for installation purposes in the customer internal network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. Under certa...

CVE-2025-32385

EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and...

CVE-2025-3689

A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-customer-detailed.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The...

Hertz Confirms Data Breach After Hackers Stole Customer PII

Hertz confirms data breach linked to Cleo software flaw; Cl0p ransomware group leaked stolen data, exposing names, driver’s…...

Topological Analysis of Mixer Activities in the Bitcoin Network

Cryptocurrency users increasingly rely on obfuscation techniques such as mixers, swappers, and decentralised or no-KYC exchanges to protect their anonymity. However, at the same time, these services are exploited by criminals to conceal and launder illicit funds. Among obfuscation services, mixer...

Hertz data breach caused by CL0P ransomware attack on vendor

The Hertz Corporation, on behalf of Hertz, Dollar, and Thrifty brands, is sending breach notifications to customers who may have had their name, contact information, driver's license, and—in rare cases—Social Security Number exposed in a data breach. The car rental giant’s data was stolen in a...