Exploit for Protection Mechanism Failure in 7-Zip

7-Zip Mark-of-the-Web Bypass Vulnerability CVE-2025-0411 - P...

Malicious code in fast-utilz (npm)

This package downloads a second stage payload via Discord. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e23b4a6118c13cf6e7d7bc0318d4ff3f1d25bbc1cb4db2a8a4676cdb4777e232 Any computer that has this package installed or running should be considered fully compromised...

Tunneling Flaws Put VPNs, CDNs and Routers at Risk Globally

Millions of devices, including home routers, VPN servers, and CDNs are vulnerable to exploitation due to critical flaws…...

The vulnerability of the administrator’s user interface function “Configuration XML” of the Continuous Integration and Delivery (CI/CD) GoCD system allows a perpetrator to increase their privileges.

The vulnerability of the “Configuration XML” user interface function in the Continuous Integration and Delivery CI/CD GoCD system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

The vulnerability of the server for the Continuous Integration and Delivery (CI/CD) system GoCD arises due to an incorrect path name limitation for the restricted access directory. This allows a malicious actor to execute arbitrary code.

The vulnerability of the CI/CD GoCD server exists due to an incorrect pathname limitation for the access-controlled directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer

Threat actors have been observed concealing malicious code in images to deliver malware such as VIP Keylogger and 0bj3ctivity Stealer as part of separate campaigns. "In both campaigns, attackers hid malicious code in images they uploaded to archive.org, a file-hosting website, and used the same...

Lazarus Group Targets Web3 Developers with Fake LinkedIn Profiles in Operation 99

The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware. "The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring...

CVE-2025-22314

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup food-store allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a through = 1.5.4...

CISA: CISA Regional Service Delivery Model

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

How Your Business Can Benefit From Combining a DAM and CDN

...

WordPress WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin <= 4.75 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin WooCommerce Digital Content Delivery incl. DRM – FlickRocket versions = 4.75...

WordPress Food Store plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.4...

Critical Deadline: Update Old .NET Domains Before January 7, 2025 to Avoid Service Disruption

Microsoft has announced that it's making an "unexpected change" to the way .NET installers and archives are distributed, requiring developers to update their production and DevOps infrastructure. "We expect that most users will not be directly affected, however, it is critical that you validate i...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, due to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks remotely...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, related to incorrect session duration, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to incorrect session duration settings. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to the lack of authentication, allows attackers to compromise the integrity of protected information.

The vulnerability of the CI/CD application integration and delivery system of JetBrains TeamCity is related to the absence of authentication. Exploiting this vulnerability allows a malicious actor to potentially compromise the integrity of the protected information...

U.S. Dept Of Defense: Secret Access Key of AWS Firehose Disclosure

The domain had an endpoint that contained the secret access key of an AWS Firehose delivery stream encoded in base64. The secret access key was disclosed, allowing the record to be put into the Firehose delivery stream...

Apache Traffic Control SQL Injection Vulnerability

Apache Traffic Control is the United States Apache Apache Foundation's set of distributed , scalable content delivery solutions. The product is mainly used to build large-scale content delivery network. Apache Traffic Control suffers from a SQL injection vulnerability that stems from a lack of...

Unspecified Vulnerability in JetBrains TeamCity

JetBrains TeamCity is a powerful continuous integration and continuous delivery CI/CD tool developed by JetBrains. A security vulnerability exists in JetBrains TeamCity that stems from an access token not being revoked after removing a user role. No details of the vulnerability are provided at th...

WordPress plugin Print Invoice & Delivery Notes for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...