Ivanti多款产品 安全漏洞

Ivanti Connect Secure ICS and others are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti Neurons is Ivanti Neurons is a groundbreaking platform that simplifies and...

WordPress plugin LiteSpeed Cache 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2025-36988

Name of the Vulnerable Software and Affected Versions: Zoom Workplace VDI Plugin versions prior to 6.4.10 Zoom Workplace VDI Plugin versions prior to 6.2.15 Zoom Workplace VDI Plugin versions prior to 6.3.12 Description: A race condition exists in the Zoom Workplace VDI Plugin macOS Universal...

PT-2025-36684

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 All versions SIMATIC PCS neo versions 5.0 All versions User Management Component UMC versions prior to 2.15.1.3 Description: The software contains an out-of-bounds read issue in the integrated User Management...

Zoom Workplace < 6.5.0 Vulnerability (ZSB-25032)

The version of Zoom Workplace installed on the remote host is prior to 6.5.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-25032 advisory. - Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user ...

Metabase < 1.40.5

The version of Metabase installed on the remote host is prior to 1.40.5. It is, therefore, affected by a local file inclusion vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 Tenable,...

Metabase < 0.29.3 XSS

The version of Metabase installed on the remote host is prior to 0.29.3. It is, therefore, affected by a Cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Note that Nessus has not tested for this issue but has instead...

Signed Copies of Rewiring Democracy

When I announced my latest book last week, I forgot to mention that you can pre-order a signed copy here. I will ship the books the week of 10/20, when it is published...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

CVE-2025-57819 FreePBX Pre-Auth RCE FreePBX Pre-Auth RCE 1day...

Stopping ransomware before it starts: Lessons from Cisco Talos Incident Response

Over the past two and a half years January 2023 through June 2025, Cisco Talos Incident Response Talos IR has responded to numerous engagements that we classified as pre-ransomware incidents. Talos looked back to analyze what key security measures were credited with deterring ransomware deploymen...

WordPress Hampton Theme <= 1.3.3 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Theme Hampton versions = 1.3.3...

MCP inspector 安全漏洞

MCP inspector is a development tool for debugging MCP servers. A security vulnerability exists in MCP inspector versions prior to 0.16.6 that stems from a cross-site scripting attack that could lead to arbitrary command execution...

Fides 安全漏洞

Fides is an open source privacy engineering platform open-sourced by Ethyca to manage the implementation of data privacy requests in the runtime environment and the enforcement of privacy regulations in code. A security vulnerability exists in Fides versions prior to 2.69.1 that stems from an...

Jinher OA SQL注入漏洞

Jinher OA is a collaboration management software from China Jinher Jinher. A SQL injection vulnerability exists in Jinher OA 1.2 and earlier versions, which originates from improper handling of parameters in the /C6/Jhsoft.Web.departments/GetTreeDate.aspx file, which can lead to SQL injection...

PT-2025-36497

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions prior to 9.12.0.0 Description: Dell PowerScale OneFS contains an improper privilege management issue. A high-privileged attacker with local access could potentially exploit this issue, leading to privilege...

PT-2025-36532

Name of the Vulnerable Software and Affected Versions: MONAI versions up to and including 1.5.0 Description: MONAI is an AI toolkit for health care imaging. The software contains insecure model loading methods that can trigger a deserialization vulnerability, potentially leading to code execution...

CVE-2024-13071

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Akinsoft e-Mutabakat allows Cross-Site Scripting XSS.This issue affects e-Mutabakat: from 2.02.05 before v2.02.06...

CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

Exploit for Use After Free in Microsoft

PoC exploit for CVE-2019-0708, a RCE vulnerability in Windows systems, including Windows 2003, Windows XP, Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2. The vulnerability occurs during pre-authorization and allows an attacker to run arbitrary malicious code in the NT...

AZL-73935 CVE-2025-38732 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfreject: don't leak dst refcount for loopback packets recent patches to add a WARN when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 inlin...