QiAnXin QAX Virus Removal 访问控制错误漏洞

QiAnXin QAX Virus Removal is a malware and virus removal tool developed by QiAnXin Corporation. Versions of QiAnXin QAX Virus Removal released on or before October 22, 2025, have a vulnerability related to access control. This vulnerability stems from incorrect operations on the function...

CVE-2024-13984 Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload

QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthenticated attackers to upload files to arbitrary locations on the server. The /rptsvr/upload endpoint fails to sanitize the filename paramete...

QiAnXin TianQing Management Center 安全漏洞

QiAnXin TianQing Management Center TianQing Terminal Security Management System is a terminal security management system from QiAnXin, China. A security vulnerability exists in QiAnXin TianQing Management Center version 6.7.0.4130 and prior versions, which originates from path traversal and could...

PT-2025-34941 · Qi Anxin · Qianxin Tianqing Management Center

Name of the Vulnerable Software and Affected Versions: QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 Description: QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component. Unauthenticated...

QiANXIN Tianqing Endpoint Security Management System 安全漏洞

QiANXIN Tianqing Endpoint Security Management System is a security vulnerability in the v10.0 version of QiANXIN Tianqing Endpoint Security Management System, a product of QiANXIN, China. A security vulnerability exists in QiANXIN Tianqing Endpoint Security Management System version v10.0, which...

New Golang-Based Zergeca Botnet Capable of Powerful DDoS Attacks

Cybersecurity researchers have uncovered a new botnet called Zergeca that's capable of conducting distributed denial-of-service DDoS attacks. Written in Golang, the botnet is so named for its reference to a string named "ootheca" present in the command-and-control C2 servers "ootheca.pw" and...

VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi

VMware has released updates to address critical flaws impacting Cloud Foundation, vCenter Server, and vSphere ESXi that could be exploited to achieve privilege escalation and remote code execution. The list of vulnerabilities is as follows - CVE-2024-37079 & CVE-2024-37080 CVSS scores: 9.8 -...

Patchwork Using Romance Scam Lures to Infect Android Devices with VajraSpy Malware

The threat actor known as Patchwork likely used romance scam lures to trap victims in Pakistan and India, and infect their Android devices with a remote access trojan called VajraSpy. Slovak cybersecurity firm ESET said it uncovered 12 espionage apps, six of which were available for download from...

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry

An advanced persistent threat APT actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism. "The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an...