CVE-2025-8864

CVE-2025-8864 affects YugabyteDB: a Shared Access Signature (SAS) token is exposed in backup config responses and in yb_backup logs. The issue impacts confidentiality and is rated CVSS v4.0 (MEDIUM, Base 6.8) with ADJACENT attack vector, HIGH privileges required, no user interaction. Affected com...

Authentication Bypass

Node-SAML is vulnerable to Authentication Bypass. The vulnerability is due to improper signature verification because the library loads assertions from the unsigned original response document instead of the signed portion, allowing attackers with a validly signed document to alter authentication...

A week in security (August 4 – August 10)

Last week on Malwarebytes Labs: Adult sites trick users into Liking Facebook posts using a clickjack Trojan Facebook users targeted in ‘login’ phish TeaOnHer, the male version of Tea, is leaking personal information on its users too How Google, Adidas, and more were breached in a Salesforce scam...

Linux Distros Unpatched Vulnerability : CVE-2024-26682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we...

CVE-2022-50233

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix using strlen with hdev-devname,shortname Both devname and shortname are not guaranteed to be NULL terminated so this instead use strnlen and then attempt to determine if the resulting string needs to be...

Open Redirect

Koa is vulnerable to Open Redirect. The vulnerability is due to improper validation of the Referrer argument in the back function of lib/response.js, which allows remote attackers to redirect users to malicious sites...

CVE-2025-8741 macrozheng mall login cleartext transmission

A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. The...

[SECURITY] [DLA 4265-1] modsecurity-crs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4265-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk August 08, 2025 https://wiki.debian.org/LTS -...

CVE-2025-8730

CVE-2025-8730 affects Belkin F9K1009 and F9K1010 Web Interface (versions 2.00.04–2.00.09). The root cause is hard-coded credentials that enable remote authentication bypass, granting full admin access via the web login interface (login.htm) without valid credentials. Public PoCs/exploits exist (P...

Security Bulletin: IBM Datapower Operations Dashboard could allow malicious or exploitable backend/content generators CVE-2023-38709

Summary Apache HTTP Server is used to deliver website content over the internet. Vulnerability Details CVEID:CVE-2023-38709 DESCRIPTION: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP...

CVE-2025-46390

CWE-204: Observable Response Discrepancy...

CVE-2025-21452

Transient DOS while processing a random-access response RAR with an invalid PDU length on LTE network...

Linux Distros Unpatched Vulnerability : CVE-2023-5517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in query-handling code can cause named to exit prematurely with an assertion failure when: - nxdomain-redirect ; is configured, and - the resolver receiv...

Announcing public preview: Phishing triage agent in Microsoft Defender

Intelligent triage for a more agile, autonomous SOC At Microsoft Secure 2025, we introduced a new wave of innovations across Microsoft Defender aimed at redefining what AI can do for security operations. At the center of these announcements was the launch of 11 Security Copilot agents, each...

Bluetooth: Fix NULL pointer deference on eir_get_service_data

...

CVE-2025-8543

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educarracacad.php. The manipulation of the argument nmraca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination

Timely and effective incident response is key to managing the growing frequency of cyberattacks. However, identifying the right response actions for complex systems is a major technical challenge. A promising approach to mitigate this challenge is to use the security knowledge embedded in large...

Linux Distros Unpatched Vulnerability : CVE-2025-7339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions 1.1.0 may result in response headers being...

CVE-2025-46390

CWE-204: Observable Response Discrepancy...

CVE-2025-46390

Technical details for CVE-2025-46390 are not publicly available in the provided documents. No specific affected product/version, root cause, impact, or fix is listed here; monitor for updates.