pgJDBC 授权问题漏洞

pgJDBC is a PostgreSQL driver for pgJDBC open source. An authorization issue vulnerability exists in pgJDBC versions 42.7.4 through 42.7.7, which stems from a channel binding misconfiguration that could lead to a man-in-the-middle attack...

PT-2025-25210 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar plugin for WordPress versions up to, and including, 6.13.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the data-date- parameters. This...

PT-2025-25224

Name of the Vulnerable Software and Affected Versions pgjdbc versions 42.7.4 through 42.7.6 Description The issue arises when the PostgreSQL JDBC driver is configured with channel binding set to required, allowing connections to proceed with authentication methods that do not support channel...

CVE-2024-7457

The CVE-2024-7457 entry concerns ws.stash.app.mac.daemon.helper on macOS. Affected component is the ws.stash.app.mac.daemon.helper, which improperly uses macOS AuthorizationCopyRights() with its own privileged context (root) instead of validating the client’s authorization reference. This allows ...

CVE-2024-7457 macOS Stash network-management utility: Unauthorized Manipulation of System Network Preferences

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights using its own privileged context root, effectively authorizing itself...

CVE-2025-33060

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review...

CVE-2025-33065

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review...

CVE-2025-47173

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 17:32:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17947...

CVE-2025-33057

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 23:33:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18028...

Do Concept Replacement Techniques Really Erase Unacceptable Concepts?

Generative models, particularly diffusion-based text-to-image T2I models, have demonstrated astounding success. However, aligning them to avoid generating content with unacceptable concepts e.g., offensive or copyrighted content, or celebrity likenesses remains a significant challenge. Concept...

PT-2025-24650 · WordPress · The Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks – WordPress Blocks Plugin versions up to, and including, 3.3.3 Description: The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping. This allows...

Patch Tuesday - June 2025

Microsoft is addressing 67 vulnerabilities this June 2025 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation for just one of the vulnerabilities published today, and that is reflected in CISA KEV. Separately, Microsoft is aware of existing public disclosure for one other freshly...

Towards Generalized Source Tracing for Codec-Based Deepfake Speech

Recent attempts at source tracing for codec-based deepfake speech CodecFake, generated by neural audio codec-based speech generation CoSG models, have exhibited suboptimal performance. However, how to train source tracing models using simulated CoSG data while maintaining strong performance on re...

PT-2025-24402 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.8.5 Description: The issue concerns a lack of validation and escaping of certain Widget options in the plugin, which can lead to Stored Cross-Site Scripting attacks. This can be exploited by...

PT-2025-24403 · WordPress · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.85 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and esca...

PT-2025-24477 · Unknown · The Fashion - Model Agency One Page Beauty Theme

Name of the Vulnerable Software and Affected Versions: The Fashion - Model Agency One Page Beauty Theme versions 1.4.4 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.4.4 and earlier, update to a...

HAX 安全漏洞

HAX is HAX The Web open source a HAX+CMS microsite managed using a PHP backend. A security vulnerability exists in HAX versions prior to 11.0.0 that stems from a local file inclusion vulnerability that could lead to the reading of sensitive files...

NewStart CGSL MAIN 7.02 : openssh Vulnerability (NS-SA-2025-0089)

The remote NewStart CGSL host, running version MAIN 7.02, has openssh packages installed that are affected by a vulnerability: - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a...

CVE-2025-29003

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mva7 The Holiday Calendar the-holiday-calendar allows Stored XSS.This issue affects The Holiday Calendar: from n/a through = 1.18.2.1...

CVE-2025-49311

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Stored XSS.This issue affects The Events Calendar Countdown Addon: from n/a through = 1.4.9...