Tag: flaw
-
Gemini Trifecta: AI autonomy without guardrails opens new attack surface
Exfiltration via the browsing tool: Even after prompt injection, the attacker needs a way to pull data out, and that’s what the third flaw affecting the Gemini Browsing Tool allowed. Tenable researchers crafted prompts to trick Gemini to fetch external web content using the Browser Tool, embedding user data into the query string of that…
-
Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882)
The Cl0p extortion gang exploited multiple Oracle E-Business Suite (EBS) vulnerabilities, including one zero-day flaw (CVE-2025-61882), >>to steal large amounts of data … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/06/cl0p-oracle-data-theft-extortion-cve-2025-61882/
-
Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882)
The Cl0p extortion gang exploited multiple Oracle E-Business Suite (EBS) vulnerabilities, including one zero-day flaw (CVE-2025-61882), >>to steal large amounts of data … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/06/cl0p-oracle-data-theft-extortion-cve-2025-61882/
-
Zabbix Agent/Agent2 for Windows Vulnerability Could Allow Privilege Escalation
A security flaw in Zabbix Agent and Agent2 for Windows has been discovered that could allow a local attacker to gain higher system privileges. The issue, tracked as CVE-2025-27237, stems from the way the agent loads its OpenSSL configuration file. By exploiting this weakness, an attacker with limited rights on a Windows host could escalate…
-
Technical Details and Exploit Released for Chrome Remote Code Execution Flaw
A remote code execution vulnerability affecting Google Chrome’s WebAssembly engine has been publicly disclosed, along with a fully functional exploit. The flaw, discovered and reported during TyphoonPWN 2025, involves a regression in the canonicalization logic for indexed reference types in WebAssembly and a novel sandbox bypass via JavaScript Promise Integration (JSPI). Researchers from SSD Secure…
-
Clop crew hits Oracle E-Business Suite users with fresh zero-day
Big Red rushes out patch for 9.8-rated flaw after crooks exploit it for data theft and extortion First seen on theregister.com Jump to article: www.theregister.com/2025/10/06/clop_oracle_ebs_zeroday/
-
Patch Now: Dell UnityVSA Flaw Allows Command Execution Without Login
WatchTowr finds a serious flaw in Dell UnityVSA (CVE-2025-36604) letting attackers run commands without login. Dell issues patch 5.5.1 – update now. First seen on hackread.com Jump to article: hackread.com/dell-unityvsa-flaw-command-execution-without-login/
-
Redis Server UseFree Vulnerability Allows Remote Code Execution
A critical security vulnerability has been discovered in Redis Server that could allow authenticated attackers to achieve remote code execution through a use-after-free flaw in the Lua scripting engine. The vulnerability, tracked as CVE-2025-49844, affects all versions of Redis that support Lua scripting functionality. Critical Memory Corruption Flaw Discovered Security researchers from Wiz, including Benny…
-
QNAP NetBak Replicator Vulnerability Allow Malicious Code Execution
QNAP Systems has disclosed a critical security vulnerability in its NetBak Replicator software that could enable local attackers to execute malicious code on affected systems. The vulnerability, tracked as CVE-2025-57714, stems from an unquoted search path element flaw that poses significant security risks to organizations using the backup solution. Vulnerability Details and Impact Assessment The…
-
Oracle Rushes Patch for CVE-2025-61882 After Cl0p Exploited It in Data Theft Attacks
Oracle has released an emergency update to address a critical security flaw in its E-Business Suite that it said has been exploited in the recent wave of Cl0p data theft attacks.The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise…
-
PoC Published for Sudo Flaw Lets Attackers Escalate to Root
A proof-of-concept exploit has been released for CVE-2025-32463, a critical local privilege escalation vulnerability affecting the Sudo binary that allows attackers to gain root access on Linux systems. The flaw was discovered by security researcher Rich Mirch and has garnered significant attention from the cybersecurity community. Critical Vulnerability in Sudo Binary CVE-2025-32463 represents a serious…
-
CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities
Tags: advisory, attack, breach, business, cve, cyber, data, email, exploit, extortion, finance, flaw, group, intelligence, mitigation, mobile, oracle, ransomware, remote-code-execution, software, threat, update, vulnerability, zero-dayFollowing reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the…
-
CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities
Tags: advisory, attack, breach, business, cve, cyber, data, email, exploit, extortion, finance, flaw, group, intelligence, mitigation, mobile, oracle, ransomware, remote-code-execution, software, threat, update, vulnerability, zero-dayFollowing reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the…
-
Oracle patches EBS zero-day exploited in Clop data theft attacks
Tags: attack, business, data, exploit, flaw, oracle, remote-code-execution, theft, vulnerability, zero-dayOracle is warning about a critical E-Business Suite zero-day vulnerability tracked as CVE-2025-61882 that allows attackers to perform unauthenticated remote code execution, with the flaw actively exploited in Clop data theft attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/oracle-patches-ebs-zero-day-exploited-in-clop-data-theft-attacks/
-
Hackers exploited Zimbra flaw as zero-day using iCalendar files
Researchers monitoring for larger .ICS calendar attachments found that a flaw in Zimbra Collaboration Suite (ZCS) was used in zero-day attacks at the beginning of the year. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploited-zimbra-flaw-as-zero-day-using-icalendar-files/
-
U.S. CISA adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these…
-
New Study Warns Several Free iOS and Android VPN Apps Leak Data
A Zimperium zLabs analysis of 800 free Android and iOS VPN apps exposes critical security flaws, including the Heartbleed bug, excessive system permissions, and non-transparent data practices. Learn how these ‘privacy’ tools are actually major security risks, especially for BYOD environments. First seen on hackread.com Jump to article: hackread.com/studyfree-ios-android-vpn-apps-leak-data/
-
Hackers Target Unpatched Flaws in Oracle E-Business Suite
Patches for the targeted vulnerabilities were released in Oracle’s July 2025 security update First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-flaws-oracle-ebs/
-
CISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting Smartbedded Meteobridge to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, CVE-2025-4008 (CVSS score: 8.7), is a case of command injection in the Meteobridge web interface that could result in code execution.” First seen on…
-
Hundreds of Free VPN Apps Expose Android and iOS Users’ Personal Data
Virtual Private Networks (VPNs) are trusted by millions to protect privacy, secure communications, and enable remote access on their mobile devices. But what if the very apps designed to safeguard your data are riddled with dangerous security flaws that expose the exact information they promise to protect? A comprehensive security and privacy analysis by Zimperium…
-
PoC Released for VMware Workstation GuestHost Escape Vulnerability
NCC Group detailed a VMware Workstation guest-to-host escape achievable from a compromised VM via a logic flaw in virtual device handling that permits memory corruption and controlled code execution on the host process. The write-up shows a practical exploitation path from guest userland to host compromise, validating real-world risk. The attack requires execution inside a…
-
Breach Roundup: FTC Sues Sendit Over Kid’s Data Collection
Also, Cyberattack Disrupts Asahi’s Japan Operations, Halts Production. This week, FTC sued Sendit, another Harrods breach, Allianz data breach and a cyberattack disrupted Asahi’s Japan operations. WestJet disclosed data theft. Hackers targeted Kido Nursery chain, a VMware privilege escalation flaw was exploited as zero-day, DarkCloud infostealer resurfaced. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-ftc-sues-sendit-over-kids-data-collection-a-29625
-
Breach Roundup: FTC Sues Sendit Over Kid’s Data Collection
Also, Cyberattack Disrupts Asahi’s Japan Operations, Halts Production. This week, FTC sued Sendit, another Harrods breach, Allianz data breach and a cyberattack disrupted Asahi’s Japan operations. WestJet disclosed data theft. Hackers targeted Kido Nursery chain, a VMware privilege escalation flaw was exploited as zero-day, DarkCloud infostealer resurfaced. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-ftc-sues-sendit-over-kids-data-collection-a-29625
-
Humanoid Robots are Walking Trojan Horses, And They’re Already in the Workplace
A new study reveals severe security flaws in the Unitree G1 humanoid robot, exposing risks from Bluetooth backdoors to hidden data exfiltration. Researchers warn that humanoid robots could be exploited as surveillance devices and active cyberattack platforms, raising urgent concerns for robotics security and privacy compliance. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/humanoid-robots-are-walking-trojan-horses-and-theyre-already-in-the-workplace/
-
$20 YoLink IoT Gateway Vulnerabilities Put Home Security at Risk
Four critical zero-day flaws found in the $20 YoLink Smart Hub allow remote physical access, threatening your home security. See the urgent steps you must take now. First seen on hackread.com Jump to article: hackread.com/20-yolink-iot-gateway-vulnerabilities-home-security/
-
Google Patches “Gemini Trifecta” Vulnerabilities in Gemini AI Suite
Cybersecurity firm Tenable found three critical flaws allowing prompt injection and data exfiltration from Google’s Gemini AI. Learn why AI assistants are the new weak link. First seen on hackread.com Jump to article: hackread.com/google-gemini-trifecta-vulnerabilities-gemini-ai/
-
Google Patches “Gemini Trifecta” Vulnerabilities in Gemini AI Suite
Cybersecurity firm Tenable found three critical flaws allowing prompt injection and data exfiltration from Google’s Gemini AI. Learn why AI assistants are the new weak link. First seen on hackread.com Jump to article: hackread.com/google-gemini-trifecta-vulnerabilities-gemini-ai/
-
Free VPN Apps Found Riddled With Security Flaws
A new study by Zimperium has revealed serious risks in free VPN apps, exposing users to privacy threats and security flaws First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/free-vpn-apps-security-flaws/
-
Free VPN Apps Found Riddled With Security Flaws
A new study by Zimperium has revealed serious risks in free VPN apps, exposing users to privacy threats and security flaws First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/free-vpn-apps-security-flaws/
-
ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand & More
From unpatched cars to hijacked clouds, this week’s Threatsday headlines remind us of one thing, no corner of technology is safe. Attackers are scanning firewalls for critical flaws, bending vulnerable SQL servers into powerful command centers, and even finding ways to poison Chrome’s settings to sneak in malicious extensions.On the defense side, AI is stepping…