Command injection vulnerability in FTP-Flask-python. The project seems no more maintained. Last update the April 28, 2017.

Nmap script to detect a Microsoft SharePoint instance version.

Usage:

$ nmap -p 443 --script ms-sharepoint-version.nse example.com
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-21 17:33 CEST
Nmap scan report for example.com (127.0.0.1)
Host is up (0.030s latency).

PORT    STATE SERVICE
443/tcp open  https
| ms-sharepoint-version: 
|   16.0.10376: 
|     product: SharePoint Server 2019  SharePoint Server 2019 MUI/language patch
|     build: 16.0.10376
|_    release_date: July 2021

Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds

More information: https://github.com/righel/ms-sharepoint-version-nse

Numerous law enforcement agencies worldwide have been affected by a zero-day exploit (path traversal) in reconnaissance software. This apparently also includes body cameras used by special forces, surveillance equipment, and police drones.

The „Media Relay Service (MRS)“ (web server) software for reconnaissance devices from the Israeli manufacturer Infodraw is affected by a serious security vulnerability (Path Traversal Vulnerability). Security experts from Mint Secure discovered the vulnerability and initially reported it to the manufacturer and – due to a lack of response – subsequently to operators and CERTs worldwide in order to rule out further risks and responsibly disclose the vulnerability. This blog post describes technical details, cases from various countries, and the approach behind the discovery. Recommendations for affected organizations are also provided.

• CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted .library-ms file. Active exploitation in the wild has been observed since March 19, 2025, potentially allowing attackers to leak NTLM hashes or user passwords and compromise systems. Although Microsoft released a patch on March 11, 2025, threat actors already had over a week to develop and deploy exploits before the vulnerability began to be actively abused.

• Around March 20–21, 2025, a campaign targeted government and private institutions in Poland and Romania. Attackers used malspam to distribute a Dropbox link containing an archive that exploited multiple known vulnerabilities, including CVE-2025-24054, to harvest NTLMv2-SSP hashes.

  • Initial reports suggested that exploitation occurred once the .library-ms file was unzipped. However, Microsoft’s patch documentation indicated that the vulnerability could even be triggered with minimal user interaction, such as right-clicking, dragging and dropping, or simply navigating to the folder containing the malicious file. This exploit appears to be a variant of a previously patched vulnerability, CVE-2024-43451, as both share several similarities.

For more details: CVE-2025-24054, NTLM Exploit in the Wild

""" Dear Customers,

Yealink hereby informs you that the SIP-T46S has been discontinued since 2022-03-31. After the date, new orders for the product would not be accepted.

After the End-of-Life date, Yealink will not pursue any new feature development on SIP-T46S, but we will follow the industry standard practices regarding software support of the discontinued (EOL) products. Consistent with such standards, Yealink will continue to offer support and after-sale service.

The general policy guidelines are:

(1) For the first year from the End of Life date, Yealink will offer full support, including HW/SW Technical Support, Apply Existing SW Bug Fixes, New Non-Critical SW Bug Fixes, New Critical SW Bug Fixes and New Security Fixes.

(2) For the second year till, and including, the fifth year from the End of Life, Yealink will attempt to provide SW bug fixes. In the EOL support phase, a SW upgrade of the product to a newer existing release will also be seen as a fix to the SW bug. Providing a fix may not be possible in some cases due to the limitation of hardware or software architecture, and Yealink in its sole discretion will determine what fixes, if any, will be provided.

(3) Yealink will not offer any New Features/Enhancements support from the End of Life.

(4) Spares or replacement parts for hardware will be available depending on your local distributors. Please contact your local Yealink distributors for HW Technical Support and HW Repair and Return (subject to inventory availability). The local Yealink distributors will provide you the corresponding HW support in accordance with Yealink Return Materials Authorization (RMA) process.

(5) Since the sixth year from the End of Life, Yealink will not offer any Support. """

24.09          2024-11-29
-------------------------
- The default dictionary size values for LZMA/LZMA2 compression methods were increased:
         dictionary size   compression level
  v24.08  v24.09  v24.09
          32-bit  64-bit
    8 MB   16 MB   16 MB   -mx4
   16 MB   32 MB   32 MB   -mx5 : Normal
   32 MB   64 MB   64 MB   -mx6
   32 MB   64 MB  128 MB   -mx7 : Maximum
   64 MB   64 MB  256 MB   -mx8
   64 MB   64 MB  256 MB   -mx9 : Ultra
  The default dictionary size values for 32-bit versions of LZMA/LZMA2 don't exceed 64 MB.
- 7-Zip now can calculate the following hash checksums: SHA-512, SHA-384, SHA3-256 and MD5.
- APM and HFS support was improved.
- If an archive update operation uses a temporary archive folder and
  the archive is moved to the destination folder, 7-Zip shows the progress of moving
  the archive file, as this operation can take a long time if the archive is large.
- The bug was fixed: 7-Zip File Manager didn't propagate Zone.Identifier stream
  for extracted files from nested archives (if there is open archive inside another open archive).
- Some bugs were fixed.

https://sourceforge.net/p/sevenzip/discussion/45797/thread/b95432c7ac/

A quick parser to extract whois and country data from the darkweb forum post listing Fortinet devices victim to CVE-2022-40684.

Parser available at:

https://github.com/cudeso/tools/tree/master/CVE-2022-40684

Chrome Update Addresses High-Severity Vulnerability: CVE-2025-0291

Ref: https://securityonline.info/chrome-update-addresses-high-severity-vulnerability-cve-2025-0291/

Google has just released a critical security update for its Chrome web browser, addressing a high-severity vulnerability that could leave users open to attack. The update, rolling out to Windows, Mac, and Linux users over the next few days, patches a “Type Confusion” flaw in V8, the JavaScript engine that powers Chrome.

This vulnerability, tracked as CVE-2025-0291, was discovered by security researcher Popax21 and reported to Google on December 11th, 2024. Type Confusion vulnerabilities are particularly dangerous as they can allow attackers to execute malicious code on a user’s system. This can lead to a range of consequences, from data theft and system crashes to complete takeover of the affected device. Google has awarded a bounty of $55,000 to Popax21 for the discovery and responsible disclosure of the bug.

Type Confusion vulnerabilities occur when a program mistakenly treats data as a different type than originally intended. In the context of V8, this can lead to out-of-bounds memory access, allowing attackers to manipulate memory, crash the browser, or execute arbitrary code. Such vulnerabilities are often exploited in sophisticated attacks, making their timely resolution critical for user safety.

Google urges all users to update their Chrome browsers to the latest version (131.0.6778.264/.265 for Windows and Mac, 131.0.6778.264 for Linux) as soon as possible. Here’s how:

1. Open Chrome.
2. Click the three vertical dots in the top right corner.
3. Go to Help > About Google Chrome.
4. Chrome will automatically check for updates and install the latest version.
5. Relaunch Chrome to complete the update.

Related Posts:

• New Chrome 0-Day Bug Under Active Attack
• New WiFi Flaw Leaves All Devices Vulnerable to ‘SSID Confusion’ Attacks
• Chrome will no longer flag HTTPS pages as secure sites

The Stable channel has been updated to 131.0.6778.264/.265 for Windows, Mac and 131.0.6778.264 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 4 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.

383356864 High CVE-2025-0291: Type Confusion in V8. Reported by Popax21 on 2024-12-11

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes: - [388088544] Various fixes from internal audits, fuzzing and other initiatives

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Reference: https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop.html

MediaTek has notified device manufacturers (OEMs) about these vulnerabilities and provided corresponding security patches.

Users are strongly encouraged to check for updates from their device manufacturers and apply them as soon as possible to mitigate these security risks.

See bundle: https://vulnerability.circl.lu/bundle/a30ff14f-a073-49be-8c0c-6b6afd6a19f3

Various Android devides are impacted.