Defense in depth -- the Microsoft way (part 95): the (shared) "Start Menu" is dispensable

Posted by Stefan Kanthak via Fulldisclosure on Jan 10

Hi @ll,

the following is a condensed form of
<https://skanthak.hier-im-netz.de/whispers.html#whisper3> and
<https://skanthak.hier-im-netz.de/whispers.html#whisper4>.

Windows Vista moved the shared start menu from "%ALLUSERSPROFILE%\Start Menu\"
to "%ProgramData%\Microsoft\Windows\Start Menu\", with some shortcuts (*.lnk)
"reflected" from the (immutable) component store below %SystemRoot%\WinSxS\

JFTR:...

Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Posted by Art Manion via Fulldisclosure on Jan 10

Hi,

CVE IDs *can* be assigned for SaaS or similarly "cloud only" software. For a period of time, there was a restriction
that only the provider could make or request such an assignment. But the current CVE rules remove this restriction:

4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine
learning) as the sole basis for determining assignment.

It would have been...

RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser

Posted by Ron E on Jan 10

A stack-based buffer overflow vulnerability exists in the RIOT OS ethos
utility due to missing bounds checking when processing incoming serial
frame data. The vulnerability occurs in the _handle_char() function, where
incoming frame bytes are appended to a fixed-size stack buffer
(serial->frame) without verifying that the current write index
(serial->framebytes) remains within bounds. An attacker capable of sending
crafted serial or...

RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction

Posted by Ron E on Jan 10

A stack-based buffer overflow vulnerability exists in the tapslip6 utility
distributed with RIOT OS (and derived from the legacy uIP/Contiki
networking tools). The vulnerability is caused by unsafe string
concatenation in the devopen() function, which constructs a device path
using unbounded user-controlled input.
Specifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed
prefix "/dev/" with a user-supplied device name...

TinyOS 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio

Posted by Ron E on Jan 10

A stack-based buffer overflow vulnerability exists in the mcp2200gpio
utility due to unsafe use of strcpy() and strcat() when constructing device
paths during automatic device discovery. A local attacker can trigger the
vulnerability by creating a specially crafted filename under /dev/usb/,
resulting in stack memory corruption and a process crash. In non-hardened
builds, this may lead to arbitrary code execution.

*Root Cause:*

The vulnerability...

TinyOS 2.1.2 printfUART Global Buffer Overflow via Unbounded Format Expansion

Posted by Ron E on Jan 10

A global buffer overflow vulnerability exists in the TinyOS printfUART
implementation used within the ZigBee / IEEE 802.15.4 networking stack. The
issue arises from an unsafe custom sprintf() routine that performs
unbounded string concatenation using strcat() into a fixed-size global
buffer. The global buffer debugbuf, defined with a size of 256 bytes, is
used as the destination for formatted output. When a %s format specifier is
supplied with a...

KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Posted by KoreLogic Disclosures via Fulldisclosure on Jan 08

KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Title: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking
Advisory ID: KL-001-2026-001
Publication Date: 2026-01-08
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2026-001.txt

1. Vulnerability Details

     Affected Vendor: yintibao
     Affected Product: Fun Print Mobile
     Affected Version: 6.05.15
   ...

Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Posted by Yuffie Kisaragi via Fulldisclosure on Jan 05

UPDATE:

Following the publication of these vulnerabilities and the subsequent CVE
assignments, the CVE identifiers have now been revoked.

The vendor (EQS Group) contacted the CVE Program (via a CNA) and disputed the
records, stating that the affected product is an exclusively hosted SaaS
platform with no customer-managed deployment or versioning. Based on this
argument, the CVE Program concluded that CVE assignment is “not a suitable...

Panda3d v1.10.16 Uncontrolled Format String in Panda3D egg-mkfont Allows Stack Memory Disclosure

Posted by Ron E on Jan 05

Panda3D’s egg-mkfont utility contains an uncontrolled format string
vulnerability that allows disclosure of stack-resident memory. The -gp
(glyph pattern) command-line option allows users to specify a formatting
pattern intended for generating glyph texture filenames. This pattern is
passed directly as the format string to sprintf() without validation or
sanitization. If the supplied pattern contains additional format specifiers
beyond the...

Panda3d v1.10.16 egg-mkfont Stack Buffer Overflow

Posted by Ron E on Jan 05

A stack-based buffer overflow vulnerability exists in the Panda3D
egg-mkfont utility due to the use of an unbounded sprintf() call with
attacker-controlled input. By supplying an excessively long glyph pattern
string via the -gp command-line option, an attacker can trigger a stack
buffer overflow, resulting in a deterministic crash of the egg-mkfont
process.

*Technical Details:*
The vulnerability occurs when egg-mkfont constructs output glyph...

Panda3d v1.10.16 deploy-stub Unbounded Stack Allocation Leading to Uninitialized Memory

Posted by Ron E on Jan 05

A memory safety vulnerability exists in the Panda3D deploy-stub executable
due to unbounded stack allocation using attacker-controlled input. The
issue allows a local attacker to trigger stack exhaustion and subsequent
use of uninitialized memory during Python interpreter initialization,
resulting in a reliable crash and undefined behavior. The vulnerability is
confirmed by MemorySanitizer (MSAN) as a use-of-uninitialized-value
originating from...

MongoDB v8.3.0 Integer Underflow in LMDB mdb_load

Posted by Ron E on Jan 05

This integer underflow vulnerability enables heap metadata corruption and
information disclosure through carefully crafted LMDB dump files.

*Impact:*

- *Denial of Service*: Immediate crash (confirmed)
- *Information Disclosure*: Heap metadata leak via OOB read

Root Cause:The readline() function fails to validate that the input line
length is non-zero before performing decrement operations, causing integer
underflow. An attacker can craft...

Bioformats v8.3.0 Untrusted Deserialization of Bio-Formats Memoizer Cache Files

Posted by Ron E on Jan 05

Bio-Formats performs unsafe Java deserialization of attacker-controlled
memoization cache files (.bfmemo) during image processing. The
loci.formats.Memoizer class automatically loads and deserializes memo files
associated with images without validation, integrity checks, or trust
enforcement.
An attacker can exploit this behavior by supplying a crafted or corrupted
.bfmemo file—either fully attacker-controlled or derived from a legitimate
memo...

Bioformats v8.3.0 Improper Restriction of XML External Entity Reference in Bio-Formats Leica Microsystems XML Parser

Posted by Ron E on Jan 05

Bio-Formats contains an XML External Entity (XXE) vulnerability in the
Leica Microsystems metadata parsing component. The vulnerability is caused
by the use of an insecurely configured DocumentBuilderFactory when
processing Leica XML-based metadata files (e.g., XLEF). When a crafted XML
file is supplied, the parser allows external entity resolution and external
DTD loading, enabling attackers to trigger arbitrary outbound network
requests, access...

MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load

Posted by Ron E on Jan 05

A heap buffer underflow vulnerability exists in the readline() function of
OpenLDAP's Lightning Memory-Mapped Database (LMDB) mdb_load utility. The
vulnerability is triggered through malformed input data and results in an
out-of-bounds read one byte before an allocated heap buffer. This can lead
to information disclosure through heap memory leakage.

*Root Cause:*
The vulnerability occurs in the readline() function at line 214 of
mdb_load.c....

zlib v1.3.1.2 Global Buffer Overflow in TGZfname() of zlib untgz Utility via Unbounded strcpy() on User-Supplied Archive Name

Posted by Ron E on Jan 05

A global buffer overflow vulnerability exists in the TGZfname() function of
the zlib untgz utility due to the use of an unbounded strcpy() call on
attacker-controlled input. The utility copies a user-supplied archive name
(argv[arg]) into a fixed-size static global buffer of 1024 bytes without
performing any length validation. Supplying an archive name longer than
1024 bytes results in an out-of-bounds write past the end of the global
buffer,...

SigInt-Hombre v1 / dynamic Suricata detection rules from real-time threat feeds

Posted by malvuln on Jan 05

SigInt-Hombre, generates derived Suricata detection rules from live
URLhaus threat indicators at runtime and deploy them to the Security
Onion platform for high-coverage real-time network monitoring.

https://github.com/malvuln/sigint-hombre

What it does:
Pulls the public URLhaus feed in real time (not mirrored or redistributed)

Skips:
Comments, empty lines, malformed URLs, and feed self-references
Normalizes and extracts:

Protocol, host, URI...

Security Vulnerability in Koller Secret: Real Hidden App (com.koller.secret.hidemyphoto)

Posted by duykham on Jan 05

Hello Full Disclosure,

I would like to disclose a security vulnerability identified in a
smartphone application: *Koller Secret: Real Hidden App*.

This report is shared in the interest of responsible disclosure and
improving overall security awareness.

---

*Summary*
- Application: Koller Secret: Real Hidden App
- Package / Bundle ID: com.koller.secret.hidemyphoto
- Platform: Android
- Affected Version(s): v.1.0.27 and below
- Vulnerability...

Linux Kernel Block Subsystem Vulnerabilities

Posted by Agent Spooky's Fun Parade via Fulldisclosure on Jan 05

================================================================================
FULL DISCLOSURE: Linux Kernel Block Subsystem Vulnerabilities
Date: 2025-12-29
Affected: Linux Kernel (all versions with affected code)
================================================================================

================================================================================
[1/4] Integer Overflow in LDM Partition Parser - Heap Overflow...

[KIS-2025-14] PKP-WAL <= 3.5.0-1 Login Cross-Site Request Forgery Vulnerability

Posted by Egidio Romano on Dec 27

-----------------------------------------------------------------
PKP-WAL <= 3.5.0-1 Login Cross-Site Request Forgery Vulnerability
-----------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

Version 3.3.0-21 and prior versions.
Version 3.4.0-9 and prior versions.
Version 3.5.0-1 and prior versions.

[-] Vulnerability Description:

Open...

[KIS-2025-13] PKP-WAL <= 3.5.0-3 (X-Forwarded-Host) LESS Code Injection Vulnerability

Posted by Egidio Romano on Dec 27

-----------------------------------------------------------------------
PKP-WAL <= 3.5.0-3 (X-Forwarded-Host) LESS Code Injection Vulnerability
-----------------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-10
and prior versions, and version 3.5.0-3 and prior versions, as...

[KIS-2025-12] PKP-WAL <= 3.5.0-1 (baseColour) LESS Code Injection Vulnerability

Posted by Egidio Romano on Dec 27

-----------------------------------------------------------------
PKP-WAL <= 3.5.0-1 (baseColour) LESS Code Injection Vulnerability
-----------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-9
and prior versions, and version 3.5.0-1 and prior versions, as used in
Open Journal...

[KIS-2025-11] Open Journal Systems <= 3.5.0-1 (NativeXmlIssueGalleyFilter.php) Path Traversal Vulnerability

Posted by Egidio Romano on Dec 27

---------------------------------------------------------------------------------------------
Open Journal Systems <= 3.5.0-1 (NativeXmlIssueGalleyFilter.php) Path
Traversal Vulnerability
---------------------------------------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca/software/ojs/
https://github.com/pkp/ojs

[-] Affected Versions:

Version 3.3.0-21 and prior versions.
Version 3.4.0-9 and...

[KIS-2025-10] PKP-WAL <= 3.5.0-1 (Institution Collector) SQL Injection Vulnerability

Posted by Egidio Romano on Dec 27

----------------------------------------------------------------------
PKP-WAL <= 3.5.0-1 (Institution Collector) SQL Injection Vulnerability
----------------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-9
and prior versions, and version 3.5.0-1 and prior versions, as used...

Backdoor.Win32.Poison.jh / Insecure Permissions

Posted by malvuln on Dec 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2025
Original source:
https://malvuln.com/advisory/3d9821cbe836572410b3c5485a7f76ca.txt
Malvuln Intelligence Feed: https://intel.malvuln.com/
Contact: malvuln13 () gmail com
Media: x.com/malvuln

Threat: Backdoor.Win32.Poison.jh
Vulnerability: Insecure Permissions
Description: The malware creates the directory 28463 under
C:\Windows\SysWOW64, granting Full (F) permissions to the Everyone...

Backdoor.Win32.Netbus.170 / Insecure Credential Storage / MVID-2025-0703

Posted by malvuln on Dec 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2025
Original source:
https://malvuln.com/advisory/086f0693f81f6d40460c215717349a1f.txt
Malvuln Intelligence Feed: https://intel.malvuln.com/
Contact: malvuln13 () gmail com
Media: x.com/malvuln

Threat: Backdoor.Win32.Netbus.170
Vulnerability: Insecure Credential Storage
Family: Netbus
Type: PE32
Attack-pattern TTP: Unsecured Credentials (T1552)
MD5: 086f0693f81f6d40460c215717349a1f...

Defense in depth -- the Microsoft way (part 94): SAFER (SRPv1 and AppLocker alias SRPv2) bypass for dummies

Posted by Stefan Kanthak via Fulldisclosure on Dec 22

Hi @ll,

since 30 years Microsoft ships Windows with "Windows Script Host",
an empty registry key and the following registry entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings]
"ActiveDebugging"="1"
"DisplayLogo"="1"
"SilentTerminate"="0"
"UseWINSAFER"="1"

The...

Backdoor.Win32.ControlTotal.t / Insecure Credential Storage / MVID-2025-0702

Posted by malvuln on Dec 22

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2025
Original source:
https://malvuln.com/advisory/6c0eda1210da81b191bd970cb0f8660a.txt
Malvuln Intelligence Feed: https://intel.malvuln.com/
Contact: malvuln13 () gmail com
Media: x.com/malvuln

Threat: Backdoor.Win32.ControlTotal.t
Vulnerability: Insecure Credential Storage
Description: The malware listens on TCP port 2032 and requires
authentication. The password "jdf4df4vdf"...

HEUR.Backdoor.Win32.Poison.gen / Arbitrary Code Execution / MVID-2025-0701

Posted by malvuln on Dec 22

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2025
Original source:
https://malvuln.com/advisory/b2e50fa38510a5ea8e11f614b1c1d0d5.txt
Malvuln Intelligence Feed: https://intel.malvuln.com/
Contact: malvuln13 () gmail com
Media: x.com/malvuln

Threat: HEUR.Backdoor.Win32.Poison.gen
Vulnerability: Arbitrary Code Execution
Description: The malware looks for and executes a x32-bit
"WININET.dll" PE file in its current directory....

CyberDanube Security Research 20251215-0 | Multiple Vulnerabilities in Phoenix Contact FL Switch Series

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Dec 17

CyberDanube Security Research 20251215-0
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| FL Switch
vulnerable version| 3.40
fixed version| TODO
CVE number| CVE-2025-41692, CVE-2025-41693, CVE-2025-41694,
| CVE-2025-41695, CVE-2025-41696, CVE-2025-41697,
| CVE-2025-41745,...

[KIS-2025-09] Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection Vulnerability

Posted by Egidio Romano on Dec 17

------------------------------------------------------------------------------------
Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection
Vulnerability
------------------------------------------------------------------------------------

[-] Software Link:

https://control-webpanel.com

[-] Affected Versions:

Version 0.9.8.1208 and prior versions.

[-] Vulnerability Description:

User input passed via the "key" GET...

Raydium CP Swap: Unchecked Account Allows Creator Fee Hijacking

Posted by LRKTBEYK LRKTBEYK on Dec 17

I tried to report these vulnerabilities to ImmuneFi, but they closed it
(report 62070) as "out of scope." I believe them when they tell me
something is out of scope, so now it's public.

https://github.com/raydium-io/raydium-cp-swap/pull/62

These vulnerabilities collectively enable fee theft, creator fee hijacking,
and potential user exploitation through uncapped fee rates. Issue #3 allows
attackers to steal all creator fees from...

[CFP] Security BSidesLjubljana 0x7EA | March 13, 2026

Posted by Andraz Sraka on Dec 17

MMMMMMMMMMMMMMMMNmddmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMN..-..--+MMNy:...-.-/yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMy..ymd-.:Mm::-:osyo-..-mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MM:..---.:dM/..+NNyyMN/..:MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
Mm../dds.-oy.-.dMh--mMds++MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
My:::::/ydMmo..-hMMMmo//omMs/+Mm+++++shNMN+//+//+oMNy+///ohM
MMMs//yMNo+hMh---m:-:hy+sMN..+Mo..os+.-:Ny--ossssdN-.:yyo+mM...

[KIS-2025-08] 1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability

Posted by Egidio Romano on Dec 15

------------------------------------------------------------------------------
1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability
------------------------------------------------------------------------------

[-] Software Link:

https://www.1c-bitrix.ru

[-] Affected Versions:

Version 25.100.500 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate...

[KIS-2025-07] Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability

Posted by Egidio Romano on Dec 15

-----------------------------------------------------------------------------
Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability
-----------------------------------------------------------------------------

[-] Software Link:

https://www.bitrix24.com

[-] Affected Versions:

Version 25.100.300 and prior versions.

[-] Vulnerability Description:

The vulnerability is located within the "Translate Module",...

nopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks functionality

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was identified Cross-Site Request Forgery (CSRF) vulnerability on the "Run now" button of Schedule tasks
functionality. Exploiting this vulnerability, an attacker can run a scheduled task without the victim users consent or
knowledge.

Assigned CVE code:
      > CVE-2025-65593

[Discoverer]
      > AlterSec t/a PenTest.NZ

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that multiple Stored Cross-Site Scripting (Stored XSS) vulnerabilities in the product
management functionality. Malicious JavaScript payloads inserted into the "Product Name" and "Short Description" fields
are stored in the backend database and executed automatically whenever a user (administrator or customer) views the
affected pages.

Assigned CVE code:
    ...

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that a Stored XSS vulnerability on the "Currencies" functionality, specifically on the
following input field: "Configuration > Currencies > Edit one of the currencies > "Custom formatting" input field.
After saving the payload, the vulnerability can be triggered by visiting the following pages:
- Bestsellers,
- "Sales" > "Orders"...

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that a Stored XSS vulnerability in the "Content Management" > "Blog posts" area. Malicious
HTML/JavaScript added to the Body overview field of a blog post is stored in the backend and executes when the blog
page is visited (http://localhost/blog/)

Assigned CVE code:
     > CVE-2025-65590

[Discoverer]
      > AlterSec t/a PenTest.NZ

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality

Posted by Onur Tezcan via Fulldisclosure on Dec 15

[Attack Vectors]
      > It was detected that a Stored XSS vulnerability in the Attributes management workflow. An attacker can insert
JavaScript into the Name field when adding a new Attribute Group (Catalog > Attributes > Specification attributes > Add
Group > Name input field). To exploit the vulnerability, privileged users should visit the "Specification attributes
page.

Assigned CVE code:
    >...

Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Posted by Yuffie Kisaragi via Fulldisclosure on Dec 15

UPDATE:

The reported vulnerabilities have now been assigned CVE identifiers:
CVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411
[https://www.cve.org/cverecord?id=CVE-2025-34411]
CVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412
[https://www.cve.org/cverecord?id=CVE-2025-34412]

APPLE-SA-12-12-2025-9 Safari 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-9 Safari 26.2

Safari 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125892.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Safari
Available for: macOS Sonoma and macOS Sequoia
Impact: On a Mac with Lockdown Mode enabled, web content opened via a
file URL may...

APPLE-SA-12-12-2025-8 visionOS 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-8 visionOS 26.2

visionOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125891.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive payment tokens
Description: A...

APPLE-SA-12-12-2025-7 watchOS 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-7 watchOS 26.2

watchOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125890.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: Apple Watch Series 6 and later
Impact: An app may be able to access sensitive payment tokens
Description: A...

APPLE-SA-12-12-2025-6 tvOS 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-6 tvOS 26.2

tvOS 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125889.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a file may lead to memory corruption
Description: The...

APPLE-SA-12-12-2025-5 macOS Sonoma 14.8.3

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-5 macOS Sonoma 14.8.3

macOS Sonoma 14.8.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125888.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: macOS Sonoma
Impact: Processing a file may lead to memory corruption
Description: The issue was...

APPLE-SA-12-12-2025-4 macOS Sequoia 15.7.3

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-4 macOS Sequoia 15.7.3

macOS Sequoia 15.7.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125887.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

AppleJPEG
Available for: macOS Sequoia
Impact: Processing a file may lead to memory corruption
Description: The issue...

APPLE-SA-12-12-2025-3 macOS Tahoe 26.2

Posted by Apple Product Security via Fulldisclosure on Dec 15

APPLE-SA-12-12-2025-3 macOS Tahoe 26.2

macOS Tahoe 26.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125886.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

App Store
Available for: macOS Tahoe
Impact: An app may be able to access sensitive payment tokens
Description: A permissions...

Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)

Posted by Yuffie Kisaragi via Fulldisclosure on Dec 05

Advisory ID: CONVERCENT-2025-001
Title: Multiple Security Misconfigurations and Customer Enumeration Exposure in
Convercent Whistleblowing Platform (EQS Group)
Date: 2025-12-04
Vendor: EQS Group
Product: Convercent Whistleblowing Platform (app.convercent.com)
Severity: Critical
CVSS v4.0 Base Score: 9.3
Vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

A series of security weaknesses were identified in the Convercent...

8 vulnerabilities in AudioCodes Fax/IVR Appliance

Posted by Pierre Kim on Dec 01

## Advisory Information

Title: 8 vulnerabilities in AudioCodes Fax/IVR Appliance
Advisory URL: https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt
Blog URL: https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html
Date published: 2025-11-20
Vendors contacted: Audiocodes
Release mode: Released
CVE: CVE-2025-34328, CVE-2025-34329, CVE-2025-34330, CVE-2025-34331,
CVE-2025-34332, CVE-2025-34333,...

2 vulnerabilities in Egovframe

Posted by Pierre Kim on Dec 01

## Advisory Information

Title: 2 vulnerabilities in Egovframe
Advisory URL: https://pierrekim.github.io/advisories/2025-egovframe.txt
Blog URL: https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html
Date published: 2025-11-20
Vendors contacted: KISA/KrCERT
Release mode: Released
CVE: CVE-2025-34336, CVE-2025-34337

## Product description

Egovframe is a Java-based framework mainly used in the websites of the
Government of...

[REVIVE-SA-2025-005] Revive Adserver Vulnerability

Posted by Matteo Beccati on Dec 01

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-005
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-005
------------------------------------------------------------------------
Date: 2025-11-26
Risk Level: Medium
Applications affected: Revive...

Missing Critical Security Headers in Legality WHISTLEBLOWING

Posted by Aerith Gainsborough via Fulldisclosure on Dec 01

Advisory ID: LEGALITYWHISTLEBLOWING-2025-001
Title: Missing Critical Security Headers in Legality WHISTLEBLOWING
Date: 2025-11-29
Vendor: DigitalPA (segnalazioni.net)
Severity: High
CVSS v3.1 Base Score: 8.2 (High)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Summary:

Multiple public deployments of Legality WHISTLEBLOWING by DigitalPA
are missing essential HTTP security headers.
This misconfiguration exposes users to client-side attacks...

[REVIVE-SA-2025-004] Revive Adserver Vulnerabilities

Posted by Matteo Beccati on Nov 19

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-004
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-004
------------------------------------------------------------------------
Date: 2025-11-19
Risk Level: Medium
Applications affected: Revive...

[REVIVE-SA-2025-003] Revive Adserver Vulnerabilities

Posted by Matteo Beccati on Nov 19

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2025-003
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2025-003
------------------------------------------------------------------------
Date: 2025-11-05
Risk Level: High
Applications affected: Revive...

[SYSS-2025-059]: Dell computer UEFI boot protection bypass

Posted by Micha Borrmann via Fulldisclosure on Nov 19

Advisory ID: SYSS-2025-059
Product: Dell computer
Manufacturer: Dell
Affected Version(s): Probably all Dell computers
Tested Version(s): Latitude 5431 (BIOS 1.33.1),
Latitude 7320 (BIOS 1.44.1),
Latitude 7400 (BIOS 1.41.1),
Latitude 7480 (BIOS 1.41.3),
Latitude 9430 (BIOS...

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Patrick via Fulldisclosure on Nov 13

Hello Jan,

You are completely right and it’s something I warned about early, which is abuse of AI-generated sensationalized
headline and fake PoC-s, for fame.

I urge the Full Disclosure staff to look into it.

Discussions with the individual responsible seem to be fruitless, and this likely constitutes abuse of this mailing
list.

Sent from Proton Mail for iOS.

-------- Original Message --------

I looked at few repos and posts of...

APPLE-SA-11-13-2025-1 Compressor 4.11.1

Posted by Apple Product Security via Fulldisclosure on Nov 13

APPLE-SA-11-13-2025-1 Compressor 4.11.1

Compressor 4.11.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125693.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Compressor
Available for: macOS Sequoia 15.6 and later
Impact: An unauthenticated user on the same network as a Compressor...

Re: 83 vulnerabilities in Vasion Print / PrinterLogic

Posted by Pierre Kim on Nov 13

No message preview for long message of 668188 bytes.

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885)

Posted by Joseph Goydish II via Fulldisclosure on Nov 07

Hey Patrick, I understand the doubt.

However… what’s not slop is reproducible logs I provided a video of and the testable, working exploit I provided.

Neither is the upstream patches that can be tracked from the disclosure dates to the cve’s listed in the report.

The exploit was caught in the wild, reversed engineered via log analysis and the logs provided are simply observed
behavior. Please feel free to independently test the...