Security News

On becoming a carpenter

Daily Dave - 12 June, 2025 - 16:05

Posted by Dave Aitel via Dailydave on Jun 12

[image: image.png]

Every so often I poke my head out, gopher-like, from the tunnels where I am
furiously vibe-coding, or as it's going to be known a couple years from
now, coding. I think it's probably true that coding used to be a high
octane sport for concentration freaks as deep in the zone as a sperm whale
hunting giant squid by listening to the faint echoes of pings off squishy
bodies leagues away. But coding is now a juggling...

SEC Consult SA-20250604-0 :: Local Privilege Escalation and Default Credentials in INDAMED - MEDICAL OFFICE (Medical practice management) Demo version

Full Disclosure - 9 June, 2025 - 21:44

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 09

SEC Consult Vulnerability Lab Security Advisory < 20250604-0 >
=======================================================================
title: Local Privilege Escalation and Default Credentials
product: INDAMED - MEDICAL OFFICE (Medical practice management)
Demo version
vulnerable version: Revision 18544 (II/2024)
fixed version: Q2/2025 (Privilege Escalation, Default Password)...

Full Disclosure: CVE-2025-31200 & CVE-2025-31201 – 0-Click iMessage Chain → Secure Enclave Key Theft, Wormable RCE, Crypto Theft

Full Disclosure - 9 June, 2025 - 21:43

Posted by josephgoyd via Fulldisclosure on Jun 09

Hello Full Disclosure,

This is a strategic public disclosure of a zero-click iMessage exploit chain that was discovered live on iOS 18.2 and
remained unpatched through iOS 18.4. It enabled Secure Enclave key theft, wormable remote code execution, and
undetectable crypto wallet exfiltration. Despite responsible disclosure, the research was suppressed by the vendor.
Apple issued a silent fix in iOS 18.4.1 (April 2025) without public...

Defense in depth -- the Microsoft way (part 89): user group policies don't deserve tamper protection

Full Disclosure - 3 June, 2025 - 08:03

Posted by Stefan Kanthak on Jun 03

Hi @ll,

user group policies are stored in DACL-protected registry keys
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]
respectively [HKEY_CURRENT_USER\Software\Policies] and below, where
only the SYSTEM account and members of the "Administrators" user group
are granted write access.

At logon the user's registry hive "%USERPROFILE%\ntuser.dat" is loaded
with exclusive (read, write and...

CVE-2025-45542: Time-Based Blind SQL Injection in CloudClassroom PHP Project v1.0

Full Disclosure - 3 June, 2025 - 08:03

Posted by Sanjay Singh on Jun 03

Hello Full Disclosure list,

I am sharing details of a newly assigned CVE affecting an open-source
educational software project:

------------------------------------------------------------------------
CVE-2025-45542: Time-Based Blind SQL Injection in CloudClassroom PHP
Project v1.0
------------------------------------------------------------------------

Product: CloudClassroom PHP Project
Vendor:...

ERPNext v15.53.1 Stored XSS in bio Field Allows Arbitrary Script Execution in Profile Page

Full Disclosure - 3 June, 2025 - 08:03

Posted by Ron E on Jun 03

An authenticated attacker can inject JavaScript into the bio field of their
user profile. When the profile is viewed by another user, the injected
script executes.

*Proof of Concept:*

POST
/api/method/frappe.desk.page.user_profile.user_profile.update_profile_info
HTTP/2
Host: --host--

profile_info={"bio":"\"><img src=x onerror=alert(document.cookie)>"}