Aggregator

In the October 2024 survey we received responses from 1,131,068,688 sites across 271,7

Although most organizations use emails with built-in security features that filter out suspicious messages, criminals always find a way to bypass these systems. With the development of AI technology, phishing is becoming increasingly difficult to recognize, allowing them to circumvent security measures. While most attempts do not succeed, it only takes one to cause significant damage to a company’s operations. Mick Leach, Field CISO at Abnormal Security, discusses why the automotive industry is the new … More →

The post Threat actors are stepping up their tactics to bypass email protections appeared first on Help Net Security.

A vulnerability, which was classified as problematic, was found in lunary-ai lunary up to 1.4.9. This affects the function extractFirstName of the file /v1/users/send-verification of the component API. The manipulation leads to failure to sanitize special elements into a different plane (special element injection). This vulnerability is uniquely identified as CVE-2024-7472. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in gaizhenbiao ChuanhuChatGPT up to 20240410. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to file inclusion. The identification of this vulnerability is CVE-2024-5823. The attack may be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, was found in langchain-ai langchainjs up to 0.3.0. Affected is the function GraphCypherQAChain. The manipulation leads to sql injection. This vulnerability is traded as CVE-2024-7042. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in gaizhenbiao ChuanhuChatGPT up to 20240628. It has been declared as problematic. This vulnerability affects unknown code of the component Private Chat Handler. The manipulation leads to data access operations outside of expected data manager component. This vulnerability was named CVE-2024-8143. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

UnitedHealth Group, which this month confirmed that the sensitive personal information of more t

The FBI and other agencies accused Iranian cyber actors of targeting the 2024 Summer Olympics, incl

error code: 1106

Here's an overview of the various breaches that have been consolidated into this Have I Been

Here’s a look at the most interesting products from the past month, featuring releases from: Action1, Balbix, BreachLock, Commvault, Dashlane, Data Theorem, Edgio, ExtraHop, Fastly, Frontegg, GitGuardian, IBM, Ivanti, Jumio, Kusari, Legit Security, Metomic, Nametag, Neon, Nucleus Security, Okta, Qualys, Rubrik, SAFE Security, Sectigo, Securiti, Veeam Software, and XM Cyber. Qualys Enterprise TruRisk Management unifies asset inventory and risk factors Qualys launched the Risk Operations Center (ROC) with Enterprise TruRisk Management (ETM). The solution enables … More →

The post Infosec products of the month: October 2024 appeared first on Help Net Security.

New Funding to Aid US Government Growth, Generative AI Security Product Development
Zenity has closed a $38 million Series B round to advance its agentic AI security platform and extend its no-code and low-code application support. With investment from Third Point Ventures and DTCP, the funding enables Zenity to cater to clients in sectors like financial services and healthcare.

Lazarus Group in Particular Using Cross-Platform Languages to Hit macOS Targets
Cryptocurrency-seeking hackers are increasingly targeting macOS users. So warn security researchers as they track a rise in macOS backdoors and information-stealing malware, much of which traces back to a well-known cryptocurrency heist culprit: North Korea.

Volt Typhoon, APT31 and APT41 Tied to Campaigns Targeting Sophos' Edge Devices
Firewall maker Sophos disclosed Thursday a half-decade worth of efforts by multiple nation-state Chinese hacking groups to infiltrate its appliances, calling the admission a wake-up call for the cybersecurity industry. Targeting firewall appliances is a known nation-state tactic.

Also: Breaches at OnePoint Patient Care and French ISP Free
This week: S&P said poor material vulnerability remediaton can be a material risk factor, OnePoint in the United States and French ISP Free suffered data breaches, a Russian court sentenced REvil members, Five Eyes published security guidelines for small businesses.