Aggregator

New HackerOne CEO Kara Sprague to Expand Beyond Bug Bounties

Ransomware DataBreachToday.com
10 months 1 week ago
Sprague Replaces Veteran CEO, Plans to Double Down on PTaaS and AI Red Teaming
HackerOne has tapped F5's longtime product leader as it next chief executive to continue expanding its portfolio beyond operating vulnerability disclosure programs. The firm tasked Kara Sprague with building on existing growth in areas including AI red teaming and penetration testing as a service.

ONCD Unveils BGP Security Road Map Amid Rising Threats

Ransomware DataBreachToday.com
10 months 1 week ago
Director Hails New Guidance as 'First Step' in Resolving BGP Security Risks
Harry Coker, director of the Office of the National Cyber Director, described new guidance published Tuesday that aims to bolster internet routing security as a critical "first step" in addressing long-standing security issues that threaten the backbone of global communications.

US NTIA Probes Data Center Security Risks

Ransomware DataBreachToday.com
10 months 1 week ago
Agency Publishes Notice Soliciting Comments on Potential Federal Response
An artificial intelligence-fueled growth in data center construction has the federal government asking what it should do to help manage data security risks. The NTIA is interested in identifying opportunities "to improve data centers’ market development, supply chain resilience, and data security."

ZDI-CAN-25305: Sante

ZDI: Upcoming Advisories
10 months 1 week ago
A CVSS score 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H severity vulnerability discovered by 'Chizuru Toyama of TXOne Networks' was reported to the affected vendor on: 2024-09-04, 62 days ago. The vendor is given until 2025-01-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

ZDI-CAN-24934: Trend Micro

ZDI: Upcoming Advisories
10 months 1 week ago
A CVSS score 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N severity vulnerability discovered by 'Poh Jia Hao of STAR Labs SG Pte. Ltd.' was reported to the affected vendor on: 2024-09-04, 62 days ago. The vendor is given until 2025-01-02 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

Research Identifies Prevalence of Brand Impersonation in Three-Year Cross-Industry Analysis

Security Boulevard
10 months 1 week ago

A frequently asked question in cybersecurity is “What affects me?”. Companies want to know not only what is affecting other companies but what is specifically affecting similar companies in their industry and is therefore likely to affect them.

The post Research Identifies Prevalence of Brand Impersonation in Three-Year Cross-Industry Analysis appeared first on Security Boulevard.

Cofense Website

CVE-2022-4100 | WP Cerber Security Plugin up to 9.4 on WordPress IP Protection access control

Vuldb Updates
10 months 1 week ago
A vulnerability, which was classified as critical, has been found in WP Cerber Security Plugin up to 9.4 on WordPress. This issue affects some unknown processing of the component IP Protection. The manipulation leads to improper access controls. The identification of this vulnerability is CVE-2022-4100. The attack may be initiated remotely. There is no exploit available.
vuldb.com

CVE-2024-8108 | Share This Image Plugin up to 2.01 on WordPress alignment cross site scripting

Vuldb Updates
10 months 1 week ago
A vulnerability has been found in Share This Image Plugin up to 2.01 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument alignment leads to cross site scripting. This vulnerability is known as CVE-2024-8108. The attack can be launched remotely. There is no exploit available.
vuldb.com

CVE-2024-8367 | HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 Markdown NotificationService.java injection (DTSPB-4180/2614)

Vuldb Updates
10 months 1 week ago
A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. This vulnerability is traded as CVE-2024-8367. The attack can only be done within the local network. There is no exploit available. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue.
vuldb.com

三项智能网联汽车强制性国家标准正式发布（附图解）

嘶吼
10 months 1 week ago

近日，工业和信息化部组织制定的GB 44495—2024《汽车整车信息安全技术要求》、GB 44496—2024《汽车软件升级通用技术要求》和GB 44497—2024《智能网联汽车 自动驾驶数据记录系统》三项强制性国家标准由国家市场监督管理总局、国家标准化管理委员会批准发布，将于2026年1月1日起开始实施。

智能网联汽车产品安全是消费者关注的焦点，也是智能网联汽车产业持续健康发展的根本保障。为贯彻落实《国家标准化发展纲要》《国家车联网产业标准体系建设指南（智能网联汽车）》等要求，提升智能网联汽车产品安全水平，工业和信息化部自2019年起即立足我国智能网联汽车行业管理需求、产业发展实际和技术进步需要，陆续启动智能网联汽车领域相关强制性国家标准制定工作，并在研制过程中与联合国UN R155《关于就信息安全与信息安全管理体系方面批准车辆的统一规定》和UN R156《关于就软件升级与软件升级管理体系方面批准车辆的统一规定》等国际法规充分协调。

其中：GB 44495—2024《汽车整车信息安全技术要求》规定了汽车信息安全管理体系要求，以及外部连接安全、通信安全、软件升级安全、数据安全等方面的技术要求和试验方法，适用于M类、N类及至少装有1个电子控制单元的O类车辆，对于提升我国汽车产品的信息安全防护技术水平、强化产业链风险防范和应对网络攻击的能力、筑牢汽车信息安全防护基线具有重要意义。

GB 44496—2024《汽车软件升级通用技术要求》规定了汽车软件升级的管理体系要求，以及用户告知、版本号读取、安全保护、先决条件、电量保障、失败处理等车辆软件升级功能方面的技术要求和试验方法，适用于具备软件升级功能的M类、N类和O类车辆，为规范车企软件升级行为、保障消费者权益和落实软件升级监管政策奠定坚实的标准基础。

GB 44497—2024《智能网联汽车 自动驾驶数据记录系统》规定了智能网联汽车自动驾驶数据记录系统的数据记录、数据存储和读取、信息安全、耐撞性能、环境评价性等方面的技术要求和试验方法，适用于M和N类车辆配备的自动驾驶数据记录系统，将为事故责任认定及原因分析提供技术支撑，有利于促进自动驾驶技术进步。

本次发布的三项标准是我国智能网联汽车领域的首批强制性国家标准，是我国智能网联汽车技术的创新成果与经验总结，对提升智能网联汽车安全水平、保障产业健康持续发展具有重要意义。

文章来源：工业和信息化部装备工业一司

企业资讯

Managed ad