Aggregator

GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
10 months ago

GitLab has rolled out critical security updates to address multiple vulnerabilities in its Community Edition (CE) and Enterprise Edition (EE), fixing issues that could lead to unauthorized access to Kubernetes clusters and other potential exploits. The latest patch versions, 17.5.2, 17.4.4, and 17.3.7, are now available, and GitLab strongly urges all self-managed users to upgrade […]

The post GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Divya

Best 7 Compliance Risk Assessment Tools for 2024

Security Boulevard
10 months ago

Organizations devote significant resources to their compliance risk assessments each year. Yet many compliance leads and senior executives feel stuck in a cycle of repetition and question whether these efforts yield meaningful benefits.  Do you find that your risk assessment process helps you tackle risk effectively? Does it offer a clear view of your top […]

The post Best 7 Compliance Risk Assessment Tools for 2024 appeared first on Centraleyes.

The post Best 7 Compliance Risk Assessment Tools for 2024 appeared first on Security Boulevard.

Rebecca Kappel

Bluesky 用户突破 1500 万

Solidot
10 months ago
Bluesky 用户突破 1500 万达到 1560 万，在美国总统大选结束一周内它增加了 100 万新用户，它现在是 iOS 上最受欢迎的社媒应用。Bluesky 基于去中心化的 AT 协议，首席运营官 Rose Wang 表示大部分新用户来自美国。其竞争对手、Meta 的微博客应用 Threads 报告有 2.75 亿月活跃用户，每天新增注册用户逾 100 万。Threads 和 Bluesky 目前都没有广告，Meta 已经表示 Threads 将在明年初引入广告。另一则相关消息是，因马斯克（Elon Musk）操纵 X/Twitter 的方式，英国《卫报》公开声明停止更新其 X 官方账号。

梆梆安全成为中国网络空间安全协会智能网联安全专业委员会首批成员单位

嘶吼
10 months ago

近日，中国网络空间安全协会智能网联安全专业委员会成立大会在湖北武汉召开，该委员会由华中科技大学、国家互联网应急中心、东风汽车、华为以及梆梆安全在内的53家会员单位联合发起，旨在发挥桥梁纽带作用，组织动员会员单位开展智能网联安全政策法规研讨、标准开发、技术创新、产业协作、智库建设、人才培养、国际交流等工作。

协会理事长指出，专委会要着眼新技术、新应用带来的挑战开展研究，及时向主管部门反馈研究成果及发展中面临的问题，积极支撑政策制定，助力行业形成广泛共识；要充分发挥专家智库作用，加速推动智能网联汽车、无人机、工业控制等领域网络与数据安全能力提升。

梆梆安全作为国内早期投身于车联网安全研究的企业，在汽车信息安全测试、车联网应用安全、信息安全能力建设等方向积累了丰富的经验，梆梆安全以车联网应用的安全风险管控为核心目标，构建涵盖事前检测、事中防护、事后监测的车联网应用安全体系，在关键环节落实好相应安全措施，确保车联网应用的软件安全和数据安全。

基于多年来在车联网安全方面的研究基础和检测评估实践，梆梆安全推出汽车信息安全测试平台，内置整车、零部件、通信协议、等多方面的常用测试用例和主流安全测试工具，可对整车机零部件进行信息安全测试和管理，快速满足车联网相关企业安全合规、风险发现及安全防护能力提升等需求。

梆梆安全作为专委会发起单位之一，将积极发挥车联网安全研究优势，通过技术创新推进我国智能网联安全产业发展，同时为专委会各项工作提供全方位支持，为我国的智能网联安全事业贡献力量。

梆梆安全

CVE-2024-45809 | Envoy up to 1.29.8/1.30.5/1.31.1 Routing Table memory corruption (GHSA-wqr5-qmq7-3qw3 / Nessus ID 210925)

Vuldb Updates
10 months ago
A vulnerability was found in Envoy up to 1.29.8/1.30.5/1.31.1 and classified as critical. Affected by this issue is some unknown functionality of the component Routing Table Handler. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2024-45809. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-52554 | Jenkins Shared Library Version Override Plugin up to 17.v786074c9fce7 permission (Nessus ID 210929)

Vuldb Updates
10 months ago
A vulnerability classified as critical has been found in Jenkins Shared Library Version Override Plugin up to 17.v786074c9fce7. Affected is an unknown function. The manipulation leads to permission issues. This vulnerability is traded as CVE-2024-52554. Access to the local network is required for this attack to succeed. There is no exploit available.
vuldb.com

CVE-2022-46751 | Oracle Business Intelligence Enterprise Edition 6.4.0.0.0 Visual Analyzer xml injection (Nessus ID 210929)

Vuldb Updates
10 months ago
A vulnerability classified as critical was found in Oracle Business Intelligence Enterprise Edition 6.4.0.0.0. This vulnerability affects unknown code of the component Visual Analyzer. The manipulation leads to xml injection. This vulnerability was named CVE-2022-46751. The attack can be initiated remotely. There is no exploit available.
vuldb.com

CVE-2024-45808 | Envoy up to 1.28.6/1.29.4/1.30.0 REQUESTED_SERVER_NAME neutralization for logs (GHSA-p222-xhp9-39rc / Nessus ID 210925)

Vuldb Updates
10 months ago
A vulnerability, which was classified as critical, was found in Envoy up to 1.28.6/1.29.4/1.30.0. This affects an unknown part. The manipulation of the argument REQUESTED_SERVER_NAME leads to improper output neutralization for logs. This vulnerability is uniquely identified as CVE-2024-45808. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-45806 | Envoy up to 1.28.6/1.29.4/1.30.0 internal_address_config authorization (GHSA-ffhv-fvxq-r6mf / Nessus ID 210925)

Vuldb Updates
10 months ago
A vulnerability has been found in Envoy up to 1.28.6/1.29.4/1.30.0 and classified as critical. This vulnerability affects unknown code. The manipulation of the argument internal_address_config leads to authorization bypass. This vulnerability was named CVE-2024-45806. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

Managed ad