Aggregator

关于jar更新问题，属于开源组件安全治理的范畴。从SDL体系上来看，还是应该纳入到统一的漏洞管理流程中跟进，即使这个问题可能是后门或强传染性开源协议。 在推动开源组件修复的过程中，可能会遇到：漏洞太多推哪些修、如何让开发愿意修等难题。若是初期可以小范围试点推修，比如有公开POC的先修；慢慢再扩大范围为所有高风险、甚至中风险。 切记不要随着开发的思路：验证成功了，再修。因为开源组件CVE漏洞验证成功水太深（业务场景不熟悉、技术水平达不到、漏洞数量太多...），按这个路数大概率会走向失败。 更多软件安全内容，可以访问： 1、SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 设计阶段应开展哪些安全活动？ 有哪些不错的安全设计参考资料？ 安全设计要求怎么做才能落地？ 有哪些威胁建模方法论？ 有哪些威胁建模工具？ 如何开始或实施威胁建模？ 威胁建模和架构安全评审，有何异同？ 编码阶段，开展哪些安全活动？ 如何选择静态代码扫描(SAST)工具？ 如何选择开源组件安全扫描(SCA)工具？ SCA工具扫描出很多漏洞，如何处理？ SCA工具识别出高风险协议，如何处理？ 如何制定一份有用的开发安全规范？ 如何做到开发安全规范的有效实施？ 应该如何选型代码安全扫描工具？ 代码安全扫描应该设置哪些指标？ 如何提升开发人员的安全意识？ 白盒检测工具存在局限性，如何进行补偿？ SCA用什么系统做，自研还是外购？ 有没有好用的SDL平台？ Sonar是否好用以及误报率咋样？ 2、SDL创新实践系列 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 从安全视角，看研发安全 数字化转型下的研发安全痛点

Zero-day vulnerabilities are serious threats. They’re completely unknown to both the vendor and the user. That gives attackers a significant advantage, allowing them to attack systems before patches are available.

The post What’s a Zero-Day Vulnerability? Prevent Exploits and Attacks appeared first on Security Boulevard.

Cybersecurity 2025 | Preparing for Tomorrow’s Threats, Challenges and Strategic Shifts

Why Should Cloud Data Protection Be Your Top Priority? With the steep rise in digitalization, sensitive data has moved from the physical world into the boundless digital realm. Cloud computing has become a crucial part of this transition, thus making cloud data protection a top priority. But what does it mean to secure this data, […]

The post Critical Steps to Keep Your Cloud Data Protected appeared first on Entro.

The post Critical Steps to Keep Your Cloud Data Protected appeared first on Security Boulevard.

大模型安全 | “创造未来，安全同行” 北京站·第九期「度安讲」 技术沙龙开放报名

哈佛大学发布基于百万公有领域书籍的免费 AI 训练数据库

For Russian spies, existing cybercrime tools become avenues into Ukrainian military devices

AI爆款视频：一键智能生成爆款视频工具

Open source Prometheus servers and exporters are leaking plaintext passwords and tokens, along with API addresses of internal locations.

Paper-to-Podcast：将学术研究论文转换成播客工具

A vulnerability has been found in NewsmanApp Plugin up to 2.7.6 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-11767. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Primer MyData for Woocommerce Plugin up to 4.2.1 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-11809. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Minify HTML Plugin up to 2.1.10 on WordPress. This issue affects some unknown processing. The manipulation leads to incorrect regular expression. The identification of this vulnerability is CVE-2024-12579. The attack may be initiated remotely. There is no exploit available.

Gamaredon Deploys Android Spyware "BoneSpy" and "PlainGnome" in Former Soviet States

Citrix Denial of Service: Analysis of CVE-2024-8534

SSPM approach of french company Decathlon

Attacking Cortex XDR from an unprivileged user perspective

Law enforcement across mainland China have been using EagleMsgSpy surveillance tool to collect mobile device data since at least 2017, new research shows.