Aggregator

A CVSS score 8.0 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2024-12-02, 88 days ago. The vendor is given until 2025-04-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'PHP Hooligans / Midnight Blue' was reported to the affected vendor on: 2024-12-02, 88 days ago. The vendor is given until 2025-04-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.3 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N severity vulnerability discovered by 'Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)' was reported to the affected vendor on: 2024-12-02, 88 days ago. The vendor is given until 2025-04-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

快速浏览！2024.11.25—12.1安全动态周回顾。

Securonix 研究人员发现的一项新活动是使用网络钓鱼电子邮件执行无人值守的 Linux 虚拟机安装，以破坏企业网络并获得持久性。

A vulnerability, which was classified as critical, has been found in Oracle Communications Analytics 12.1.1. This issue affects some unknown processing of the component Platform. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2020-11022. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

印度电信监管机构推出了旨在保护国家关键基础设施网络免受网络威胁的规则。

你是否花了太多时间在社媒网站上浏览短视频？如果是，那么你可能遭遇了 brain rot。brain rot 成为了牛津今年的年度词，该词反映了对过度消费低质量在线内容的影响的担忧。从 2023 年到 2024 年，该词使用率增长了 230%。牛津大学教授 Andrew Przybylski 称，其流行反映了我们这个时代的症状。Brain rot 战胜了其它几个流行词，其中包括 demure、Romantasy、dynamic pricing 和 slop。Brain rot 的首次使用是在互联网诞生前，来自于梭罗(Henry David Thoreau) 的著作《瓦尔登湖》，用于形容精神的贫瘠，如今被用于形容低质量低价值的内容。Przybylski 教授说，该词概况了我们对社交媒体的焦虑。

近日，一起大规模的数据泄露事件震动了网络安全界。名为“HikkI-Chan”的黑客在臭名昭著的Breach Forums上泄露了超过3.9亿VK用户的个人信息。

A vulnerability was found in Linux Kernel 3.0.63. It has been classified as critical. This affects the function ath9k_htc_set_bssid_mask. The manipulation leads to cryptographic issues. This vulnerability is uniquely identified as CVE-2013-4579. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Berkeley Sendmail 8.7/8.8/8.8.1/8.8.2 and classified as critical. This issue affects some unknown processing of the component Daemon Mode. The manipulation leads to improper privilege management. The identification of this vulnerability is CVE-1999-0130. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Il Web Tossico, e Sisifo Felice

Cybersecurity programs have evolved significantly over the past few decades. The advent of cloud computing shattered the conventional corporate perimeter, forcing organizations to update their defense strategies. Today, with the rise of work-from-anywhere and bring-your-own-device (BYOD) policies as well as the ongoing shift to cloud environments, we’re seeing a shift of equal magnitude as it is becoming increasingly clear that endpoint security tools alone cannot handle the new threat landscape. Endpoint security is still an … More →

The post 5 reasons to double down on network security appeared first on Help Net Security.

A vulnerability, which was classified as problematic, has been found in Symantec pcAnywhere 8.0. Affected by this issue is some unknown functionality. The manipulation leads to denial of service. This vulnerability is handled as CVE-1999-1028. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

In this Help Net Security interview, Alec Summers, Project Leader for the CVE Program at MITRE, shares his insights on the 2024 CWE top 25 most dangerous software weaknesses. He discusses the impact of the new methodology that involves the CNA community and highlights the persistent vulnerabilities that continue to make the list year after year. Summers also touches on the role of AI tools in identifying vulnerabilities and the importance of root cause mapping … More →

The post Inside the 2024 CWE Top 25: Trends, surprises, and persistent challenges appeared first on Help Net Security.

A vulnerability has been found in Netscape Messaging Server 3.6/3.54/3.55 and classified as problematic. This vulnerability affects unknown code of the component RCPT TO Handler. The manipulation leads to uncontrolled memory allocation. This vulnerability was named CVE-1999-1532. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Hikvision DVR DS-7204 2.2.10. Affected by this issue is some unknown functionality of the component Authorization. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2014-4880. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical has been found in 0verkill 0.16. This affects the function parse_command_line. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2004-0238. Attacking locally is a requirement. Furthermore, there is an exploit available.

A vulnerability classified as problematic has been found in Webdav neon 0.28.6. This affects an unknown part. The manipulation leads to improper resource management. This vulnerability is uniquely identified as CVE-2009-2473. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

While human error has always posed a cybersecurity risk, AI and emerging tech are playing an evolving role in Human Risk Management – uncovering new needs, challenges, and pain points. In this Help Net Security video, Bret Fund, SVP and General Manager at Infosec Institute, discusses how human risk management should be at the core of an organization’s risk management strategy, especially in the age of AI. As tech advances, training must be regularly updated … More →

The post How AI is transforming human risk management appeared first on Help Net Security.