Aggregator

本文系《可信实验白皮书》系列的第七篇文章。上一篇我们重点介绍了观察性研究，内容主要包括合成控制法、匹配方法、Causal Impact等几个方面。针对单次实验功效不足、假阳性、策略调优等实验中面临的问题，本篇我们来介绍几个高阶实验工具，重点解读了统合分析、多重比较，同时还有一些拓展与展望。

Sitecore 10.4 - Remote Code Execution (RCE)

McAfee Agent 5.7.6 - Insecure Storage of Sensitive Information

Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)

Tails 6.17版本新增显示密码选项，并更新uBlock Origin扩展至1.62.0及Tor Browser至14.5.4。修复了新标签页显示空白及重复CPU微代码问题。提供自动或手动升级指南，并支持通过多种系统安装或直接下载USB/ISO镜像。

freeSSHd 1.0.9 存在拒绝服务（DoS）漏洞，攻击者可通过构造特定数据包导致服务崩溃。该漏洞由Fernando Mengali发现并提供PoC代码验证。

微软Excel 2024存在Use after free漏洞（CVE-2025-47165），攻击者可通过恶意DOCM文件诱使用户执行远程代码，导致设备感染或严重破坏。建议禁用宏功能以防范风险。

OneTrust SDK 6.33.0 存在原型污染漏洞，攻击者可利用 `Object.setPrototypeOf` 和 `Object.assign` 注入恶意属性，导致全局对象污染、应用逻辑错误或拒绝服务（DoS）。建议升级至修复版本并加强输入过滤以防止类似问题。

文章描述了PX4军事无人机自动驾驶仪1.12.3版本中的一个堆栈溢出漏洞（CVE-2025-5640），该漏洞由处理畸形的MAVLink TRAJECTORY_REPRESENTATION_WAYPOINTS消息触发。攻击者可利用此漏洞通过UDP发送定制数据包使自动驾驶仪崩溃。文章附带了一个Python工具用于测试连接或发起DoS攻击。

这篇文章介绍了Pterodactyl Panel 1.11.11中的远程代码执行漏洞（CVE-2025-49132），允许攻击者通过特定请求获取数据库配置信息，并提供了检测脚本。

PX4 Military UAV Autopilot 1.12.3 - Denial of Service (DoS)

OneTrust SDK 6.33.0 - Denial Of Service (DoS)

Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE)

freeSSHd 1.0.9 - Denial of Service (DoS)

Microsoft Excel 2024 Use after free - Remote Code Execution (RCE)

国际权威认证！

A British national known online as "IntelBroker" has been charged by the U.S. for stealing and selling sensitive data from dozens of victims, causing an estimated $25 million in damages. [...]

When the RMS Titanic hit an iceberg on 15 April 1912, she set off flares
and her wireless operator sent out a distress call. The RMS Carpathia
responded, but by the time she arrived, the Titanic had already sunk: only
those who had made it to the lifeboats could be saved. Some 1,500 people
died.

Another ship was closer and could potentially have responded faster—perhaps
even fast enough that more lives could have been saved. Yet despite seeing
the flares, she did nothing.

The post Lessons from the Titanic: when you don’t respond to a crisis appeared first on Security Boulevard.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

Organizations are moving away from the public cloud and embracing a more hybrid approach due to big changes over the past five years.