Aggregator

A vulnerability was found in Sun MySQL up to 4.1.9 on Windows. It has been classified as critical. Affected is an unknown function. The manipulation leads to denial of service. This vulnerability is traded as CVE-2005-0799. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Belkin Belkin 54g Wireless Router F5D7130. This vulnerability affects unknown code. The manipulation leads to Remote Code Execution. This vulnerability was named CVE-2005-0833. The attack can be initiated remotely. There is no exploit available.

German Consultancy's Latest LLM Aims to Reduce Costs, Preserve Reasoning Skills
Say hello to DeepSeek-TNG R1T2 Chimera, a large language model built by German firm TNG Consulting, using three different DeepSeek LLMs. The goal of R1T2 is to provide a faster LLM with more predictable performance that maintains full reasoning accuracy.

Also: Medicare Data Breach; Gartner Security & Risk Management Summit Takeaways
In this week's update, ISMG editors discussed Iran-linked hackers claiming to steal emails from Trump's inner circle, how to refine application development in the age of AI, and a U.S. Medicare data breach amplifying concerns over the safety, security and privacy of federal health systems.

Rejects Business and AI Leaders' Call for Two-Year Enforcement Moratorium
Expect to see no pause in the EU's enforcement of new rules governing artificial intelligence, a spokesperson for the European Commission said amid intensifying calls for officials to "stop the clock" over implementing the bloc's AI Act, in the name of innovation and competition.

个人的做题思考

A vulnerability has been found in libjxl 0.8.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Exif Handler. The manipulation leads to out-of-bounds read. This vulnerability is known as CVE-2023-0645. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in libjxl 0.8.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file dec_patch_dictionary.cc. The manipulation leads to integer underflow. This vulnerability is known as CVE-2023-35790. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in corydolphin flask-cors up to 4.0.1 and classified as critical. Affected by this issue is some unknown functionality of the component Configuration Options Handler. The manipulation leads to improper access controls. This vulnerability is handled as CVE-2024-6221. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Pacemaker and classified as critical. Affected by this issue is some unknown functionality of the component pcsd. The manipulation leads to improper authentication. This vulnerability is handled as CVE-2022-1049. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability was found in PCS. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Unix Socket Handler. The manipulation leads to incorrect default permissions. This vulnerability is known as CVE-2022-2735. The attack needs to be done within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in QOS logback 1.4.11. This issue affects some unknown processing of the component Logback Receiver. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2023-6378. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

MCP重新定义了大语言模型（LLM）与外部世界的互动方式。本文主要介绍并复现MCP服务的提示词注入、工具投毒、命令注入等漏洞，以及给出了相关漏洞的防护策略。

漏洞描述CVE-2017-17215是CheckPoint团队披露的远程命令执行（RCE）漏洞，存在于华为HG532路由器中。该设备支持名为DeviceUpgrade的一种服务类型，可通过向/ctrlt/DeviceUpgrade_1的地址提交请求，来执行固件的升级操作。可通过向37215端口发送数据包，启用UPnP协议服务，并利用该漏洞，在NewStatusURL或NewDownloadURL标

本篇文章将从 0 到 1 带你实现一个 基于大模型+MCP 协议+开源信息收集工具 的自动化漏洞挖掘工具，真正迈入「模型驱动安全工具链」的新时代。AI批量刷洞的时代即将来临！！！

环境搭建jdk 8u71Commons Collection 3.2.1jdk下载地址：https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html#license-lightbox具体搭建流程与CC1链是一样的，可以看我之前的文章。注意CC6对jdk是不受版本限制的，所以任意版本都行，但Commons

阿里云jtools详解及codeql分析调用链

在红队渗透过程中，数据外发和回传是常见的任务之一，尤其在对目标文件系统进行信息收集、凭据导出、WebShell落地或敏感文件抓取之后，为了避免引起告警或减小传输体积，往往需要对收集到的数据进行压缩处理。