Aggregator

The guidance aims to ensure security, privacy and accessibility during the identity-proofing process for people accessing government services.

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

• CVE-2021-33044 Dahua IP Camera Authentication Bypass Vulnerability
• CVE-2021-33045 Dahua IP Camera Authentication Bypass Vulnerability
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow
• CVE-2021-31196 Microsoft Exchange Server Information Disclosure Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

作为前华为安全产品领域总裁，前杭州安恒信息技术股份有限公司总裁，宋端智现在的title成为了杭州端爷餐饮有限公司创始人。

主站 分类 漏洞 工具 极客

At ANY.RUN, we’re committed to staying at the forefront of cybersecurity threats. Our team continuously monitors and analyzes emerging phishing campaigns to keep our users informed and protected. We regularly share our findings on our X (formerly Twitter) account.    In this article, we’ve compiled a selection of the most notable phishing campaigns we’ve seen […]

The post Recent Phishing Campaigns Discovered by ANY.RUN Researchers appeared first on ANY.RUN's Cybersecurity Blog.

腾势，有了自己的 「001」。

Последний сбой был зафиксирован всего несколько дней назад, 19 августа.

Выявленная RCE-уязвимость получила максимальную оценку по шкале CVSS.

В чем секрет постоянной плотности галактик?

金山办公方面表示，目前软件功能已修复完成，崩溃原因或与云服务异常有关。

主站 分类 漏洞 工具 极客

Теперь горе-взломщику придётся ответить за свои действия по всей строгости закона.

A vulnerability was found in Autodesk Revit up to 2022.1.6/2023.1.4/2024.2.1/2025 and classified as critical. This issue affects some unknown processing of the component DWG File Handler. The manipulation leads to stack-based buffer overflow. The identification of this vulnerability is CVE-2024-37008. The attack may be initiated remotely. There is no exploit available.

It's no great revelation to say that SaaS applications have changed the way we operate, both in our personal and professional lives. We routinely rely on cloud-based and remote applications to conduct our basic functions, with the result that the only true perimeter of our networks has become the identities with which we log into these services. Unfortunately – as is so often the case – our

每日更新当天鲜活情报和热点漏洞

In what's a case of an operational security (OPSEC) lapse, the operator behind a new information stealer called Styx Stealer leaked data from their own computer, including details related to the clients, profit information, nicknames, phone numbers, and email addresses. Styx Stealer, a derivative of the Phemedrone Stealer, is capable of stealing browser data, instant messenger sessions from

Судья возобновил коллективный иск против компании.

Как цифровые развлечения влияли на нашу психику во время пандемии.

Cybersecurity researchers have uncovered a new macOS malware strain dubbed TodoSwift that they say exhibits commonalities with known malicious software used by North Korean hacking groups. "This application shares several behaviors with malware we've seen that originated in North Korea (DPRK) — specifically the threat actor known as BlueNoroff — such as KANDYKORN and RustBucket," Kandji security