Aggregator

本文总结了一系列Flask SSTI利用与绕过方式，希望提高大家的工作与研究效率。

A vulnerability, which was classified as problematic, was found in JetBrains TeamCity up to 2024.12.1. Affected is an unknown function of the component Code Inspection Report Tab. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-26493. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Sinaptik AI PandasAI 2.4.0. This issue affects some unknown processing of the component Natural language Processing. The manipulation leads to code injection. The identification of this vulnerability is CVE-2024-12366. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic was found in JetBrains TeamCity up to 2024.12.1. This vulnerability affects unknown code of the component Kubernetes Connection Handler. The manipulation leads to insufficiently protected credentials. This vulnerability was named CVE-2025-26492. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Devolutions Server up to 2024.3.10.0. This affects an unknown part of the component PAM Module. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2025-1231. Access to the local network is required for this attack to succeed. There is no exploit available.

​The United States, Australia, and the United Kingdom have sanctioned Zservers, a Russia-based bulletproof hosting (BPH) services provider, for supplying essential attack infrastructure for the LockBit ransomware gang. [...]

Роскомнадзор подтвердил кратковременные проблемы.

若得到证实，这将成为 AI 生成对话数据中规模最大的泄露事件之一。

Defenders, this one is for you. Read this SOTI report to get actionable insights from cybersecurity experts who battle cyberthreats every day.

Ransomware groups are adopting agile techniques in a quantity-over-quality approach, according to a new report from Huntress

This blog examines how diverse cultural celebrations — from Western Christmas to Orthodox and Lunar New Year festivities — shape global Internet traffic.

According to a recent report, U.S. spending on private 4G/5G networks is expected to jump by 18 percent to $3.7 billion by 2027. As of the first half of 2024, research indicates that the manufacturing industry leads the growth in the deployment of private 5G networks. Private 5G brings connectivity, reliability, and...

该漏洞影响 TLS 客户端，可能导致认证检查失败，攻击者可发起中间人攻击，威胁网络安全。尽快更新至最新版本至关重要。

Multi-factor authentication (MFA) has quickly become the standard for securing business accounts. Once a niche security measure, adoption is on the rise across industries. But while it’s undeniably effective at keeping bad actors out, the implementation of MFA solutions can be a tangled mess of competing designs and ideas. For businesses and employees, the reality is that MFA sometimes feels

The Thai police has arrested four individuals suspected of being the leaders of the 8Base ransomware group and of stealing approximately $16 million from 1,000+ victims they targeted with the Phobos ransomware. “Officers from Cyber Crime Investigation Bureau, led by Police Lieutenant General Trairong Phiwphan, conducted ‘Operation PHOBOS AETOR’ in Phuket on February 10, arresting four foreign hackers involved in ransomware attacks. The operation, coordinated with Immigration Police and Region 8 Police, raided four locations … More →

The post 8Base ransomware group leaders arrested, leak site seized appeared first on Help Net Security.

Industrial Defender announced its latest platform, Industrial Defender 8.0. This release introduces a completely redesigned risk dashboard, helping critical infrastructure and industrial operators manage security and compliance risks by assessing and prioritizing them with enhanced intelligence and risk scoring. Industrial Defender 8.0 also includes updates to Industrial Defender’s robust policy library, for meeting the very latest in standards and frameworks such as NERC CIP, AESCSF, OTCC, TSA Security Directives, and more. Industrial Defender’s 8.0 platform … More →

The post Industrial Defender 8.0 offers detailed view of OT environments appeared first on Help Net Security.

看书，是个随缘的事