利用位图资源隐藏恶意软件的新型混淆技术分析
攻击者通过图像隐写术将恶意软件隐藏在看似无害的位图资源中，轻松绕过传统安全检测，如何防范？
Aggregator
Входишь в почту — а она уже не твоя: девять российских компаний пробиты через Outlook
2 months 3 weeks ago
Почтовый клиент, который шпионил за тобой.
Sale of 23andMe: On the Hot Seat of Congress, States
2 months 3 weeks ago
Lawmakers Quiz Execs on Security; State AG Seek to Block Sale of Bankrupt Firm
While a Congressional committee grilled 23andMe executives on Tuesday about security and privacy, 28 states filed a lawsuit to stop the sale of the bankrupt genetics testing firm unless the company obtains explicit consent from each customer for the transfer or their information to a third party.
While a Congressional committee grilled 23andMe executives on Tuesday about security and privacy, 28 states filed a lawsuit to stop the sale of the bankrupt genetics testing firm unless the company obtains explicit consent from each customer for the transfer or their information to a third party.
300K Crash Reports Stolen in Texas DOT Hack
2 months 3 weeks ago
Crash Records and Driver Data Exposed in Texas Transportation Hack
Hackers accessed the Texas Department of Transportation's crash records system using a compromised account, stealing nearly 300,000 reports containing personal and vehicle information that could be used for fraud, the department warned in a letter to impacted individuals.
Hackers accessed the Texas Department of Transportation's crash records system using a compromised account, stealing nearly 300,000 reports containing personal and vehicle information that could be used for fraud, the department warned in a letter to impacted individuals.
How to Get a Clearer Picture of Vendor Risk
2 months 3 weeks ago
Experts Call for Continuous Assessments of Vendor Risk - Not Just at Onboarding
As vendor ecosystems grow in complexity, many organizations still view third-party risk management as a static assessment of vendors as they're onboarded. But organizations often focus too heavily on upfront vetting of vendors and fail to track how their risk profiles may change over time.
As vendor ecosystems grow in complexity, many organizations still view third-party risk management as a static assessment of vendors as they're onboarded. But organizations often focus too heavily on upfront vetting of vendors and fail to track how their risk profiles may change over time.
CVE-2025-5485 | SinoTrack IOT PC Platform up to 8.6 Web Management Interface observable response discrepancy (icsa-25-160-01)
2 months 3 weeks ago
A vulnerability was found in SinoTrack IOT PC Platform up to 8.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Management Interface. The manipulation leads to observable response discrepancy.
This vulnerability is known as CVE-2025-5485. The attack can be launched remotely. There is no exploit available.
vuldb.com
CVE-2025-5484 | SinoTrack IOT PC Platform 8.3 Device Management weak authentication (icsa-25-160-01)
2 months 3 weeks ago
A vulnerability was found in SinoTrack IOT PC Platform 8.3. It has been classified as critical. Affected is an unknown function of the component Device Management Handler. The manipulation leads to weak authentication.
This vulnerability is traded as CVE-2025-5484. It is possible to launch the attack remotely. There is no exploit available.
vuldb.com
CVE-2025-4799 | WP-DownloadManager Plugin up to 1.68.10 on WordPress absolute path traversal (EUVD-2025-18083)
2 months 3 weeks ago
A vulnerability was found in WP-DownloadManager Plugin up to 1.68.10 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to absolute path traversal.
The identification of this vulnerability is CVE-2025-4799. The attack may be initiated remotely. There is no exploit available.
vuldb.com
网络钓鱼攻击的演变：传统检测手段为何失效？
2 months 3 weeks ago
如果不是对企业和消费者造成严重危害，现代网络钓鱼的“高明”手法甚至令人叹服。
CVE-2024-35295 | Siemens Perfect Harmony GH180 up to 8.3.2 missing authentication (ssa-771113 / EUVD-2024-54675)
2 months 3 weeks ago
A vulnerability has been found in Siemens Perfect Harmony GH180 up to 8.3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to missing authentication.
This vulnerability was named CVE-2024-35295. It is possible to launch the attack on the physical device. There is no exploit available.
It is recommended to upgrade the affected component.
vuldb.com
CVE-2025-5991 | Qt 6.9.0 QtNetwork Module QHttp2ProtocolHandler use after free (EUVD-2025-18092)
2 months 3 weeks ago
A vulnerability, which was classified as critical, was found in Qt 6.9.0. This affects the function QHttp2ProtocolHandler of the component QtNetwork Module. The manipulation leads to use after free.
This vulnerability is uniquely identified as CVE-2025-5991. The attack needs to be approached locally. There is no exploit available.
It is recommended to upgrade the affected component.
vuldb.com
2025轩辕杯CTF之web
2 months 3 weeks ago
Webezweb查看网页源码，发下账号密码，fly233/123456789登录进去点击抓包，查看数据包猜测存在任意文件读取漏洞，直接读环境变量看看拿下flagezjs查看源码，看看main.js 直接向 getflag.php 发送 POST 请求即可Ezflask题目名可知为ssti注入 进入题目测试进一步验证fenjing直接跑：{{''['__cla'+'ss__']['__ba'+'s
Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero-Day Exploited in the Wild
2 months 3 weeks ago
Microsoft has released patches to fix 67 security flaws, including one zero-day bug in Web Distributed Authoring and Versioning (WebDAV) that it said has come under active exploitation in the wild.
Of the 67 vulnerabilities, 11 are rated Critical and 56 are rated Important in severity. This includes 26 remote code execution flaws, 17 information disclosure flaws, and 14 privilege escalation
The Hacker News
Египетский бог с головой сокола теперь живёт в вашем Edge — но это не мифология, а новый 0day
2 months 3 weeks ago
PDF не виноват — просто в него вселился демон с WebDAV-сервера.
Dire Wolf
2 months 3 weeks ago
You must login to view this content
cohenido
Dire Wolf
2 months 3 weeks ago
You must login to view this content
cohenido
Dire Wolf
2 months 3 weeks ago
You must login to view this content
cohenido
双项殊荣｜梆梆安全入选2025年度 “中国数据安全50强” 及 “价值图谱代表企业”
2 months 3 weeks ago
近日，国内权威咨询机构数世咨询发布《中国数据安全50强（2025）》与《中国数字安全价值图谱》，梆梆安全基于技术能力、产品落地性及市场表现等核心维度的综合评估，入选“中国数据安全50强-综合实力榜单”及“中国数字安全价值图谱-APP个人信息保护检测代表厂商”，印证综合实力与专业价值。
中国数据安全50强
“中国数据安全50强”是数世咨询于2024年在业内首创，评价数字安全产业中数据安全领域供应商的权威性产业榜单。本次评选：
·综合实力是指具备自主知识产权的数据安全产品和提供的数据安全服务在市场中具备一定知名度或覆盖率，并且以数据安全领域作为公司重点发展方向。
·评选指标包括企业发展力和领域影响力两个维度，分别从经营、技术、管理、品牌传播、业内评价和技术前瞻性等多角度进行综合评价。
中国数字安全价值图谱
《中国数字安全价值图谱》由数世咨询"基于价值"理念推出，聚焦企业核心能力，遴选细分领域市场占有率较高或技术创新性较强的供应商，凸显优秀安全能力提供者，降低供需双方的试错成本，为数字安全行业用户提供研究与借鉴。
梆梆安全长期深耕数据安全领域，构建覆盖多场景的数据安全技术体系。在数据泄露防护、数据分类分级、数据安全治理、个人信息保护、API安全监测防护等关键技术领域持续突破，通过API安全平台、移动应用合规平台、全渠道应用安全监测平台、数据安全合规审计、个人信息隐私合规评估服务等核心产品，打造覆盖数据全生命周期的防护方案，针对复杂应用环境提供具备落地性和可持续性的安全能力支撑。
此次同时入选“中国数据安全50强-综合实力榜单”与“中国数字安全价值图谱-APP个人信息保护检测代表厂商” ，印证了行业对梆梆安全在数据安全领域的技术积累与实践成果，及其安全价值的双重认可。
据数世咨询调研分析，2024年度，我国数据安全领域市场规模达到62.018亿元（开票额），较2023年度增长3.99亿元，增长率为6.87%。在保守预测的情况下，数据安全领域规模将持续高增长态势，于2027年突破100亿元关口。
伴随我国网络法治建设深化，在“三法三条例”框架下，数据作为关键资产价值凸显，监管趋严与合规要求强力驱动数据安全场景化需求激增。隐私合规、数据分类分级、防泄露、API安全、合规咨询及风险评估需求集中爆发，对数据安全供应商能力提出更高标准。
未来，梆梆安全将持续以创新驱动，深化技术实力与产品服务，融合人工智能等前沿技术突破数据安全边界，致力于交付全面、智能、高效的数据安全解决方案，为国家数字经济健康发展提供坚实保障。
梆梆安全
Safepay
2 months 3 weeks ago
You must login to view this content
cohenido
【已复现】契约锁电子签章系统远程代码执行漏洞
2 months 3 weeks ago
检测业务是否受到此漏洞影响，请联系长亭应急服务团队！