Aggregator

A vulnerability has been found in Ecovacs Mobile Application 3.3.0 on iOS/Android and classified as problematic. This vulnerability affects unknown code of the component Alibaba Object Storage Service. The manipulation leads to hard-coded credentials. This vulnerability was named CVE-2025-2394. It is possible to launch the attack on the physical device. There is no exploit available.

A vulnerability, which was classified as critical, was found in openDCIM up to 23.04. This affects the function people_depts of the file people_depts.php. The manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2025-48701. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Microsoft Edge. Affected by this issue is some unknown functionality of the component Updater. The manipulation leads to link following. This vulnerability is handled as CVE-2025-47181. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

In this Help Net Security interview, Dr. Joy Wu, Assistant Professor, UBC Sauder School of Business, discusses the psychological and societal impacts of data monetization, why current privacy disclosures often fall short, and what it will take to create a more equitable data ecosystem. From the limits of transparency to the potential for privacy to become a luxury, Wu offers a candid assessment of where we are, and where we’re headed. Consumers significantly change their … More →

The post Is privacy becoming a luxury? A candid look at consumer data use appeared first on Help Net Security.

鼓励各组织在所有平台上采用多因素身份验证（MFA），以增加额外的安全层，即使凭证被泄露也应该及时采取此类措施。

该软件于2022年12月首次在网络犯罪论坛上出售，KELA报告称，仅仅几个月后，该软件就在网络犯罪分子中流行起来。

探讨了多种在线诈骗活动，包括利用房屋交易托管流程进行的房产欺诈，以及被称为“杀猪盘”的复杂浪漫加密货币投资骗局。专家 Ronnie Tokazowski 详细介绍了这些骗局的运作方式，并强调了情感操纵和信任在诈骗过程中的核心作用。录音还深入探讨了商业邮件入侵（BEC），指出这些骗局与尼日利亚王子”诈骗的联系，并讨论了名为黑斧的尼日利亚犯罪集团涉足这些网络犯罪，甚至提及了献祭仪式的令人不安的方面。最后，讨论转向了与这些诈骗相关的巨额金融损失，特别是针对美国政府疫情援助资金的欺诈，并呼吁人们对这些看似简单的犯罪提高警惕，承认其造成的广泛损害。

全世界的人口出生率在下降，大部分发达国家的生育率低于更替水平，意味着从长期看人口将会萎缩。相比下，养狗则愈来愈受欢迎。在大部分欧洲国家，有四分之一到半数的家庭养育了至少一条狗，狗通常被视为家庭的一员，甚至被称为“毛茸茸的宝宝”。匈牙利布达佩斯罗兰大学（Eötvös Loránd University）的研究人员认为，虽然狗不能替代孩子，但某种情况下它提供了一种为人父母的机会，且投入的资源要比养育后代少得多，也更容易控制和照顾。狗能与主人建立情感联系，能带来积极情绪和社会支持。养狗要比养育后代要轻松的多，一个原因是狗的寿命有限。研究人员认为，包括狗在内的宠物在人类生活中扮演的角色正在重新定义家庭的概念。

先知社区Q&A

​用安全的模型去守护不安全的模型，用智能的系统去抵御来自智能的攻击。

Но кто-то должен спросить: а нам точно это нужно?

Outsourcing cybersecurity can be a practical and affordable option. It allows small businesses to get the protection they need without straining their budgets, freeing up time and resources to focus on core operations. 76% of SMBs lack the in-house skills to properly address security issues, increasing demand for the expertise and services of MSPs, and 78% are concerned that a severe cyberattack could drive them out of operation, according to ConnectWise. What you can outsource … More →

The post Outsourcing cybersecurity: How SMBs can make smart moves appeared first on Help Net Security.

基金申报截止时间为 2025 年 6 月 15 日 24:00

内核中一些结构体的常见利用方式

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications hosted in their Microsoft Azure cloud environment. "Threat actors may have accessed client secrets for Commvault's (Metallic) Microsoft 365 (M365) backup software-as-a-service (SaaS) solution, hosted in Azure," the agency said. "This

A vulnerability was found in Linux Kernel up to 5.15.48/5.18.5. It has been classified as critical. This affects the function lpfc_nlp_get. The manipulation of the argument NLP_EVT_DEVICE_RM leads to use after free. This vulnerability is uniquely identified as CVE-2022-49730. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 5.10.129/5.15.53/5.18.10. It has been classified as critical. Affected is the function __reg_bound_offset. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2022-49658. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 5.4.203/5.10.128/5.15.52/5.18.9. This issue affects the function of_get_devfreq_events/of_get_child_by_name. The manipulation leads to improper update of reference count. The identification of this vulnerability is CVE-2022-49668. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Linux Kernel up to 5.18.5. This affects the function i40e_vsi_close of the component setup_tx_descriptors. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2022-49725. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 5.15.45/5.17.13/5.18.2. This affects the function smp_processor_id. The manipulation leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2022-49537. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.