Aggregator

Kibana, a popular open-source data visualization and exploration tool, has identified a critical security flaw that could allow attackers to execute arbitrary code. This vulnerability, tracked as CVE-2024-37287, has a CVSSv3 severity rating of 9.9, indicating its critical nature. CVE-2024-37287 – Vulnerability Details The flaw arises from a prototype pollution vulnerability that can be exploited […]

The post Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code appeared first on Cyber Security News.

根据国家信息安全漏洞库（CNNVD）统计，本周（2024年7月29日至2024年8月4日）安全漏洞情况如下。

日产汽车公司展示了一种特殊车漆的实证试验，即使暴晒在夏季烈日下也能控制车内温度上升。这种特殊车漆是与拥有辐射制冷技术的中国企业联合开发。在开发阶段，确认到与常规车漆相比，车身表面降低 12 度、驾驶席头部空间降低 5 度。开空调时降至设定温度的时间也能缩短。除反射阳光外，车漆还通过释放汽车表面热能，防止温度上升。正在开发的车漆漆膜较厚，用于量产车存在课题，力争改良。

A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the file /goform/apPortalAuth. The manipulation of the argument webUserName/webUserPassword leads to buffer overflow. This vulnerability is known as CVE-2024-7585. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formApPortalPhoneAuth of the file /goform/apPortalPhoneAuth. The manipulation of the argument data leads to buffer overflow. This vulnerability is traded as CVE-2024-7584. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the function formApPortalOneKeyAuth of the file /goform/apPortalOneKeyAuth. The manipulation of the argument data leads to buffer overflow. The identification of this vulnerability is CVE-2024-7583. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function formApPortalAccessCodeAuth of the file /goform/apPortalAccessCodeAuth. The manipulation of the argument accessCode/data/acceInfo leads to buffer overflow. This vulnerability was named CVE-2024-7582. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-7581. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Игроки смогут испытать 23 карты, среди которых знакомые локации из предыдущих игр.

自2021年起，俄罗斯用户已成为一种新型未被记录的安卓后门间谍软件“LianSpy”的攻击目标。 网络安全公司卡巴斯基在2024年3月发现了这款恶意软件，并指出其利用俄罗斯的云服务Yandex Cloud进行命令和控制（C2）通信，以避免设立专用基础设施并逃避检测。 安全研究员Dmitry Kalinin在周一发布的技术报告中表示：LianSpy能够捕获屏幕录像、窃取用户文件、收集通话记录和应用程序列表。 目前尚不清楚该间谍软件的传播方式，但卡巴斯基推测，它可能是通过未知的安全漏洞或是直接接触目标手机来部署的，这些带有恶意软件的应用程序看起来像是支付宝或安卓系统的一个服务。 LianSpy一旦被激活，会先检查自己是不是以系统应用身份在运行。如果是，它会利用管理员权限在后台操作。如果不是，它会请求一系列权限以访问联系人、通话记录、通知，甚至会在手机屏幕上绘制覆盖层。 它还会检查自己是否在调试环境中运行，以便设置一个在手机重启后也能保持的配置。然后从手机的启动器中隐藏图标，并触发屏幕截图、导出数据和更新配置等活动，以指定需要捕获的信息类型。 某些变种被发现能够收集俄罗斯流行的即时通讯应用的数据，并根据是否连接到Wi-Fi或移动网络来允许或禁止运行恶意软件。 Kalinin说：“为了更新间谍软件配置，LianSpy每隔30秒会在攻击者的Yandex Disk上搜索与正则表达式’^frame_.+.png$’匹配的文件，如果找到，文件将被下载到应用程序的内部数据目录中。” 并且，收集的数据以加密形式存储在SQL数据库中，指定记录类型和SHA-256哈希值，只有拥有相应私有RSA密钥的攻击者才能解密窃取的信息。 LianSpy的隐蔽性体现在它能够绕过谷歌在Android 12中引入的隐私指示器功能，该功能要求请求麦克风和相机权限的应用显示状态栏图标。LianSpy开发者通过修改Android安全设置参数，防止通知图标出现在状态栏。 它还利用NotificationListenerService隐藏后台服务的通知，处理并抑制状态栏通知。 LianSpy恶意软件的另一个复杂之处在于它使用了修改名称为”mu”的su二进制文件来获取root权限，这增加了它可能是通过一个以前未知的漏洞或对设备的物理访问来传播的可能性。 此外，LianSpy的C2通信是单向的，只接收命令，不发送任何回应。它使用Yandex Disk传输被盗数据和存储配置命令，从硬编码的Pastebin URL更新Yandex Disk的凭据，不同恶意软件变种的 Pastebin URL 各不相同，使用这种合法服务增加了混淆层，追踪LianSpy变得更加困难。 LianSpy是不断增长的间谍软件工具列表中的最新成员，通常利用零日漏洞攻击目标移动设备（无论是 Android 还是 iOS）。Kalinin表示：“除了收集通话记录和应用列表等标准间谍行为外，它还利用root权限进行隐蔽的屏幕录制，避开安全检查，其依赖重命名的su二进制文件，暗示了初次入侵后的二次感染。”   转自Freebuf，原文链接：https://www.freebuf.com/news/408008.html 封面来源于网络，如有侵权请联系删除

云南省昭通市彝良县一村民报告，8 月 5 日 18 时 14 分左右，自家院子里突然掉下来一颗炮弹，不幸砸中其母亲，母亲右腿当场被砸断致截肢。从他发布的家中监控视频中可以看到，有两个村民正在院落中干农活，突然一声巨响，伴随一阵烟尘，可以明显看到空中有物体坠落。现场照片显示，坠落物为黑色圆柱体。该村民表示，母亲目前还在昭通市第一人民医院的重症监护室治疗，呈昏迷状态，情况十分糟糕，而且医疗费用十分高昂。当地气象部门表示正在核查中，暂时无信息公布。

本文介绍了HTTPDNS服务从中心迁移至边缘详细的落地过程。主要围绕HTTPDNS下沉边缘实践遇到的挑战、解决方案，和下沉边缘后的收益展开。

“职”属于你的Offer，中电安科多个岗位热招

过去的一年里，针对关键国家基础设施（CNI）组织进行的勒索软件攻击所带来的相关成本呈现出显著增长的趋势。

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. This vulnerability is handled as CVE-2024-7580. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. It is recommended to apply restrictive firewalling.

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. This vulnerability is known as CVE-2024-7579. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. It is recommended to apply restrictive firewalling.

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. This vulnerability is traded as CVE-2024-7578. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. It is recommended to apply restrictive firewalling.

A vulnerability was found in File Upload Plugin up to 4.24.7 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2024-6494. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

谷歌已修复 Android 设备中一个可能“受到有限、有针对性利用”的“高严重性”漏洞。 谷歌在周一的公告中表示，该漏洞编号为CVE-2024-36971，影响 Linux 内核——操作系统的核心组件，是软件和计算机物理硬件之间的桥梁。 谷歌表示，该漏洞允许黑客在受影响的设备上远程执行代码。该公司尚未提供有关具体攻击以及幕后威胁者的任何详细信息。 为了成功利用该漏洞，攻击者需要拥有系统级权限，即最高级别的访问权限。 谷歌 8 月份的补丁共修复了 47 个漏洞，包括 Arm、Imagination Technologies、联发科和高通组件中的漏洞。其中大多数漏洞被评为“高严重性”。 新的 Android 0day漏洞是由 Google 威胁分析小组的 Clement Lecigne 发现的。他之前主要报道间谍攻击中利用的0day漏洞。 今年早些时候，谷歌的研究人员警告称，0day漏洞已变得越来越普遍，因为国家黑客和网络犯罪分子已经找到了实施攻击的复杂方法。 谷歌在 3 月份的一份报告中表示，它观察到 2023 年有 97 个0day漏洞被利用，而 2022 年只有 62 个，增长了 50%。其中 48 个漏洞归因于间谍行为者，其余 49 个漏洞归因于以经济为目的的黑客。   转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/K-H7sGAjR_4u_iScnfRYOw 封面来源于网络，如有侵权请联系删除