Aggregator

之前的文章中曾为大家简单介绍过线上代码审计平台ssa，为大家详细介绍一下如何用ssa进行PHP的代码审计。

Обновления породили нового троянского коня для Microsoft.

A vulnerability classified as problematic has been found in activesupport Gem on Ruby. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2023-28120. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability has been found in Kredis Gem up to 1.3.0.0 on Ruby and classified as problematic. This vulnerability affects unknown code. The manipulation leads to deserialization. This vulnerability was named CVE-2023-27531. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Drupal Coffee up to 1.3.x. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-13247. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Drupal CKEditor 4 LTS up to 1.0.0. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-13245. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Node.js 18.x/20.x/21.x on Windows. This vulnerability affects the function child_process.spawn. The manipulation of the argument args leads to os command injection. This vulnerability was named CVE-2024-27980. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Rack Gem on Ruby. It has been rated as problematic. This issue affects some unknown processing of the component Header Parser. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2023-27539. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

通告编号:NS-2025-00012025-01-10TAG：Ivanti、缓冲区溢出、CVE-2025-0282漏洞危害：攻击者利用此漏洞，可实现任意代码执行版本：1.01漏洞概述近日，绿盟科技

近日，绿盟科技监测到Ivanti发布安全公告，修复了Ivanti多款产品缓冲区溢出漏洞(CVE-2025-0282)。CVSS评分9.0，目前已发现在野利用，请相关用户尽快采取措施进行防护。

Консерваторы хотят раскрыть личности википедистов за антисемитские правки.

China-linked APT group MirrorFace targets JapanJapanese authori

Japanese authorities attributed a cyber-espionage campaign targeting the country to the China-linked APT group MirrorFace. The National Police Agency (NPA) and the Cabinet Cyber Security Center in Japan have linked a long-running cyber-espionage campaign targeting local entities to the China-linked group MirrorFace (aka Earth Kasha). The campaign has been active since at least 2019, it […]

JAMA Pediatrics 发表的一项研究回顾了在加拿大、中国和印度等 10 个国家进行的 74 项关于氟化物暴露和儿童智商的研究，并将这些研究中的数据进行整合分析。分析指出，有 59 项研究显示，与低氟化物暴露组相比，高氟化物暴露组儿童的智商分数显著较低。有 31 项研究发现，暴露组和对照组之间存在剂量-反应关联。当水中氟化物剂量小于4mg/L和2mg/L，都能发现氟化物剂量越高，儿童智商越低。而当剂量小于1.5mg/L时，剂量-反应关联消失，但不能排除氟暴露本身的影响。还有 13 项个体水平的研究发现，儿童尿液中氟化物每增加 1 mg/L，智商分数下降 1.63 分。

CrowdStrike, a leader in cybersecurity, uncovered a sophisticated phishing campaign that leverages its recruitment branding to propagate malware disguised as an “employee CRM application.” This alarming attack vector begins with a fraudulent email impersonating CrowdStrike’s hiring team, coaxing recipients into visiting a malicious website. Once there, victims are unwittingly prompted to download and execute a […]

The post Beware! Fake Crowdstrike Recruitment Emails Spread Cryptominer Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Криптокошельки и пароли оказались под прицелом нового вредоноса.

环境异常 当前环境异常，完成验证后即可继续访问。 去验证