Aggregator

A vulnerability was found in Oracle Solaris 10. It has been declared as critical. This vulnerability affects unknown code of the component Common Desktop Environment. The manipulation leads to improper access controls. This vulnerability was named CVE-2017-3622. Attacking locally is a requirement. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in WordPress up to 6.2.0. This issue affects some unknown processing. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2023-2745. Access to the local network is required for this attack. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

WhatsApp has announced the rollout of its new “Advanced Chat Privacy” feature, designed to give users greater control over the confidentiality of their conversations. Building on its foundation of end-to-end encryption, which ensures that only the sender and recipient can access messages, this latest update introduces a powerful tool to prevent sensitive content from being […]

The post WhatsApp’s New Advanced Chat Privacy Feature to Protect Sensitive Conversations appeared first on Cyber Security News.

HackerNews 编译，转载请注明出处： 自2025年3月初以来，多个疑似与俄罗斯有关的威胁组织针对与乌克兰及人权事务相关的个人和机构发动攻击，旨在非法入侵Microsoft 365账户。Volexity指出，此类高度定向的攻击已从此前利用设备代码钓鱼技术的攻击方式转向新策略，表明相关威胁组织正在积极改进其攻击手法。 安全研究人员Charlie Gardner、Josh Duke、Matthew Meltzer、Sean Koessel、Steven Adair和Tom Lancaster在详尽分析中表示：“近期观测到的攻击严重依赖与目标的点对点互动，攻击者必须说服目标点击链接并回传微软生成的验证码。”目前至少有两个追踪编号为UTA0352和UTA0355的威胁集群被认定参与攻击，但尚未排除其与APT29、UTA0304和UTA0307存在关联的可能性。 最新攻击的特征在于滥用合法的Microsoft OAuth 2.0身份验证工作流程。攻击者冒充欧洲多国官员，并至少在一次案例中利用被入侵的乌克兰政府账户诱骗受害者提供微软生成的OAuth代码以控制其账户。攻击者通过Signal和WhatsApp等即时通讯软件联系目标，邀请其参加与欧洲政要的视频通话或注册涉及乌克兰事务的私人会议，最终诱导受害者点击托管在Microsoft 365基础设施上的链接。 Volexity表示：“若目标回应信息，对话将迅速推进至实际安排会议时间。当约定时间临近时，伪装成欧洲政要的攻击者会再次联系目标，发送会议加入指引。”这些指引以文档形式呈现，随后攻击者发送会议链接。所有URL均重定向至Microsoft 365官方登录门户。 具体而言，攻击者设计的链接会重定向至微软官方URL并在过程中生成微软授权令牌，该令牌将出现在URI或重定向页面正文中。攻击随后试图诱骗受害者与攻击者共享该代码。这是通过将已认证用户重定向至浏览器版Visual Studio Code（insiders.vscode[.]dev）实现的，令牌将在此界面显示给用户。若受害者分享OAuth代码，UTA0352将生成访问令牌以最终控制受害者M365账户。 Volexity还观测到该活动的早期版本会将用户重定向至“vscode-redirect.azurewebsites[.]net”网站，该网站再次重定向至本地IP地址（127.0.0.1）。研究人员解释称：“此时授权码仅存在于URL中，用户浏览器会显示空白页面。攻击者必须要求用户分享浏览器URL才能获取代码。” 2025年4月初发现的另一社交工程攻击涉及UTA0355使用已入侵的乌克兰政府电子邮箱向目标发送钓鱼邮件，随后通过Signal和WhatsApp发送信息。这些信息邀请目标参加关于乌克兰“暴行罪”起诉及国际合作投资的视频会议。尽管最终目标与UTA0352相同，但存在关键差异：攻击者滥用微软365认证API获取受害者邮件数据，并将窃取的OAuth授权码用于在受害者Microsoft Entra ID（原Azure Active Directory）永久注册新设备。 攻击者随后发起第二轮社交工程以说服目标批准双重认证请求并劫持账户。Volexity指出：“在此次互动中，UTA0355要求受害者批准双重认证（2FA）请求以‘访问与会议关联的SharePoint实例’，此举旨在绕过受害者组织设置的额外安全要求以访问其邮箱。”该攻击的特别有效性体现在：登录活动、邮件访问及设备注册均通过地理位置与受害者匹配的代理网络进行，大幅增加检测难度。 为应对此类攻击，建议组织审计新注册设备、培训用户警惕即时通讯平台上的非主动联络，并实施条件访问策略限制仅允许受审批/管理设备访问组织资源。Volexity补充道：“近期攻击活动完全利用微软官方基础设施进行用户交互，未使用攻击者自托管设施。同时，攻击不涉及需用户显式授权的恶意OAuth应用（此类应用可被组织轻松拦截）。已获许可的微软原生应用使用使得该技术的预防与检测极为困难。”       消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络；  转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability classified as critical was found in Itd-inc bingo!CMS up to 1.7.4.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper authentication. This vulnerability is known as CVE-2022-42458. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability has been found in Book Store Management System 1.0.0 and classified as problematic. This vulnerability affects unknown code of the component Add New System User Module. The manipulation of the argument Level leads to cross site scripting. This vulnerability was named CVE-2022-45217. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Google Go on Windows. It has been declared as critical. Affected by this vulnerability is the function os.DirFS/http.Dir. The manipulation leads to pathname traversal. This vulnerability is known as CVE-2022-41720. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability was found in oretnom23 Sanitization Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /php-sms/admin/?page=services/view_service. The manipulation of the argument ID leads to sql injection. This vulnerability is handled as CVE-2022-44393. The attack can only be done within the local network. There is no exploit available.

A vulnerability classified as problematic has been found in labstack echo on Windows. This affects an unknown part of the component Static File Handler. The manipulation leads to pathname traversal. This vulnerability is uniquely identified as CVE-2020-36565. The attack can only be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical was found in hope-boot 1.0.0. This vulnerability affects unknown code. The manipulation leads to deserialization. This vulnerability was named CVE-2022-44371. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in ZZCMS 2022. This issue affects some unknown processing of the file admin/ad_list.php. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2022-44361. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Zorlan Skycaiji 2.5.1. It has been rated as critical. This issue affects some unknown processing of the file /SkycaijiApp/admin/controller/Mystore.php. The manipulation leads to deserialization. The identification of this vulnerability is CVE-2022-44351. The attack needs to be done within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, was found in qubes-mirage-firewall up to 0.8.3. This affects an unknown part of the component Multicast UDP Packet Handler. The manipulation leads to resource consumption. This vulnerability is uniquely identified as CVE-2022-46770. The attack needs to be approached within the local network. Furthermore, there is an exploit available.

A vulnerability was found in TRENDnet Wireless AC Easy-Upgrader TEW-820AP 1.0R. It has been classified as critical. Affected is an unknown function. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2022-44373. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in AyaCMS 3.1.2. This issue affects some unknown processing. The manipulation leads to injection. The identification of this vulnerability is CVE-2022-45550. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Oracle Communications Unified Assurance up to 5.5.9/6.0.1. It has been classified as critical. Affected is an unknown function of the component Core. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2022-41720. It is possible to launch the attack remotely. There is no exploit available.

A significant security vulnerability (CVE-2025-34028) has been discovered in Commvault Command Center Innovation Release, enabling unauthenticated attackers to execute arbitrary code remotely. The vulnerability, which carries a high CVSS score of 9.0, affects explicitly version 11.38 of the Command Center installation and could lead to complete system compromise if exploited. Security researchers have identified a […]

The post Critical Commvault RCE Vulnerability Lets Remote Attackers Execute Arbitrary Code appeared first on Cyber Security News.

玩过《我的世界》的同学都知道，钻石是这款游戏中最稀有的物品之一，产量低，找寻复杂，即使准备充分，玩家更多的时候也得靠运气。

在搜索引擎中搜索“我的世界如何快速找到钻石”，会发现有1000万+的内容量，可见“找钻石”应该算是《我的世界》玩家的头号大事了。

原文链接：https://mp.weixin.qq.com/s/lca68xYc20MwTQLMQ2dSew

这个月，多伦多大学举办了一场特别活动，邀请2024年诺贝尔物理学奖得主、被称为"AI教父"的杰弗里·辛顿（Geoffrey Hinton）大学荣誉教授与即将上任的校长梅兰妮·伍登（Melanie Wooden）进行了一场对话。

原文链接：https://mp.weixin.qq.com/s/PXScqqCxhMT8Zkw5P1Bh_w

HackerNews 编译，转载请注明出处： 与伊朗有关联的威胁组织UNC2428在2024年10月针对以色列发起以招聘为主题的社会工程攻击，其通过部署名为MURKYTOUR的后门实施网络间谍活动。 谷歌旗下Mandiant公司将UNC2428称为与伊朗结盟的威胁组织，该组织通过“复杂的欺骗技术链”部署恶意软件。 根据Mandiant 2025年度《M-Trends报告》，UNC2428伪装成以色列国防承包商拉斐尔（Rafael）的招聘方，诱导目标用户访问仿冒网站并下载所谓的“求职辅助工具”。 该工具（“RafaelConnect.exe”）实为LONEFLEET安装程序，启动后会向受害者展示图形用户界面（GUI），要求输入个人信息并提交简历。一旦用户提交信息，LEAFPILE启动器将在后台激活MURKYTOUR后门，使攻击者获得对受感染设备的持续访问权限。 Mandiant指出：“伊朗相关威胁组织通过图形用户界面将恶意软件伪装成合法应用。这类仿冒安装程序的界面设计能有效降低目标用户的怀疑”。 此活动与以色列国家网络局归因于伊朗威胁组织黑影（Black Shadow）的攻击存在重叠，后者受伊朗情报和安全部（MOIS）支持，以攻击以色列学术、旅游、通信、金融等多领域而闻名。 2024年，多个伊朗威胁组织瞄准以色列，包括使用专有擦除器POKYBLIGHT的Cyber Toufan组织。 另一组织UNC3313通过钓鱼攻击进行监视和信息收集，其攻击手段包括在文件共享平台托管恶意软件，并嵌入以培训和网络研讨会为主题的钓鱼链接。UNC3313还分发JELLYBEAN投放器和CANDYBOX后门，并滥用9种合法远程监控工具（RMM）规避检测。 2024年7月，疑似伊朗背景的攻击者伪装成Palo Alto Networks的GlobalProtect远程访问软件安装包，暗中部署.NET后门CACTUSPAL。该后门启动后验证进程唯一性，随后与外部C2服务器通信。 伊朗威胁组织如UNC1549还通过云基础设施增强隐蔽性，例如利用拼写错误域名（Typosquatting）或复用合法域名托管C2节点。APT42（又名Charming Kitten）则通过伪造谷歌、微软、雅虎登录页面窃取凭证，并利用Google Sites和Dropbox引导目标访问虚假Google Meet页面。 2024年，Mandiant在中东攻击活动中识别出20余种伊朗组织专用恶意软件家族，包括APT34（OilRig）用于攻击伊拉克政府实体的DODGYLAFFA和SPAREPRIZE后门。该公司警告：“伊朗相关威胁组织将持续调整战术手段以适应当前形势。”     消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络；  转载请注明“转自 HackerNews.cc”并附上原文