Aggregator

介绍Lockpass 是一款密码管理工具，是作者参考1password做的，目前功能尚不完善，作者会在使用过程中不断优化。软件采用双密码机制，主密码和25字符的key(软件生成）组合成超强密码。...

A vulnerability was found in Great Circle Associates Majordomo 1.94.4. It has been classified as problematic. Affected is an unknown function of the component resend Command Handler. The manipulation as part of Metacharacter leads to improper privilege management. This vulnerability is traded as CVE-2000-0035. Attacking locally is a requirement. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in QNX RTOS 4.25/6.1.0. This vulnerability affects unknown code of the component ptrace. The manipulation leads to memory corruption. This vulnerability was named CVE-2002-2042. It is possible to launch the attack on the local host. Furthermore, there is an exploit available.

7 Тб/с: MSK-IX фиксирует рекордные показатели за год.

投入少量资源，解决了高危WEB应用服务识别的问题

A vulnerability was found in Dell EMC NetWorker up to 8.2.4.10/9.0.x/9.1.1.5/9.2.1.0 and classified as critical. Affected by this issue is some unknown functionality of the component nsrd. The manipulation as part of Messages leads to memory corruption. This vulnerability is handled as CVE-2018-1218. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Искусственный интеллект стал главным оружием северокорейских аферистов.

U.S. officials are pushing back at the ongoing threats posted by Chinese state-sponsored hackers like Volt Typhoon and Salt Typhoon, which have infiltrated critical infrastructure organizations to steal information and preposition themselves in case of a conflict breaking out between the two countries.

The post The Cyberthreats from China are Ongoing: U.S. Officials appeared first on Security Boulevard.

Google’s threat intelligence team uncovered four Chinese PR firms operating networks of inauthentic news sites

A vulnerability classified as problematic was found in SpringSource Hyperic HQ up to 4.0.2. Affected by this vulnerability is an unknown functionality. The manipulation of the argument Description leads to cross site scripting. This vulnerability is known as CVE-2009-2898. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

IF 共创，就是现在！

来创新大会 2025，身份逆转，就是现在！

АБР предложила новый подход к внедрению валюты.

A vulnerability, which was classified as critical, has been found in Linux Kernel 2.4.0/2.4.1/2.4.2/2.4.3. This issue affects the function ip_conntrack_ftp of the component iptables. The manipulation leads to improper privilege management. The identification of this vulnerability is CVE-2001-0405. The attack may be initiated remotely. Furthermore, there is an exploit available. Due to its background and reception, this vulnerability has an historic impact. It is recommended to upgrade the affected component.

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

• CVE-2023-28461 Array Networks AG and vxAG ArrayOS Improper Authentication Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute malicious JavaScript and send crafted requests to interconnected Microsoft applications like Outlook, OneDrive, and Copilot. The exploit leveraged the trust placed in Bing’s root domain (www.bing.com) as an allowed origin across Microsoft’s ecosystem, posing a significant security risk. The Research […]

The post XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability classified as critical was found in Red Hat Ansible. This vulnerability affects unknown code of the component User Module. The manipulation leads to improper authorization. This vulnerability was named CVE-2024-9902. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Chromium libvpx up to 1.14.0. It has been rated as critical. Affected by this issue is the function vpx_img_alloc. The manipulation of the argument d_w/d_h/align leads to integer overflow. This vulnerability is handled as CVE-2024-5197. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in TianoCore EDK2 up to edk2-stable202405. This affects the function PeCoffLoaderRelocateImage. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-38796. The attack can only be done within the local network. There is no exploit available.