Aggregator

The traditional CIA Triad (Confidentiality, Integrity, and Availability) has long been a corne

本文 11075字   阅读约需 28分钟近日，奇安信集团发布《政务大模型安全治理框架》，从政务大模型的应用趋势、安全风险、治理框架及管控措施四个方面，详细阐述了政务大模型安全治理方法。概要政务大模型

Understanding the Impact of Security on the Business Makes You More Effective
With cybersecurity now embedded across all industries and functions, the importance of aligning security measures with business objectives has never been greater. Here’s why being business savvy is crucial in cybersecurity - and how you can cultivate it to become a more effective professional.

NY AG Action and $1M Fine Follow Back-to-Back Hacks That Affected 224,500 in 2023
An upstate New York-based medical practice must spend $2.25 million to improve its data security practices over the next five years, plus pay state regulators up to a $1 million fine following an investigation into two ransomware attacks days apart in 2023 that affected nearly 224,500 people.

United States’ Top Cyber Defense Agency Mobilizes Nationwide Election Support Hub
The director of the Cybersecurity and Infrastructure Security Agency said Wednesday the agency is establishing an election operations room to help counter foreign interference and support state officials amid escalating cyber and physical threats to the 2024 vote.

Insight Partners-Led Round Boosts US Growth, Fuels Threat Intelligence for Filigran
Filigran’s $35 million Series B funding, led by Insight Partners, positions the company to scale its threat intelligence and proactive security capabilities while expanding its U.S. footprint. Plans include doubling the engineering team and strengthening breach and attack simulation capabilities.

The latest FakeCall malware version for Android intercepts outgoing bank calls, redirecting them to attackers to steal sensitive info and bank funds. Zimperium researchers spotted a new version of the FakeCall malware for Android that hijacks outgoing victims’ calls and redirects them to the attacker’s phone number. The malware allows operators to steal bank users’ […]

A vulnerability was found in Google Chrome. It has been declared as problematic. This vulnerability affects unknown code of the component V8. The manipulation leads to out-of-bounds read. This vulnerability was named CVE-2024-2884. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Google Chrome and classified as problematic. Affected by this issue is some unknown functionality of the component FedCM. The manipulation leads to Privilege Escalation. This vulnerability is handled as CVE-2024-6999. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. This issue affects some unknown processing of the component User Profile Page. The manipulation of the argument first name/middle name/last name leads to cross site scripting. The identification of this vulnerability is CVE-2024-37856. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in libcURL. This affects the function GTime2str of the component ASN1 Parser. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2024-7264. Access to the local network is required for this attack. There is no exploit available.

A vulnerability was found in Mozilla Firefox up to 128. It has been classified as problematic. This affects the function PK11_Encrypt of the component NSS. The manipulation leads to missing encryption of sensitive data. This vulnerability is uniquely identified as CVE-2024-7531. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Mozilla Firefox up to 128 on Android. It has been declared as critical. This vulnerability affects unknown code of the component Select Option Handler. The manipulation leads to improper restriction of rendered ui layers. This vulnerability was named CVE-2024-7523. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in AMD Radeon RX 6000 Graphics Cards and Radeon PRO W6000 Graphics Cards and classified as problematic. Affected by this issue is some unknown functionality of the component PMFW. The manipulation leads to use of hard-coded cryptographic key . This vulnerability is handled as CVE-2023-20512. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in AMD EPYC 7003 Processors and EPYC 9004 Processors. It has been classified as critical. This affects an unknown part of the component SEV Firmware. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2023-31356. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Huizhi Enterprise Resource Management System up to 1.0. This affects an unknown part of the file /nssys/common/filehandle. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-42677. Local access is required to approach this attack. There is no exploit available.

A vulnerability, which was classified as critical, was found in GNCC GC2 Indoor Security Camera. Affected is an unknown function. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2024-31800. It is possible to launch the attack on the physical device. There is no exploit available.

A vulnerability was found in Linux Kernel up to 6.1.102/6.6.43/6.10.2. It has been classified as critical. This affects the function page_pool_destroy of the component xdp. The manipulation leads to improper update of reference count. This vulnerability is uniquely identified as CVE-2024-43834. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.1.102/6.6.43/6.10.2. Affected by this vulnerability is the function sprintf of the component bna. The manipulation of the argument name leads to buffer overflow. This vulnerability is known as CVE-2024-43839. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.10.2 and classified as problematic. Affected by this vulnerability is the function virtnet_poll_tx of the file net/core/skbuff.c. The manipulation leads to Privilege Escalation. This vulnerability is known as CVE-2024-43835. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.