Aggregator

A vulnerability was found in Dream Carousel Plugin up to 1.0.1b on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-13331. The attack can be launched remotely. There is no exploit available.

Intelから各製品向けのアップデートが公開されました。

Пока военные укрепляют границы, хакеры проникают через цифровые щели.

LastPass has announced the general availability of SaaS Monitoring. This new capability empowers organizations of all sizes to gain visibility into their Software-as-a-Service ecosystem, reduce risk from Shadow IT and Shadow AI, and optimize costs.

The post LastPass launches SaaS Monitoring to reduce shadow IT and AI risks appeared first on Help Net Security.

ABBが提供するAutomation Builderには、複数の脆弱性が存在します。

关于虚假和错误信息在社交平台（SNS）上传播并成为社会问题一事，日本总务省公布了首次实际情况调查的结果。在实际存在 15 种虚假信息中，有 47.7% 的受访者表示看过或听过其中的一种内容并误以为是“真相”。调查就“众多沙丁鱼和鲸鱼被冲上岸是地震的前兆或影响”等虚假信息实施了调查。此外还获悉，接触到这些信息的四个人中有一个会告诉家人朋友，或者发布在社交平台上，使虚假信息扩散开来。关于传播虚假信息的理由，位列第一的是“内容令人震惊”，占到27.1%。此外，“觉得有趣”、“觉得对别人有用”等回答也超过了20%。

美国商务部撤回了拜登政府最后制定的 AI 芯片出口限制政策《Artificial Intelligence Diffusion Rule》，该政策原计划于 5 月 15 日生效，它将各个国家划分为 3 个梯队，对包括中俄在内的第三梯队（Tier-3）国家实施更严格的出口管控。特朗普政府尚未确定替代方案，只是表示可能会转向按国家进行的谈判，它公布了临时规定，警告企业不要使用华为昇腾（Ascend）AI 芯片，警告允许美国芯片在中国训练 AI 模型会面临后果。

Resilience launched Cyber Risk Calculator to provide organizations with a financial snapshot of their cyber risk. The AI-powered tool provides security and risk practitioners and C-Suite executives alike with a data-driven language to better understand and quantify their cyber risk. The Cyber Risk Calculator uses industry benchmarks to help stakeholders understand their risk exposure and potential financial losses due to cyber-related incidents. Existing strategies for understanding cyber risk, such as heat maps, focus on vague ratings … More →

The post Resilience helps businesses understand their cyber risk in financial terms appeared first on Help Net Security.

Microsoft Researchers Link Turkish Spy Group to Output Messenger Zero-Day Hack
A Turkish-linked cyberespionage group known as Marbled Dust exploited a zero-day in the Output Messenger Server Manager application to spy on Kurdish military operations in Iraq. Microsoft reported the hack and called for immediate mitigation to block credential theft and malware delivery.

Prosecutors Say Liridon Masurica Ran BlackDB.cc
A Kosovar man is being held in a Tampa jail after being extradited on charges that he was the main administrator of an online illicit marketplace in operation since 2018. Prosecutors accused Liridon Masurica, 33, of being the force behind BlackDB.cc.

CEO Howard Ting's Resignation Comes as Data Protection Company Hits $1B Valuation
Cyberhaven appointed product chief Nishant Doshi as interim CEO as longtime leader Howard Ting transitions to the board. With a sevenfold valuation increase and deep investment in Gen AI security and DSPM, the company is preparing to unify data controls across enterprises.

CISA Said Its Cyber Alerts Were Moving to X on Monday. By Tuesday, the Plan Changed.
The U.S. cyber defense agency reversed plans to move cybersecurity alerts off its .gov site Tuesday and acknowledged the "confusion" the decision caused within the cybersecurity community, amid concerns that relying on platforms like X would reduce visibility and public access to critical warnings.

讨论了生成式人工智能 (GenAI) 的安全理论与实践。 文章指出，尽管 GenAI 发展迅速，但新的安全威胁（如提示注入和越狱）也在不断涌现，使得传统的缓解技术难以应对。 文章强调了紧跟不断变化的监管环境以及制定健全的政策、实践和治理措施的必要性，正如 ChatGPT 曾因隐私问题在意大利被禁所凸显的那样。 文章还深入探讨了 GenAI 的基础概念，例如神经网络、深度学习、Transformer 和扩散模型，并介绍了 GenAI 安全的各个方面，包括数据安全、模型安全、应用程序安全以及如何利用 GenAI 工具来增强安全态势。 最后，文章强调，鉴于 GenAI 带来的巨大影响，GenAI 的安全性不再是事后才考虑的问题， 并为所有利益相关者（从学生到首席执行官）提供了构建安全基础的及时指导。 大家好，今天我们来聊聊生成式人工智能，也就是 GenAI。你可能已经用过，感觉挺强大的；但是安全问题层出不穷——比如提示注入（prompt injection）、越狱攻击，甚至之前 ChatGPT 在意大利因为隐私问题被禁过一阵子。防不胜防，简直像在玩打地鼠。 ⸻ 这次深入探讨的内容来自一本很及时的书——《生成式人工智能安全：理论与实践》。书里汇集了许多顶尖专家的观点：有来自香港科技大学的学者，也有业界人士，比如 Singularity Net、环球音乐，还有 TWIS 金融等公司。一群人共同讨论，如何为 GenAI 生态的未来打下更安全的基础。我们的目标就是帮你梳理书中提到的核心挑战和关键策略——因为安全早已不是事后再考虑的问题，新攻击方法一个接一个地冒出来，传统防火墙、杀毒软件往往跟不上。 ⸻ 一、挑战概览 1. 黑箱模型难以观测 许多大模型本身像个黑箱，可观测性不足——看不透就很难预测和防范潜在风险。这也让模型容易受到对抗性攻击：攻击者用精心设计的输入（提示词），就可能让模型说出不该说的内容或生成有害信息，甚至泄露数据。 现在市面上已经出现一些专门“干坏事”的 AI 工具，如 EvilGPT、WormGPT，用来做网络钓鱼或诈骗，可见形势严峻。 2. 法规与伦理多头并进 安全不仅是技术层面，还牵涉数据隐私与伦理。全球监管变化很快：欧盟《AI 法案》推行分级风险管理；美国更关注竞争与版权问题。到底怎样系统应对，成了核心难题。 ⸻ 二、书中提出的多层次策略 1. 技术架构认知 必须先理解模型核心架构——如 Transformer 的自注意力机制（self‑attention）。理解原理才能发现潜在弱点。 2. 治理与合规 • 制定清晰的安全政策，强调透明度、数据隐私保护并遵守法规。 • 可借鉴 NIST AI 风险管理框架（AI‑RMF）、MITRE ATLAS（分析 AI 攻击策略）、以及 OWASP Top 10 for LLM 等最佳实践。 3. 数据安全“三难困境” 数据是训练 AI 的燃料，也是风险源： • 数据收集：是否合法合规？ • 偏见控制：采集和处理过程是否引入偏见？ • 隐私‑效用‑安全平衡：尤其在向量数据库中处理个人身份信息（PII）时，传统加密/匿名化手段面临新挑战。 4. 模型本体防护 除了防已知攻击（模型反演、成员推断），还要提升健壮性和可解释性。前沿做法包括： • 用去中心化技术（如区块链）增强模型完整性、防止篡改； • 采用 RLHF/RLAIF（人类反馈强化学习）让模型行为更符合预期和价值观。 5. 开发与运维（LLMOps / DevSecOps） • LLMOps 用于管理大语言模型的全生命周期； • Shift Left：在开发早期就把安全纳入； • Prompt Engineering 也要考虑安全——如利用 “chain‑of‑thought” 引导模型分步思考，既要效果好，也要压低风险。 ⸻ 三、可用工具示例 • 应用安全测试：BB‑GPT、GitHub Advanced Security • 隐私与交互防护：LlamaGuard、Private GPT、Nemo Guardrails • 威胁检测与响应：Microsoft Security Copilot、Google Duet AI • 治理与合规：Titanium、CopyLeaks 用 AI 来保护 AI，正成为显著趋势——有点“以魔法对抗魔法”的味道。 ⸻ 四、系统工程与跨域协作 保障 GenAI 安全是一项复杂且动态变化的系统工程，涉及技术、策略、流程与人： • 不再是单纯的 IT 部门问题，而与企业生计、法律合规、战略发展直接相关； • 需要跨部门协作和全球范围的沟通协调。 ⸻ 五、值得思考的新概念：Machine Unlearning 书里最后提到“机器遗忘 （Machine Unlearning）”——让 AI 模型有选择地忘掉已学到的某些信息。如果这项技术成熟，可能带来意想不到的好处，也可能引入新的风险：让 AI 学会遗忘，本身就颇具哲学意味，值得持续关注和思考。

Кто ответственен за слив и как защитить свой аккаунт?

A vulnerability, which was classified as problematic, has been found in Floorsight Insights Q3 2023. Affected by this issue is some unknown functionality of the component Order/Invoice Pages. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2023-45892. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Liferay Portal and DXP. Affected by this issue is some unknown functionality of the component Search Result App. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-25145. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Liferay Portal and DXP. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to observable response discrepancy. The identification of this vulnerability is CVE-2024-25146. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apache Linkis Metadata Query Service JDBC 1.5.x/1.6.x. It has been declared as problematic. This vulnerability affects unknown code of the component JDBC Datasource Module. The manipulation leads to information disclosure. This vulnerability was named CVE-2024-45627. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in WC Affiliate Plugin up to 2.3.9 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-12321. It is possible to launch the attack remotely. There is no exploit available.