Aggregator

「智效融合，安全护航」第七期“度安讲”技术沙龙即将同大家见面。本期「度安讲」技术沙龙将于11月20日在深圳召开，诚邀您出席主题演讲环节/拨冗参会。在本次沙龙中，我们聚焦企业智能化工程效能探索及其安全能

WhoYouCalling Monitors network activity made by a process through the use of Windows Event Tracing (ETW) and Full Packet Capture (FPC). Filters a generated .pcap file with BPF based on the detected network activity made by...

The post WhoYouCalling: Effortless Process Network Monitoring with ETW and BPF appeared first on Penetration Testing Tools.

sslscan sslscan tests SSL/TLS-enabled services to discover supported cipher suites. This is a fork of ioerror’s version of sslscan. Changes are as follows: Highlight SSLv2 and SSLv3 ciphers in output. Highlight CBC ciphers on SSLv3 (POODLE). Highlight...

The post sslscan: tests SSL/TLS enabled services to discover supported cipher suites appeared first on Penetration Testing Tools.

Bopscrk Bopscrk (Before Outset PaSsword CRacKing) is a tool to generate smart and powerful wordlists. Included in BlackArch Linux pentesting distribution and Rawsec’s Cybersecurity Inventory since August 2019.   The first idea was inspired by Cupp and Crunch. We could say...

The post bopscrk: generate smart and powerful wordlists appeared first on Penetration Testing Tools.

The traditional CIA Triad (Confidentiality, Integrity, and Availability) has long been a corne

本文 11075字   阅读约需 28分钟近日，奇安信集团发布《政务大模型安全治理框架》，从政务大模型的应用趋势、安全风险、治理框架及管控措施四个方面，详细阐述了政务大模型安全治理方法。概要政务大模型

Understanding the Impact of Security on the Business Makes You More Effective
With cybersecurity now embedded across all industries and functions, the importance of aligning security measures with business objectives has never been greater. Here’s why being business savvy is crucial in cybersecurity - and how you can cultivate it to become a more effective professional.

NY AG Action and $1M Fine Follow Back-to-Back Hacks That Affected 224,500 in 2023
An upstate New York-based medical practice must spend $2.25 million to improve its data security practices over the next five years, plus pay state regulators up to a $1 million fine following an investigation into two ransomware attacks days apart in 2023 that affected nearly 224,500 people.

United States’ Top Cyber Defense Agency Mobilizes Nationwide Election Support Hub
The director of the Cybersecurity and Infrastructure Security Agency said Wednesday the agency is establishing an election operations room to help counter foreign interference and support state officials amid escalating cyber and physical threats to the 2024 vote.

Insight Partners-Led Round Boosts US Growth, Fuels Threat Intelligence for Filigran
Filigran’s $35 million Series B funding, led by Insight Partners, positions the company to scale its threat intelligence and proactive security capabilities while expanding its U.S. footprint. Plans include doubling the engineering team and strengthening breach and attack simulation capabilities.

The latest FakeCall malware version for Android intercepts outgoing bank calls, redirecting them to attackers to steal sensitive info and bank funds. Zimperium researchers spotted a new version of the FakeCall malware for Android that hijacks outgoing victims’ calls and redirects them to the attacker’s phone number. The malware allows operators to steal bank users’ […]

A vulnerability was found in Google Chrome. It has been declared as problematic. This vulnerability affects unknown code of the component V8. The manipulation leads to out-of-bounds read. This vulnerability was named CVE-2024-2884. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Google Chrome and classified as problematic. Affected by this issue is some unknown functionality of the component FedCM. The manipulation leads to Privilege Escalation. This vulnerability is handled as CVE-2024-6999. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in libcURL. This affects the function GTime2str of the component ASN1 Parser. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2024-7264. Access to the local network is required for this attack. There is no exploit available.

A vulnerability was found in Mozilla Firefox up to 128. It has been classified as problematic. This affects the function PK11_Encrypt of the component NSS. The manipulation leads to missing encryption of sensitive data. This vulnerability is uniquely identified as CVE-2024-7531. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in AMD Radeon RX 6000 Graphics Cards and Radeon PRO W6000 Graphics Cards and classified as problematic. Affected by this issue is some unknown functionality of the component PMFW. The manipulation leads to use of hard-coded cryptographic key . This vulnerability is handled as CVE-2023-20512. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in AMD EPYC 7003 Processors and EPYC 9004 Processors. It has been classified as critical. This affects an unknown part of the component SEV Firmware. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2023-31356. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Huizhi Enterprise Resource Management System up to 1.0. This affects an unknown part of the file /nssys/common/filehandle. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-42677. Local access is required to approach this attack. There is no exploit available.

A vulnerability, which was classified as critical, was found in GNCC GC2 Indoor Security Camera. Affected is an unknown function. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2024-31800. It is possible to launch the attack on the physical device. There is no exploit available.

A vulnerability was found in Linux Kernel up to 6.1.102/6.6.43/6.10.2. It has been classified as critical. This affects the function page_pool_destroy of the component xdp. The manipulation leads to improper update of reference count. This vulnerability is uniquely identified as CVE-2024-43834. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.