Aggregator

近期，针对广大人民群众反映强烈的App未公开收集使用规则、未按法律规定提供删除或更正个人信息功能等问题，国家网信办依法依规查处“开个密室馆”等82款违法违规App（含小程序）。

勒索威胁新年抬头，500余政企机构受害严重

Хакеры нанесли двойной удар по госучреждению страны.

Hudson Rock has found evidence that infostealers have compromised hundreds of US military and defense contractor credentials

A vulnerability was found in Paypal Currency Converter Basic Plugin up to 1.3 on WordPress and classified as critical. Affected by this issue is some unknown functionality of the file proxy.php. The manipulation of the argument requrl leads to path traversal. This vulnerability is handled as CVE-2015-5065. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. This vulnerability was named CVE-2025-1447. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing of the file 9-12ping.php. The manipulation of the argument retry leads to command injection. The identification of this vulnerability is CVE-2025-1448. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. It is recommended to apply restrictive firewalling. The vendor was contacted early about this disclosure but did not respond in any way.

作者：DARKNAVY 原文链接：https://mp.weixin.qq.com/s/Ockx4fnrvLvqDXiwiIJNzA 2023年是生成式AI和大型语言模型的元年，它们以前所未有的方式输出内容。 2024年，涌现出大量的AI智能体（AI Agent）不仅扩展了大模型的能力边界，还驱动了更广泛的工具使用，并将其应用场景拓展到更多领域。 对于安全研究者而言，如何借助AI力量的提高工...

Valve 更新了 Source SDK，加入了《团队要塞2》(Team Fortress 2 或 TF2)客户端和服务器端代码。Valve 称这次更新允许内容创作者在《团队要塞2》基础上构建全新的游戏。SDK 让 Mod 作者能修改、扩展或重写 TF2。SDK 以非商业方式授权给用户，意味着使用 SDK 创建的任何 Mod 都必须免费，且 Mod 中的任何内容都必须免费。TF2 Mod 可在 Steam 商店发布。Valve 没有开源《团队要塞2》使用的 Source 引擎，只是 SDK。

Users who are on the lookout for popular games were lured into downloading trojanized installers that led to the deployment of a cryptocurrency miner on compromised Windows hosts. The large-scale activity has been codenamed StaryDobry by Russian cybersecurity company Kaspersky, which first detected it on December 31, 2024. It lasted for a month. Targets of the campaign include individuals and

实验室首部教材《移动安全》正式出版！欢迎广大读者关注与阅读，期待您的反馈。

实验室首部教材《移动安全》正式出版！欢迎广大读者关注与阅读，期待您的反馈。

Edge Delta announced its Security Data Pipelines. This solution empowers security teams to process, analyze, and act on security data faster and more efficiently than ever before. By enabling real-time data processing and enrichment, Edge Delta’s Security Data Pipelines transform how organizations detect, respond to, and mitigate security threats across complex environments. The Security Data Pipelines provide a foundational, scalable framework for standardizing, enriching, and streaming security data from a wide array of data sources … More →

The post Edge Delta Security Data Pipelines mitigates security threats appeared first on Help Net Security.

A vulnerability was found in Microsoft Windows 2000. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Hardware Breakpoint Handler. The manipulation leads to improper privilege management. This vulnerability is handled as CVE-2001-1347. It is possible to launch the attack on the local host. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Tungsten Automation Power. It has been rated as critical. Affected by this issue is some unknown functionality of the component JP2 File Parser. The manipulation leads to out-of-bounds read. This vulnerability is handled as CVE-2024-12551. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as very critical was found in Logsign Unified SecOps Platform. This vulnerability affects unknown code. The manipulation leads to improper authentication. This vulnerability was named CVE-2025-1044. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Mintty 3.4.5/3.4.7/3.6.3. This issue affects some unknown processing of the component Sixel Image Parser. The manipulation leads to heap-based buffer overflow. The identification of this vulnerability is CVE-2025-1052. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in ahmadmj Majestic Support Plugin up to 1.0.5 on WordPress. Affected by this vulnerability is an unknown functionality of the component Object Reference Handler. The manipulation leads to authorization bypass. This vulnerability is known as CVE-2024-13601. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in LCweb Global Gallery Plugin up to 9.1.5 on WordPress. It has been classified as problematic. This affects an unknown part of the component Shortcode Handler. The manipulation leads to code injection. This vulnerability is uniquely identified as CVE-2024-13814. It is possible to initiate the attack remotely. There is no exploit available.