Aggregator

速修复

速修复

揭秘Hunters International勒索软件团伙

2024年9月2日至9月6日，vivo在内部圆满举办了第三届•2024安全与隐私主题周活动。

Масштаб атак охватил уже несколько стран и множество сфер бизнеса.

Endor Labs claims security patches can break underlying open source software 75% of the time

Видеохостинг тестирует новый формат.

CNNVD关于微软多个安全漏洞的通报

你可能错过的新鲜事部分旧版 Windows 11 即将结束支持9 月 10 日，微软公司发布支持公告称，适用于个人和家庭用户的 Windows 11 22H2 消费者版将从下月起结束支持，鉴于停止

2024年9月11日 —— 在广东省通信管理局举办的国家网络安全宣传周电信日主题论坛上，广州锦行网络科技有限公司（简称“锦行科技”）被正式认定为广东省电信和互联网行业网络数据安全技术支撑单位。

A vulnerability was found in Oracle Utilities Framework up to 4.3.0.6.0/4.4.0.0.0. It has been classified as very critical. This affects an unknown part of the component Groovy. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2016-6814. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Скептики уже предупреждают о возможных последствиях нововведения.

Исследователи представили климатический атлас Красной планеты.

近日，一起大规模的数据泄露事件震动了网络安全界。名为“HikkI-Chan”的黑客在臭名昭著的Breach Forums上泄露了超过3.9亿VK用户的个人信息。

Cloudera launched Cloudera Private Link Network to address critical data security and privacy concerns for highly regulated organizations with strict internal data security policies. Cloudera Private Link Network provides secure, private connectivity from customer workloads to the Cloudera Control Plane, ensuring that data does not traverse the public Internet. Organizations in industries such as finance, healthcare and pharmaceuticals often face privacy challenges because providers often cannot guarantee that traffic between tenants, even within the same … More →

The post Cloudera Private Link Network helps enterprises protect their data appeared first on Help Net Security.

A vulnerability, which was classified as very critical, was found in Oracle WebCenter Sites 12.2.1.3.0. Affected is an unknown function of the component Apache Commons FileUpload. The manipulation leads to deserialization. This vulnerability is traded as CVE-2016-6814. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

本文分析了Apache OFBiz的SSRF到RCE漏洞（CVE-2024-45507）。通过复现漏洞、研究其触发条件以及影响版本，详细讲解了如何利用该漏洞进行未授权的远程代码执行，并提供了修复补丁分析和防护规则。

作者：Sunflower@知道创宇404实验室 时间：2024年9月12日 1.前言 漏洞名称：Apache OFBiz SSRF to RCE 漏洞影响：version < 18.12.16 CVE：CVE-2024-45507 据互联网上相关OFBiz漏洞PoC陆续公开，趁热拿url调试分析一下漏洞原理。 2.环境搭建 复现版本：18.12.12 执行如下代码进行下载和启动OFBi...