Aggregator

Аттосекундная микроскопия открывает новые горизонты в квантовой физике.

OpenAI присоединилась к бунту против государственного надзора.

A cyberattack disrupted operations of US chipmaker Microchip TechnologySemiconductor manufactu

Semiconductor manufacturer Microchip Technology announced that its operations were disrupted by a cyberattack. U.S. chipmaker Microchip Technology suffered a cyberattack that disrupted operations at several of its manufacturing plants. The company detected potentially suspicious activity involving its IT infrastructure on August 17, 2024. The attack severely impacted the production capacity of the company that shut […]

AppOmni 的网络安全研究人员警告称，Oracle NetSuite SuiteCommerce 平台存在数据泄露风险，可能使攻击者能够访问客户的敏感信息。 NetSuite 是一个广泛使用的 SaaS 企业资源规划 (ERP) 平台，它允许通过 SuiteCommerce 或 SiteBuilder 部署面向外部的在线商店。这些商店托管在 NetSuite 租户的子域上，未经身份验证的客户可以直接从企业浏览、注册并购买产品。 问题的根源不在于 NetSuite 解决方案本身，而在于自定义记录类型（CRT）的访问控制配置错误，这可能会泄露客户的敏感信息。 暴露的数据包括注册客户的个人身份信息（PII），如完整地址和手机号码。 攻击者可能会利用 NetSuite 中配置为“无需权限”访问的自定义记录类型 (CRT)，通过 NetSuite 的记录和搜索 API 获取数据。然而，要成功发动攻击，攻击者需要事先知道正在使用的 CRT 的名称。 “我们还需要假设未经身份验证的参与者知道 CRT 的名称。在本文发表之前，曾有一种方法可以检索所有 CRT 的名称，但这个问题已经得到解决。”研究人员发布的报告写道。“如今，还有两种方法可以检索 CRT 名称： 使用由 Github 等公共资源整理的流行 CRT 名称组成的单词列表，对下面第一步中显示的 API 端点进行暴力破解。 通过观察与网站交互时的 HTTP 流量，在响应中查找以“customrecord_”为前缀的字符串。” 为了降低风险，管理员应加强对自定义记录类型 (CRT) 的访问控制，限制公众对敏感字段的访问，并考虑暂时使受影响的站点脱机以防止数据泄露。 “解决这些数据泄露问题的最可靠方法是加强 CRT 的访问控制。从安全角度来看，最简单的解决方案可能是将记录类型定义的访问类型更改为设置更改为‘需要自定义记录条目权限’或‘使用权限列表’ ”。报告总结道。 实际上，许多组织确实有业务需求，需要公开记录类型中的某些字段。因此，管理员应该开始评估字段级别的访问控制，并确定哪些字段（如果有）需要公开。对于必须锁定以防止公共访问的字段，管理员应进行以下两项更改： 默认访问级别：无 搜索/报告的默认级别：无   消息来源：securityaffairs，译者：YY；   本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

error code: 521

Google addressed the ninth actively exploited Chrome zero-day this yearGoogle released emergen

Google released emergency security updates to fix the ninth actively exploited Chrome zero-day vulnerability this year. ​​Google released an emergency security update to address a Chrome zero-day vulnerability, tracked as CVE-2024-7971, that is actively exploited. The vulnerability is a type confusion issue that resides in Chrome’s V8 JavaScript engine. “Google is aware that an exploit for CVE-2024-7971 […]

Всего одна ошибка в настройке сделает ваш сервер магнитом для злоумышленников.

A vulnerability was found in Mage AI. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Terminal Server Command History Handler. The manipulation leads to information disclosure. This vulnerability is known as CVE-2024-8072. The attack can be launched remotely. There is no exploit available.

键盘鼠标都最低，派商店 Keychron 系列清仓促销专场 利益相关声明： 文中包含营销（如促销活动）和推广（如返利链接）信息 活动时间：即日起至 8.29省流版：少数派定制 Keychron K3

A vulnerability was found in Mattermost up to 9.5.7/9.8.2/9.9.1/9.10.0/9.11.0. It has been classified as problematic. Affected is an unknown function of the component User Management Page. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-40886. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Mattermost up to 9.5.7/9.8.2/9.9.1/9.10.0/9.11.0 and classified as critical. This issue affects some unknown processing of the component Shared Channel Handler. The manipulation leads to improper access controls. The identification of this vulnerability is CVE-2024-32939. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.