Aggregator

HisModules ERP 系统存在的严重安全缺陷

Bread 靶机渗透测试：利用 ACL/ACE 滥用攻击提权前言Bread 靶机是由 maze-sec 团队开发的 Active Directory (AD) 环境靶场，旨在模拟真实域环境下的权限提升场景。本文记录了从信息收集到域控提权的完整过程，重点聚焦于 Wegia CMS 的 SQL 注入漏洞利用、密码爆破，以及通过 bloodyAD 工具进行的 ACL/ACE 滥用攻击。该靶机强调 AD

Submit #780725 / VDB-354450

Researchers at numerous firms are sounding warnings about the supply-chain attack on an open-source project with 100 million weekly downloads.

The post Attack on axios software developer tool threatens widespread compromises appeared first on CyberScoop.

Submit #780669 / VDB-354449

Submit #780666 / VDB-354448

Submit #780723 / VDB-354447

Submit #780618 / VDB-354446

Submit #780617 / VDB-354445

Submit #780615 / VDB-354444

本文旨在研究 PDF 解析器 Xpdf 中的深度递归漏洞（CVE-2019-13288）。通过使用 AFL++ 模糊测试工具对 Xpdf 3.02 进行压力测试，成功捕获了由于畸形 PDF 文件引起的拒绝服务（DoS）崩溃

Submit #780614 / VDB-354443

Submit #780613 / VDB-354442

Submit #780607 / VDB-354441

A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos. The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update,

Соцсеть размещена на европейских серверах и не собирает данные для таргетинга.

发表在 PNAS 期刊上的一项研究分析了撒哈拉以南非洲 33 个国家近 300 万例分娩，发现孕妇怀孕早期暴露于 20 摄氏度以上的气温会增加流产风险，受到影响的主要是男胎。尽管 20 摄氏度不算特别热，但研究人员表示，他们的分析表明存在一个阈值效应：一旦温度超过该值，男婴出生率开始下降。更极端的气温没有导致相应的更大的变化，表明只有当热超过特定生物应激点时效应才会触发。这项研究反映了一个长期以来广泛认可的生物学原理——“男性体质虚弱假说”——该假说认为男胎在妊娠期间更容易受到压力影响，从而导致更高的流产率。

Submit #780716 / VDB-354430

Submit #780589 / VDB-354429

Amazon’s latest AI capabilities bring on-demand penetration testing through the AWS Security Agent, alongside the AWS DevOps Agent. “These agents are changing the way we secure and operate software. AWS Security Agent compresses penetration testing timelines from 2-6 weeks to 1-2 days. AWS DevOps agent gives teams 3–5x faster incident resolution so they can spend less time on incident resolution and more time innovating”, said Swami Sivasubramanian, VP, AI Amazon Web Services. AWS Security Agent … More →

The post Amazon sends AI agents into pen testing and DevOps appeared first on Help Net Security.