Aggregator

随着大模型的火热，大模型在安全产品中有哪些应用，我们今天来详细剖析

随着大模型的火热，大模型在安全产品中有哪些应用，我们今天来详细剖析

KATRIN（Karlsruhe Tritium Neutrino，卡尔斯鲁厄氚中微子）实验的研究人员报告了迄今为止对中微子质量上限的最精确测量结果：设定为 0.45 电子伏特 (eV) ，不到电子质量的百万分之一。该发现为宇宙中最难以捉摸的基本粒子设置了更严格的质量范围，使得其物理学适用边界超越了“标准模型”（Standard Model）。中微子（一种电中性基本粒子）是宇宙中数量最多的粒子，它以三种不同类型或“味”存在：电子中微子、μ 中微子和 τ 中微子。这些味态的摆荡意味着单个中微子在传播时可转变为三种味态中的每一种类型；该现象提供了确凿的证据：中微子具有质量；这与“标准模型”最初假设的中微子无质量相矛盾。然而，它们的确切质量仍是粒子物理学的一大谜团。KATRIN 实验通过分析氚的 β 衰变来确定中微子的质量。在此衰变过程中，中子会转变为质子，同时会释放一个电子和一个电子反中微子——后者是中微子的反粒子。通过分析发射的电子和电子反中微子间的总衰变能量分布便可推算中微子的质量。在 2019 年至 2021 年间的 259 天中，KATRIN 合作团队测量了约 3600 万个电子的能量——这一数据集比之前的运行规模要大 6 倍。这些发现确定了电子中微子有效质量的最严格实验室上限：将其置于 < 0.45 eV （置信水平为 90%）。

Главное изменение — ускоренная распаковка благодаря новым алгоритмам.

Here’s a look at the most interesting products from the past week, featuring releases from Forescout, Index Engines, Jit, RunSafe Security, and Seal Security. Jit launches AI agents to ease AppSec workload Jit has launched its new AI agents to offload specific and tedious tasks from AppSec teams such as creating risk assessments, threat models, and compliance reports; while making it easy to take action on mitigating security risk. As a result, AppSec teams can … More →

The post New infosec products of the week: April 11, 2025 appeared first on Help Net Security.

一种基于代码知识图谱（CKG）增强的检索增强生成（RAG）和Multi-LLMs系统的自动化模糊测试方法

一种基于代码知识图谱（CKG）增强的检索增强生成（RAG）和Multi-LLMs系统的自动化模糊测试方法

微软官方发布4月安全更新，请及时安装补丁修复。

微软官方发布4月安全更新，请及时安装补丁修复。

向量数据库成就云上LLM智能跃迁，却也悄然埋下数据泄露隐患，安全风险不容忽视！

向量数据库成就云上LLM智能跃迁，却也悄然埋下数据泄露隐患，安全风险不容忽视！

HackerNews 编译，转载请注明出处： Sensata Technologies（简称 Sensata）在上周末遭受了一次勒索软件攻击，部分公司网络被加密，运营受到扰乱。 在向美国证券交易委员会（SEC）提交的 8-K 表格中，Sensata 表示此次攻击发生在 4 月 6 日星期日，并涉及数据泄露。 “此次事件暂时影响了 Sensata 的运营，包括发货、收货、制造生产以及各种其他支持功能，”通知中写道。 Sensata 是一家工业技术公司，开发、制造和销售各种传感器及传感器解决方案，以及电气保护组件和系统。 该公司产品主要用于汽车、航空航天和工业应用领域。2023 年，Sensata 报告的年收入为 40 亿美元。 Sensata 表示，公司已采取立即行动，加快受网络攻击影响的关键功能的恢复进程。然而，公司无法提供完成这一工作的具体时间表。 在外部网络安全专家的协助下进行的初步调查确认，黑客已从公司网络中窃取了数据。 数据泄露与勒索软件的常见策略 数据泄露是勒索软件攻击者常用的策略，用于勒索受害者、增加支付赎金的压力，并制造法律和监管上的复杂性。 目前，Sensata 正在确定此次攻击中被盗的文件，并将根据调查结果通知受影响的个人和监管机构。 公司预计此次事件对其截至今年 6 月 30 日的当前季度财务结果不会产生重大影响。 然而，Sensata 承认，随着对安全事件的全面范围和影响的进一步了解，这一预期可能会发生变化。   消息来源：The Hacker News；  本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability classified as problematic has been found in lemonldap-ng. Affected is an unknown function of the component Choice Authentication Module. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-31510. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in MongoDB mongosh up to 2.3.8. This vulnerability affects unknown code of the component Control Character Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. This vulnerability was named CVE-2025-1693. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in MongoDB mongosh up to 2.2.x. Affected by this issue is some unknown functionality of the file C:\node_modules\ of the component File Handler. The manipulation leads to untrusted search path. This vulnerability is handled as CVE-2025-1756. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in MongoDB mongosh up to 2.3.8. This issue affects some unknown processing of the component Control Character Handler. The manipulation leads to injection. The identification of this vulnerability is CVE-2025-1691. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in MongoDB mongosh up to 2.3.8. Affected is an unknown function of the component Control Character Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. This vulnerability is traded as CVE-2025-1692. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Autodesk Navisworks Freedom, Navisworks Simulate and Navisworks Manage 2025. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component DWFX File Handler. The manipulation leads to out-of-bounds read. This vulnerability is known as CVE-2025-1659. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Autodesk Navisworks Freedom, Navisworks Simulate and Navisworks Manage 2025. This affects an unknown part of the component DWFX File Handler. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2025-1658. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Autodesk Navisworks Freedom, Navisworks Simulate and Navisworks Manage 2025. This vulnerability affects unknown code of the component DWFX File Handler. The manipulation leads to buffer overflow. This vulnerability was named CVE-2025-1660. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.