Aggregator

DEF CON 33: Mobile Hacking Community

Security Boulevard
9 months ago

Creators, Authors and Presenters: d3dbot, Mobile Hacking Community

Our sincere appreciation to DEF CON, and the Creators/Presenters/Authors for publishing their timely DEF CON 33 outstanding content. Originating from the conference's events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 33: Mobile Hacking Community appeared first on Security Boulevard.

Marc Handelman

Cybersecurity Newsletter Weekly – Shai Halud Attack, Ivanti Exploits, FinWise, BMW Data Leak, and More

Cyber Security News
9 months ago

This week in cybersecurity, researchers exposed hidden alliances between ransomware groups, the rise of AI-powered phishing platforms, and large-scale vulnerabilities affecting telecom and enterprise systems. Major data breaches at financial services and luxury brands highlighted insider threats and supply chain risks, while arrests of Scattered Spider hackers signaled rare law enforcement wins. From botnets hijacking […]

The post Cybersecurity Newsletter Weekly – Shai Halud Attack, Ivanti Exploits, FinWise, BMW Data Leak, and More appeared first on Cyber Security News.

Balaji N

OpenAI 研究人员称 AI 幻觉在数学上是不可避免的

Solidot
9 months ago
OpenAI 研究人员在预印本平台 arxiv 上发表了一篇论文，指出由于大模型使用的统计学特性以及计算限制，即使有完美的数据，AI 仍然会产生貌似可信但实际上错误的输出。研究人员承认，AI 幻觉在数学上是不可避免的，无法通过更先进的工程技术解决。研究人员在论文中称，类似面对考试难题的学生，大模型会在不确定的情况下猜测，产生貌似可信但实际错误的表述，而不是承认不确定性。即使是最先进的 AI 系统，幻觉仍然存在，会破坏信任。研究人员证明，幻觉源于训练大模型使用的统计学特性，而非实现缺陷。研究人员测试了竞争对手 DeepSeek-V3 模型、Meta AI 和 Claude 3.7 Sonnet，以及 OpenAI 自己的 GPT 系列模型。研究人员称，ChatGPT 也会产生幻觉，GPT-5 有更少的幻觉，但幻觉仍然会发生，且更先进的推理模型比简单的系统更容易产生幻觉：o1 推理模型 16% 的时间会产生幻觉，而较新的 o3 和 o4-mini 分别有 33% 和 48% 的时间会产生幻觉。OpenAI 的研究识别了三个导致幻觉不可避免的数学因素：当训练数据集中信息过少时的认知不确定性，模型局限性和计算难解性。

AI驱动勒索软件PromptLock分析

先知技术社区
9 months ago
不久前，由ESET的安全研究员发现了首个由AI驱动的勒索软件，并命名为PromptLock，本文将简单对此勒索软件进行简要分析，主要内容为攻击者如何操纵AI进行勒索攻击，因此不涉及逆向相关。

CVE-2025-43346

CVE Trends
9 months ago
Currently trending CVE - Hype Score: 9 - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in tvOS 26, watchOS 26, iOS 18.7 and iPadOS 18.7, visionOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing a maliciously crafted media file may lead to unexpected app termination ...

CVE-2024-34102

CVE Trends
9 months ago
Currently trending CVE - Hype Score: 1 - Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted ...

CVE-2025-6544 | h2oai h2o-3 up to 3.46.7 JDBC Connection deserialization (EUVD-2025-30380)

Vuldb Updates
9 months ago
A vulnerability categorized as critical has been discovered in h2oai h2o-3 up to 3.46.7. This impacts an unknown function of the component JDBC Connection Handler. The manipulation results in deserialization. This vulnerability was named CVE-2025-6544. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.
vuldb.com

CVE-2010-4349 | MantisBT up to 1.2.3 Error Message db_type information disclosure (Bug 663230 / EDB-15735)

Vuldb Updates
9 months 1 week ago
A vulnerability described as problematic has been identified in MantisBT. This issue affects some unknown processing of the component Error Message Handler. Such manipulation of the argument db_type leads to information disclosure. This vulnerability is listed as CVE-2010-4349. The attack may be performed from remote. In addition, an exploit is available. Upgrading the affected component is recommended.
vuldb.com

CVE-2010-4350 | MantisBT up to 1.2.3 db_type path traversal (Bug 663230 / EDB-15736)

Vuldb Updates
9 months 1 week ago
A vulnerability classified as problematic has been found in MantisBT. Impacted is an unknown function. Performing manipulation of the argument db_type results in path traversal. This vulnerability is cataloged as CVE-2010-4350. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2010-3272 | Zoho ManageEngine ADSelfService Plus up to 4.3 User Account quesList input validation (EDB-35330 / XFDB-65350)

Vuldb Updates
9 months 1 week ago
A vulnerability has been found in Zoho ManageEngine ADSelfService Plus up to 4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component User Account. The manipulation of the argument quesList leads to improper input validation. This vulnerability is uniquely identified as CVE-2010-3272. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is advisable to introduce extra authentication.
vuldb.com

CVE-2010-3274 | Zoho ManageEngine ADSelfService Plus up to 4.3 Search Engine EmployeeSearch.cc searchString cross site scripting (EDB-35331 / Nessus ID 57049)

Vuldb Updates
9 months 1 week ago
A vulnerability was found in Zoho ManageEngine ADSelfService Plus up to 4.3. It has been classified as problematic. This affects an unknown part of the file EmployeeSearch.cc of the component Search Engine. This manipulation of the argument searchString causes cross site scripting. The identification of this vulnerability is CVE-2010-3274. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Upgrading the affected component is recommended.
vuldb.com

Managed ad