Aggregator

马斯克（Elon Musk）旗下平台 X 使用的一个位于俄亥俄州 Hillsboro 的数据中心发生火灾。当地消防队称他们在一个房间内发现了疑似与火灾有关联的电池，房间内烟雾弥漫，火势未蔓延至建筑物的其它部分。数据中心运营商 Digital Realty 表示火灾已得到控制，暂无人员伤亡报告。

托尔金（J.R.R. Tolkien）的《指环王》系列小说影响了一代又一代的人，但今天一部分人对书的解读可能与作者的意图南辕北辙。硅谷的科技右派们可能更痴迷于掌握魔戒的力量，是索伦(Sauron) 的追随者，虽然他们在口头上仍然会宣称站在致力于摧毁魔戒的护戒使者这一边。经历过战火的托尔金向往的是霍比特人 (Hobbits)的田园风光，他在书中刻画的英雄也是普通的霍比特人、佛罗多的园丁萨姆（Sam Gamgee）。然而今天的科技右派向往的是索伦的专制帝国，前苹果和 Google 高管 Kim Scott 在一篇专栏中指出，科技业对“一人原则”或“创始人模式”的管理风格推崇备至。风险投资人 Marc Andreessen 形容这种专制管理风格是“踏上英雄之路，反抗现状，探索未知，征服巨龙，带回战利品”。Andreessen、Elon Musk 和 Peter Thiel 是硅谷科技右派的代表，将他们前进路上的障碍，无论是监管还是伦理，都视为恶棍。Thiel 是保守派的一大金主，他称自己至少读过《指环王》三部曲十遍，他用书中的魔法物品命名了旗下的多家公司。副总统 JD Vance 深受其影响，他表示自己的保守世界观主要来自托尔金。他用甘道夫的火之戒命名了自己的风投公司 Narya Capital。托尔金如果还活着可能会对硅谷科技右派的做法倍感困惑。Thiel 说他对永生的追逐来自于《指环王》中的精灵，他称精灵是不死的人类，说“我们为什么不能成为精灵”？黑暗启蒙运动的创始人 Curtis Yarvin 推崇君主制，把将特朗普选上台的选民轻蔑的称为是“霍比特人”。但霍比特人在摧毁魔戒的使命中起到了举足轻重的作用。

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function load_state_dict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. This vulnerability is traded as CVE-2025-5148. An attack has to be approached locally. There is no exploit available. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. It is recommended to apply a patch to fix this issue.

Submit #573800 / VDB-310236

今日暂未更新资讯~
更多最新文章，请访问SecWiki

FBI warns Silent Ransom Group has targeted U.S. law firms for 2 years using callback phishing and social engineering extortion tactics. The FBI warns that the Silent Ransom Group, active since 2022 and also known as Luna Moth, has targeted U.S. law firms using phishing and social engineering. Linked to BazarCall campaigns, the group previously […]

Authors/Presenters: Bård Aase

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – PasswordsCon – That’s Not My Name appeared first on Security Boulevard.

A critical XSS vulnerability, CVE-2024-27443, in Zimbra Collaboration Suite’s CalendarInvite feature is actively being exploited, potentially by the…

The Bumblebee malware SEO poisoning campaign uncovered earlier this week aimpersonating RVTools is using more typosquatting domainsi mimicking other popular open-source projects to infect devices used by IT staff. [...]

A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical. This issue affects the function tools_ping of the file /usr/bin/network_tools. The manipulation of the argument url leads to command injection. The identification of this vulnerability is CVE-2025-5147. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vulnerability affects the function passwd_set of the file /usr/bin/routerd of the component HTTP Header Handler. The manipulation of the argument pwd leads to command injection. This vulnerability was named CVE-2025-5146. The attack can be initiated remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 20250508. This affects an unknown part of the file /www/cgi-bin/ of the component Query String Handler. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2025-5145. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as problematic, has been found in Interspire ActiveKB NX 2.5.4. Affected by this issue is some unknown functionality of the file activekb. The manipulation of the argument page leads to cross site scripting. This vulnerability is handled as CVE-2007-5426. The attack may be launched remotely. Furthermore, there is an exploit available.

Submit #573759 / VDB-310235

Submit #573682 / VDB-310235

Submit #573493 / VDB-310234

Submit #573492 / VDB-310233

CycloneDX Rust (Cargo)插件项目有漏洞悬赏项目，资金来自于德国主权科技基金（Sovereign Tech Fund)的 Bug Resilience Program，但由于大量 AI 生成的漏洞报告涌入，开发者在 GitHub 上宣布关闭该项目。开发者称他们收到的报告几乎全都是 AI 生成的垃圾，与 CycloneDX Rust (Cargo)插件根本没有关系，绝大多数报告者甚至都懒得阅读规则或者了解该工具的用途。AI 生成的报告增加了额外的工作，所以他们决定关闭该项目。开发者最后说，“感谢 AI。”

A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. This vulnerability is uniquely identified as CVE-2025-5124. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The real existence of this vulnerability is still doubted at the moment. It is recommended to change the configuration settings. The vendor was contacted early about this issue. They confirmed the existence but pointed out that they "have published the 'Hardening Guide' on the Web from July 2018 to January 2025 and have thoroughly informed customers of the recommendation to change their initial passwords".

A vulnerability was found in Blue Coat ProxySG up to 5.4.1.1 and classified as very critical. Affected by this issue is some unknown functionality. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2011-5124. The attack may be launched remotely. Furthermore, there is an exploit available.