Aggregator

SDL 93/100问：与外部厂商合作时需要外发敏感数据，有啥好方案？

我的安全视界观
3 weeks 6 days ago
对外进行数据对接，是比较常见且风险比较高的业务场景，需要结合具体的业务场景来设计安全方案或做安全评审，不过通用的思考框架也是有的： 1、必要性：是否必须提供原始的敏感信息到第三方，对方通过API的方式过来查询或计算，取结果回去是否可行； 2、最小化：敏感的业务数据最小化传出去或加入计算，有时候开发会为了方便就用现有的数据接口； 3、设验证：针对API对接的场景，尽可能做各种维度的验证，比如对方出口IP、调用权限等； 4、可审计：无论是API对接还是数据拷贝的场景，都需要做数据出司的审计，可以是邀请第三方相关部门审计、业务打印日志做模型审计。 以上四点可以根据实际业务场景扩展、细化，亦可结合实际需求加入新的维度，完善安全评估方案。 ------------更多内容，请访问------------- 1、SDL 100问 SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 大家都有哪些SDL运营指标？ 业务系统是否可以带漏洞上线？ 哪个厂商做SDL咨询服务和建设比较强？ 源代码扫描，是做仓库的全量扫描还是增量扫？ 如何推动业务方修复开源组件漏洞？ 开发安全左移和右移，哪一个更好？ 什么是ASTRIDE？ SDL 92/100问：在测试代码审计类产品能力时，有没有好一点的开源项目推荐？ 2、SDL创新实践 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 DevSecOps实施关键：研发安全工具 从安全视角，看研发安全 数字化转型下研发安全痛点 一个思考：安全测试驱动产品安全？ 3、SDL最初实践 【SDL最初实践】开篇 【SDL最初实践】安全培训 【SDL最初实践】安全需求 【SDL最初实践】安全设计 【SDL最初实践】安全开发 【SDL最初实践】安全测试 【SDL最初实践】安全审核 【SDL最初实践】安全响应 4、安全运营实践 基于实践的安全事件简述 安全事件运营SOP：钓鱼邮件 安全事件运营SOP：网络攻击 安全事件运营SOP：蜜罐告警 安全事件运营SOP：webshell事件 安全事件运营SOP：接收漏洞事件 应急能力提升：实战应急困境与突破 应急能力提升：挖矿权限维持攻击模拟

CVE-2023-21214 | Google Android 13.0 p2p_iface.cpp addGroupWithConfigInternal out-of-bounds (A-262235736 / EUVD-2023-25382)

Vuldb Updates
3 weeks 6 days ago
A vulnerability labeled as problematic has been found in Google Android 13.0. Affected by this vulnerability is the function addGroupWithConfigInternal of the file p2p_iface.cpp. Executing manipulation can lead to out-of-bounds read. This vulnerability is handled as CVE-2023-21214. It is possible to launch the attack on the local host. There is not any exploit available. It is best practice to apply a patch to resolve this issue.
vuldb.com

CVE-2023-21213 | Google Android 13.0 sta_iface.cpp initiateTdlsTeardownInternal out-of-bounds (A-262235951 / EUVD-2023-25381)

Vuldb Updates
3 weeks 6 days ago
A vulnerability was found in Google Android 13.0 and classified as problematic. Impacted is the function initiateTdlsTeardownInternal of the file sta_iface.cpp. Executing manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2023-21213. The attack needs to be launched locally. No exploit is available. Applying a patch is advised to resolve this issue.
vuldb.com

CVE-2023-21212 | Google Android 13.0 Wifi Server out-of-bounds (A-262236031 / EUVD-2023-25380)

Vuldb Updates
3 weeks 6 days ago
A vulnerability identified as problematic has been detected in Google Android 13.0. Affected is an unknown function of the component Wifi Server. Performing manipulation results in out-of-bounds read. This vulnerability is known as CVE-2023-21212. Attacking locally is a requirement. No exploit is available. Applying a patch is the recommended action to fix this issue.
vuldb.com

CVE-2025-27234 | Zabbix Agent 2 smartctl Plugin up to 5.0.46 Parameter smart.disk.get os command injection (EUVD-2025-29036 / Nessus ID 264710)

Vuldb Updates
3 weeks 6 days ago
A vulnerability, which was classified as critical, has been found in Zabbix Agent 2 smartctl Plugin up to 5.0.46. This affects an unknown part of the file smart.disk.get of the component Parameter Handler. The manipulation leads to os command injection. This vulnerability is referenced as CVE-2025-27234. The attack needs to be initiated within the local network. No exploit is available.
vuldb.com

CVE-2012-2206 | IBM WebSphere MQ 7.0.3/7.0.4 access control (ID 1607481 / EDB-20478)

Vuldb Updates
3 weeks 6 days ago
A vulnerability categorized as problematic has been discovered in IBM WebSphere MQ 7.0.3/7.0.4. Affected is an unknown function. Such manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2012-2206. The attack can be launched remotely. Moreover, an exploit is present. It is advisable to implement a patch to correct this issue.
vuldb.com

CVE-2012-2171 | IBM Ds4100 1724 ModuleServlet.do selectedModuleOnly sql injection (EDB-19321 / XFDB-75236)

Vuldb Updates
3 weeks 6 days ago
A vulnerability marked as critical has been reported in IBM Ds4100 1724. The impacted element is an unknown function of the file ModuleServlet.do. The manipulation of the argument selectedModuleOnly leads to sql injection. This vulnerability is traded as CVE-2012-2171. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2012-3294 | IBM WebSphere MQ 7.0.3/7.0.4/7.5 cross-site request forgery (ID 1607482 / EDB-20477)

Vuldb Updates
3 weeks 6 days ago
A vulnerability identified as problematic has been detected in IBM WebSphere MQ 7.0.3/7.0.4/7.5. Affected by this vulnerability is an unknown functionality. Performing manipulation results in cross-site request forgery. This vulnerability was named CVE-2012-3294. The attack may be initiated remotely. In addition, an exploit is available. Applying a patch is the recommended action to fix this issue.
vuldb.com

Lynx

Dark Feed IO
3 weeks 6 days ago

You must login to view this content

cohenido

Achieve Independence in NHI and Secrets Management

Security Boulevard
3 weeks 6 days ago

Why should NHI and Secrets Management Matter to Businesses? How often do businesses rethink their cybersecurity strategy to ensure it is all-inclusive and fool-proof? A comprehensive data protection plan cannot overlook the need for Non-Human Identities (NHIs) and Secrets Management. Regrettably, this crucial aspect is often overlooked, leading to severe loopholes in a company’s data […]

The post Achieve Independence in NHI and Secrets Management appeared first on Entro.

The post Achieve Independence in NHI and Secrets Management appeared first on Security Boulevard.

Alison Mack

Managed ad