Aggregator

HackerNews 编译，转载请注明出处： 印度中央银行印度储备银行（RBI）表示，将为印度的银行引入一个专用的“bank.in”互联网域名，以打击数字金融欺诈行为。 “这一举措旨在减少网络安全威胁和诸如网络钓鱼之类的恶意活动，并简化安全金融服务，从而增强对数字银行和支付服务的信任，”RBI在今日发布的一份声明中表示。 为此，印度银行技术发展与研究研究所（IDRBT）将担任唯一的注册机构。域名注册预计将于2025年4月开始。 RBI还表示，计划为金融部门的其他非银行实体推出一个单独的专用域名“fin.in”。 作为增强在线支付信任的更广泛努力的一部分，RBI还表示将推出跨境无卡（CNP）在线交易的额外身份验证因素（AFA）。 AFA，也称为多因素身份验证（MFA），指的是使用多个因素来验证用户身份的过程，在这种情况下，是通过卡片、预付工具和移动银行渠道完成的数字交易。 “这将在海外商家启用AFA的情况下，提供额外的安全层，”RBI表示。 然而，值得注意的是，RBI并未强制规定AFA的具体因素。印度的数字支付生态系统在很大程度上采用了基于短信的一次性密码（OTP）作为AFA。   消息来源：The Hacker News, 编译：zhongx；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints....

The post drs-malware-scan: Perform file-based malware scan on your on-prem servers with AWS appeared first on Penetration Testing Tools.

Amnesiac Amnesiac is a post-exploitation framework designed to assist with lateral movement within active directory environments. Amnesiac is being developed to bridge a gap on Windows OS, where post-exploitation frameworks are not readily available...

The post Amnesiac: lateral movement within active directory environments appeared first on Penetration Testing Tools.

DIAL Workloads on the cloud provide equal opportunities for hackers as much as they do for internal teams. Cloud-native companies are open to attacks from both outside forces and from within. With the ever-growing...

The post DIAL: centralised security misconfiguration detection framework appeared first on Penetration Testing Tools.

A vulnerability was found in WSO2 Oauth Plugin up to 1.0 on Jenkins. It has been rated as problematic. This issue affects some unknown processing of the file config.xml of the component Controller File System Handler. The manipulation leads to information disclosure. The identification of this vulnerability is CVE-2023-30527. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability classified as critical has been found in Assembla Merge Request Builder Plugin up to 1.1.13 on Jenkins. Affected is an unknown function. The manipulation leads to permission issues. This vulnerability is traded as CVE-2023-30521. The attack needs to be done within the local network. There is no exploit available.

A vulnerability classified as critical was found in Report Portal Plugin up to 0.5 on Jenkins. Affected by this vulnerability is an unknown functionality of the component Controller File System Handler. The manipulation leads to permission issues. This vulnerability is known as CVE-2023-30523. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Report Portal Plugin up to 0.5 on Jenkins. Affected by this issue is some unknown functionality of the component Configuration Form Handler. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2023-30524. Access to the local network is required for this attack. There is no exploit available.

A vulnerability, which was classified as critical, was found in Report Portal Plugin up to 0.5 on Jenkins. This affects an unknown part. The manipulation leads to permission issues. This vulnerability is uniquely identified as CVE-2023-30526. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability has been found in Consul KV Builder Plugin up to 2.0.13 on Jenkins and classified as problematic. This vulnerability affects unknown code of the component Controller File System Handler. The manipulation leads to cleartext storage of sensitive information. This vulnerability was named CVE-2023-30530. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability was found in Consul KV Builder Plugin up to 2.0.13 on Jenkins and classified as problematic. This issue affects some unknown processing of the component Configuration Form Handler. The manipulation leads to information disclosure. The identification of this vulnerability is CVE-2023-30531. The attack can only be done within the local network. There is no exploit available.

A vulnerability was found in TurboScript Plugin up to 1.3 on Jenkins. It has been classified as critical. Affected is an unknown function. The manipulation leads to permission issues. This vulnerability is traded as CVE-2023-30532. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability was found in Quay.io Trigger Plugin up to 0.1 on Jenkins. It has been rated as problematic. Affected by this issue is some unknown functionality of the component URL Scheme Handler. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2023-30520. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as critical has been found in Fogbugz Plugin up to 2.2.17 on Jenkins. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument jobname leads to permission issues. This vulnerability is uniquely identified as CVE-2023-30522. Access to the local network is required for this attack. There is no exploit available.

A vulnerability classified as problematic was found in Report Portal Plugin up to 0.5 on Jenkins. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. This vulnerability was named CVE-2023-30525. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Lucene-Search Plugin up to 387.v938a_ecb_f7fe9 on Jenkins. This issue affects some unknown processing of the component HTTP Endpoint. The manipulation leads to cross-site request forgery. The identification of this vulnerability is CVE-2023-30529. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, was found in WSO2 Oauth Plugin up to 1.0 on Jenkins. Affected is an unknown function of the component Configuration Form Handler. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2023-30528. The attack can only be done within the local network. There is no exploit available.