Aggregator

Linux 安全工程师 Andrey Konovalov 在本月举行的 POC 2024 安全会议上介绍了如何秘密关闭 ThinkPad 摄像头 LED 指示灯的方法。他开发的概念验证程序通过重刷 ThinkPad X230 摄像头的固件去关闭 LED 指示灯，在用户不知情下悄悄摄录像。今天大部分笔记本电脑都提供了摄像头盖子，可以在不使用时盖住摄像头。他的 Lights Out 源代码发布在 GitHub 上。

A vulnerability has been found in Artifex MuPDF and classified as problematic. Affected by this vulnerability is the function pdf_run_xobject of the file pdf-op-run.c. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2017-5991. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Myproxy 2003-06-29. Affected by this issue is some unknown functionality of the component URL Handler. The manipulation leads to basic cross site scripting. This vulnerability is handled as CVE-2003-1199. The attack may be launched remotely. Furthermore, there is an exploit available.

Wanted Russian Cybercriminal Linked to Hive and LockBit Ransomware Has Been Arrested

A new set of 15 SpyLoan Android malware apps with over 8 million installs was discovered on Google Play, targeting primarily users from South America, Southeast Asia, and Africa. [...]

A vulnerability was found in Apple Mac OS X 10.10/10.10.1. It has been rated as critical. This issue affects some unknown processing of the component bash. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2014-7187. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

澳大利亚本周通过了禁止 16 岁以下儿童使用社交媒体的法律，它给社媒企业一年时间制定年龄限制计划，违反者将面临最高 5000 万澳元的罚款。科技巨头们纷纷抨击这一禁令。TikTok 警告禁令可能会将年轻用户推向风险更高的在线空间。Meta 质疑该法律的通过过于匆忙，只给它们 24 小时的时间提交意见。Snapchat 母公司 Snap 认为，法律留下了很多未解答的疑问。对于如何实施年龄限制，相关企业不知道如何执行。

This week’s cybersecurity digest highlights multiple critical vulnerabilities and threat actor activities, emphasizing the importance of proactive mitigation strategies. Vulnerabilities […]

The post Weekly Threat Landscape Digest – Week 48 appeared first on HawkEye.

本月玩什么 | 潜行者 2、黄金像凶杀案再起、俄罗斯方块永恒篇等

A vulnerability, which was classified as critical, has been found in Linux Kernel 3.9.0/3.9.1/3.9.2/3.9.3/3.9.4. Affected by this issue is some unknown functionality of the file drivers/net/wireless/b43/main.c. The manipulation of the argument modprobe leads to format string. This vulnerability is handled as CVE-2013-2852. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

From a Regular Infostealer to its Obfuscated Version, (Sat, Nov 30th)

A vulnerability classified as critical was found in m1k1o blog. Affected by this vulnerability is the function imagecreatefrom/image. The manipulation leads to improper input validation. This vulnerability is known as CVE-2022-23626. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Thinking Arts ES.One 1.0. Affected is an unknown function of the file store.cgi. The manipulation of the argument StartID with the input .. leads to path traversal. This vulnerability is traded as CVE-2001-0305. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in SourceFire Snort 2.1.0/2.1.1 Rc1/2.1.3/2.2. Affected is the function decodetcpoptions of the file decode.c of the component Verbose Mode. The manipulation leads to denial of service. This vulnerability is traded as CVE-2004-2652. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Jukka Lahtinen Minicom 1.82.0/1.82.1/1.83.0/1.83.1 on Linux. Affected is an unknown function of the component uucp User Handler. The manipulation leads to symlink following. This vulnerability is traded as CVE-2000-0698. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Web-app.org WebAPP 0.9.9/0.9.9.2/0.9.9.2.1. It has been classified as critical. This affects an unknown part of the file apage.cgi. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2005-1628. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Name: AlpacaHack Round 7 (Web) (an AlpacaHack event.)
Date: Nov. 30, 2024, 3 a.m. — 30 Nov. 2024, 09:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://alpacahack.com/ctfs/round-7
Rating weight: 0
Event organizers: AlpacaHack

A vulnerability was found in Apple Safari up to 3.2.3. It has been declared as critical. This vulnerability affects unknown code of the component feed URI Handler. The manipulation leads to memory corruption. This vulnerability was named CVE-2008-3529. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple Safari up to 3.2.3. It has been rated as critical. This issue affects some unknown processing of the component SVGList Handler. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2008-3529. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.