Aggregator

好，我现在要帮用户总结这篇文章的内容，控制在100字以内。首先，我需要通读全文，抓住主要信息。 文章主要讲的是AI换脸技术带来的安全风险。梆梆安全提出了一个专项解决方案，针对人脸识别的安全问题。他们分析了攻击手段，比如非实时和实时换脸攻击，并提出了加强检测、构建模型、排查风险和明确标准等建议。 接下来，我需要将这些信息浓缩到100字以内，确保涵盖关键点：AI换脸的安全威胁、梆梆安全的解决方案、攻击手段分析以及提出的建议。 最后，组织语言，确保简洁明了，不使用“文章内容总结”等开头。 针对AI换脸技术带来的安全威胁，梆梆安全推出专项解决方案，分析攻击手段并提出加强检测、构建模型等建议，助力提升人脸识别系统的安全性。

DataCon2025报名进行中， AI安全赛道出题人赛前指导，速读！

A vulnerability has been found in projectworlds Expense Management System 1.0 and classified as problematic. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2025-12230. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in projectworlds Expense Management System 1.0 and classified as problematic. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-12231. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability was found in Tenda CH22 1.0.0.1. It has been classified as critical. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing manipulation of the argument page results in buffer overflow. This vulnerability is identified as CVE-2025-12232. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability, which was classified as critical, was found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. This vulnerability is uniquely identified as CVE-2025-12242. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability has been found in code-projects Client Details System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. This vulnerability was named CVE-2025-12243. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in code-projects Simple E-Banking System 1.0 and classified as problematic. This affects an unknown part of the file /eBank/register.php. Executing manipulation of the argument Username can lead to cross site scripting. The identification of this vulnerability is CVE-2025-12244. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in chatwoot up to 4.7.0. It has been classified as problematic. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. This vulnerability is referenced as CVE-2025-12245. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in chatwoot up to 4.7.0. It has been declared as problematic. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. This vulnerability is identified as CVE-2025-12246. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as problematic, was found in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. This vulnerability was named CVE-2025-12229. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. This vulnerability is known as CVE-2025-12226. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability classified as problematic was found in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executing manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2025-12227. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability, which was classified as problematic, has been found in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-12228. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability, which was classified as critical, was found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing manipulation of the argument keywords can lead to sql injection. The identification of this vulnerability is CVE-2025-12215. The attack may be launched remotely. Furthermore, there is an exploit available.

HackerNews 编译，转载请注明出处： 网络安全研究人员在OpenAI新推出的ChatGPT Atlas网络浏览器中发现了一个新漏洞，该漏洞可能允许恶意行为者向AI助手的记忆系统中注入恶意指令并运行任意代码。 LayerX安全公司的联合创始人兼首席执行官奥尔·埃舍德在与The Hacker News分享的一份报告中表示：”该漏洞可利用允许攻击者使用恶意代码感染系统、为自己授予访问权限或部署恶意软件。” 该攻击的核心是利用跨站请求伪造漏洞，向ChatGPT的持久化记忆系统中注入恶意指令。被污染的记忆能够在不同设备和会话中持续存在，使得当已登录的用户尝试将ChatGPT用于合法目的时，攻击者能够进行各种操作，包括夺取用户账户、浏览器或连接系统的控制权。 ChatGPT的”记忆”功能于2024年2月首次推出，旨在让AI聊天机器人能在不同对话之间记住有用的细节，从而使其回复更加个性化和贴合上下文。这可能包括用户的姓名、偏爱的颜色、兴趣或饮食偏好等各种信息。 这种攻击构成了重大的安全风险，因为它通过污染记忆，使得恶意指令能够持续存在，除非用户明确前往设置并删除它们。如此一来，它将一个有用的功能变成了可以运行攻击者提供代码的强大武器。 LayerX安全公司安全研究主管米歇尔·莱维表示：”该漏洞的独特危险性在于，它针对的是AI的持久化记忆，而不仅仅是浏览器会话。通过将标准的CSRF攻击与记忆写入操作串联起来，攻击者可以无形地植入能在不同设备、会话甚至不同浏览器中存活的指令。“ “在我们的测试中，一旦ChatGPT的记忆被污染，后续的’正常’提示就可能触发代码获取、权限提升或数据窃取，而不会触发有意义的防护措施。” 攻击的具体流程如下： 用户登录ChatGPT。 用户被社会工程学手段诱骗点击恶意链接。 恶意网页触发CSRF请求，利用用户已通过身份验证的事实，在用户不知情的情况下向ChatGPT的记忆系统中注入隐藏指令。 当用户为合法目的查询ChatGPT时，被污染的记忆会被调用，导致代码执行。 LayerX未透露实施该攻击所需的额外技术细节。该浏览器安全公司表示，ChatGPT Atlas缺乏强大的反钓鱼防护控制，加剧了这一问题，并补充说这使得用户遭受攻击的风险比谷歌Chrome或微软Edge等传统浏览器高出90%。 在对100多个真实网络漏洞和钓鱼攻击的测试中，Edge成功拦截了53%的攻击，其次是谷歌Chrome，拦截率为47%，Dia为46%。相比之下，Perplexity的Comet和ChatGPT Atlas仅分别拦截了7%和5.8%的恶意网页。 这为各种攻击场景打开了大门，包括一种场景：开发者请求ChatGPT编写代码，可能导致AI代理在”氛围编程”过程中嵌入隐藏指令。 这一事态发展与NeuralTrust演示的针对ChatGPT Atlas的提示注入攻击同时发生，后者通过将恶意提示伪装成看似无害的待访问URL，从而越狱其多功能地址栏。此前也有报告指出，AI代理已成为企业环境中最常见的数据泄露载体。 埃舍德表示：”AI浏览器正在将应用、身份和智能集成到一个统一的AI威胁面上。像’被污染的记忆’这样的漏洞就是新的供应链攻击：它们随着用户传播，污染未来的工作，并模糊了有用的AI自动化与隐蔽控制之间的界限。” “随着浏览器成为AI的通用接口，以及新的智能代理浏览器将AI直接融入浏览体验，企业需要将浏览器视为关键基础设施，因为这正是下一代AI生产力和工作的前沿阵地。”   消息来源：thehackernews； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Цепочка заражения стала настолько длинной и запутанной, что исследователям пришлось отслеживать её полгода.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding serious vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System. Released on October 23, 2025, the alert warns that attackers could exploit these flaws to take control of industrial systems used worldwide, particularly in the energy sector. Two Critical Vulnerabilities Discovered Security […]

The post CISA Alerts on Critical Veeder-Root Flaws Allowing Attackers to Execute System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

科学界普遍认为恐龙在 6600 万年前小行星终结其统治之前早已走向衰亡。然而发表在《科学》期刊的新研究对这一长期观点提出了挑战。研究结果显示，恐龙当时非但没有衰退，反而处于繁盛状态。美国新墨西哥州岩层中的化石距今 6640 万至 6600 万年，正好处于白垩纪与古近纪分界线的全球灭绝事件时期。化石证据呈现了与传统认知截然不同的景象。北美各地的恐龙非但没有减少，反而在独特的区域群落中蓬勃发展。通过分析生态与地理模式，研究人员发现北美西部的恐龙种群主要受区域温差影响（而非山脉或河流），形成了独立的“生物集群”。小行星撞击使恐龙时代骤然终结，但它们留下的生态系统成为新进化篇章的基础。仅 30 万年内，哺乳动物就开始快速分化，发展出新的食性、体型和生态角色。曾经定义恐龙生态系统的温度相关模式延续至古新世，指引着灾难后生命的复苏路径。

A vulnerability marked as critical has been reported in Planex MZK-DP300N up to 1.07. The affected element is an unknown function of the component Telnet. The manipulation leads to hard-coded credentials. This vulnerability is referenced as CVE-2025-62777. The attack needs to be initiated within the local network. No exploit is available.