Aggregator

A vulnerability was found in Linux Kernel up to 5.15.112/6.1.80/6.3.3. It has been rated as critical. This impacts the function mi_init of the component ntfs3. This manipulation causes null pointer dereference. This vulnerability is handled as CVE-2023-53732. The attack can only be done within the local network. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability marked as critical has been reported in Linux Kernel up to 4.14.321/4.19.290/5.4.250/5.10.187/5.15.120. This affects the function netlink_set_err. The manipulation leads to deadlock. This vulnerability is referenced as CVE-2023-53731. The attack needs to be initiated within the local network. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Linux Kernel up to 5.10.187/5.15.120/6.1.38/6.3.12/6.4.3. Affected by this issue is the function adjust_inuse_and_calc_cost. Executing a manipulation can lead to deadlock. The identification of this vulnerability is CVE-2023-53730. The attack needs to be done within the local network. There is no exploit available. The affected component should be upgraded.

Злоумышленники создали идеального двойника популярного финансового инструмента.

【工具】xcanvas：开源代码指纹框架

Session 14A: Software Security: Applications & Policies

Authors, Creators & Presenters: Yue Xiao (IBM Research), Dhilung Kirat (IBM Research), Douglas Lee Schales (IBM Research), Jiyong Jang (IBM Research), Luyi Xing (Indiana University Bloomington), Xiaojing Liao (Indiana University)

PAPER
JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs

A Software Bill of Materials (SBOM) is a detailed inventory that lists the dependencies that make up a software product. Accurate, complete, and up-to-date SBOMs are essential for vulnerability management, reducing license compliance risks, and maintaining high software integrity. The US National Institute of Standards and Technology (NTIA) has established minimum requirements for SBOMs to comply with, especially the correctness and completeness of listed dependencies in SBOMs. However, these requirements remain unexamined in practice. This paper presents the first systematic study on the landscape of SBOMs, including their prevalence, release trends, and characteristics in the Java ecosystem. We developed an end-to-end tool to evaluate the completeness and accuracy of dependencies in SBOMs. Our tool analyzed 25,882 SBOMs and associated JAR files, identifying that 7,907 SBOMs failed to disclose direct dependencies, highlighting the prevalence and severity of SBOM noncompliance issues. Furthermore, 4.97% of these omitted dependencies were vulnerable, leaving software susceptible to potential exploits. Through detailed measurement studies and analysis of root causes, this research uncovers significant security implications of non-compliant SBOMs, especially concerning vulnerability management. These findings, crucial for enhancing SBOM compliance assurance, are being responsibly reported to relevant stakeholders.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – JBomAudit: Assessing The Landscape, Compliance, And Security Implications Of Java SBOMS appeared first on Security Boulevard.

2025年网络安全漏洞态势报告 by ourren

大模型在数据安全领域的应用探索 by tuhao

更多最新文章，请访问SecWiki

Just last week I wrote that CISA was on life support. That was before we knew how bad it really was. When Jen Easterly stepped down and the agency was left without a Senate-confirmed director, it was already troubling. The Cybersecurity and Infrastructure Security Agency — the nerve center for defending federal networks and coordinating..

The post Things Were Even Worse at CISA Than We Thought appeared first on Security Boulevard.

A vulnerability classified as problematic was found in Canon IJ Scan Utility up to 1.5.0 on Windows. Affected is an unknown function of the component Windows Service. The manipulation results in unquoted search path. This vulnerability was named CVE-2026-1585. The attack needs to be approached locally. There is no available exploit.

Cybersecurity researchers at Infoblox Threat Intel have uncovered a highly sophisticated phishing campaign that exploits the foundational plumbing of the internet to bypass enterprise security controls. In a novel evasion tactic, threat actors are weaponizing the .arpa top-level domain (TLD) and utilizing IPv6 tunnels to host malicious phishing content. This approach actively circumvents traditional domain reputation checks, […]

The post Phishing Schemes Abuse .arpa TLD and IPv6 Tunnels to Evade Detection appeared first on Cyber Security News.

根据发表在《Animal Behaviour》期刊上的一项研究，匈牙利研究人员对比了人在需要帮助时 18-24 个月的幼儿、以及宠物狗和猫的反应。结果显示，狗的自发性亲社会行为与幼儿类似，而猫则是冷眼旁观。在实验中，熟人如父母或主人假装在寻找一个藏起来的东西，四分之三的情况下狗和幼儿会提供帮助。猫只有在符合自身利益时才会参与进来提供帮助。

South Korea's National Tax Service accidentally exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release, allowing hackers to steal 6.4 billion won ($4.8M) worth in cryptocurrency. [...]

In light of today’s attack by the U.S. and Israel on Iran, it is prudent to ask: What can Iran do? Strip away everything Iran had a year ago and ask yourself what’s left. Their nuclear program? Set back years, maybe a decade. Their air defenses? Dismantled across two conflicts. Hezbollah? Degraded to the point..

The post Iran Has One Card Left—It’s Pointed at Your Network appeared first on Security Boulevard.

A vulnerability labeled as problematic has been found in nats-io nats-server up to 2.11.11/2.12.2. Impacted is an unknown function of the component WebSockets Handler. The manipulation results in highly compressed data. This vulnerability is identified as CVE-2026-27571. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability described as critical has been identified in Tattile Smart+, Tolling+, Smart+ Speed, Smart+ Traffic Light, Axle Counter, Vega53, Vega33, Vega11, Basic MK2 and ANPR Mobile up to 1.181.5. Affected is an unknown function of the component RTSP Service. Executing a manipulation can lead to missing authentication. This vulnerability is tracked as CVE-2026-26340. The attack can be launched remotely. No exploit exists.

A vulnerability classified as critical has been found in Beyond Limits Altec DocLink 4.0.336.0. Affected by this vulnerability is an unknown functionality of the component .NET Remoting Endpoint. The manipulation leads to deserialization. This vulnerability is listed as CVE-2026-26222. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in Mastodon up to 4.4.13/4.5.6. Affected by this issue is some unknown functionality of the component FASP Feature. The manipulation of the argument EXPERIMENTAL_FEATURES results in missing authorization. This vulnerability is cataloged as CVE-2026-27468. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as critical, has been found in NVIDIA Cumulus Linux GA, Cumulus Linux LTS and NVOS. This affects an unknown part of the component NVUE Interface. This manipulation causes incorrect privilege assignment. This vulnerability is registered as CVE-2025-33179. The attack requires access to the local network. No exploit is available.

A vulnerability, which was classified as critical, was found in NVIDIA Cumulus Linux GA, Cumulus Linux LTS and NVOS. This vulnerability affects unknown code of the component NVUE Interface. Such manipulation leads to command injection. This vulnerability is documented as CVE-2025-33180. The attack requires being on the local network. There is not any exploit available.

A vulnerability has been found in NVIDIA Cumulus Linux GA, Cumulus Linux LTS and NVOS and classified as critical. This issue affects some unknown processing of the component NVUE Interface. Performing a manipulation results in command injection. This vulnerability is reported as CVE-2025-33181. The attack requires a local approach. No exploit exists.