Aggregator

A vulnerability classified as critical has been found in Netgear R7000P 1.3.0.8. Affected is an unknown function. The manipulation of the argument openvpn_server_ip leads to buffer overflow. This vulnerability is traded as CVE-2022-44197. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Netgear R7000P 1.3.1.64. Affected by this issue is some unknown functionality. The manipulation of the argument openvpn_server_ip leads to buffer overflow. This vulnerability is handled as CVE-2022-44199. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability has been found in Netgear R7000P 1.3.0.8 and classified as critical. This vulnerability affects unknown code of the file /usr/sbin/httpd. The manipulation of the argument wan_dns1_sec leads to buffer overflow. This vulnerability was named CVE-2022-44184. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability was found in ZTE MF286R. It has been rated as critical. This issue affects some unknown processing of the component Phonebook Interface. The manipulation leads to sql injection. The identification of this vulnerability is CVE-2022-39066. The attack needs to be done within the local network. There is no exploit available.

A vulnerability classified as critical has been found in ZTE MF286R. Affected is an unknown function of the component Wifi Interface. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-2022-39067. The attack needs to be initiated within the local network. There is no exploit available.

知道创宇404实验室星链计划项目更新情况。

知道创宇404实验室星链计划项目更新情况。

Microsoft announced that hotpatching support for Windows Server 2025 will become generally available as a subscription service starting July 1, 2025. This move expands a key feature-previously exclusive to Azure-based servers-for broader use in on-premises and multicloud environments via Azure Arc. What is Hotpatching? Hotpatching is a revolutionary update mechanism that patches the in-memory code […]

The post Windows Server 2025 Gets Hotpatching Support Beginning July 1, 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Учёные залезли в голову Reddit-пользователей через фальшивые исповеди.

Bugcrowd’s new service connects customers with a global network of vetted ethical hackers for a variety of red team engagements—fully managed through the Bugcrowd Platform. This release sets a new benchmark in the red team services market, enabling organizations to test their security environments with the highest level of confidence. By tapping into a global pool of experts using the latest adversarial tactics, techniques, and procedures (TTPs), customers gain unparalleled insight into how real-world attackers … More →

The post Bugcrowd enables organizations to test their security environments appeared first on Help Net Security.

A vulnerability classified as problematic was found in ZoneMinder. This vulnerability affects unknown code of the component HTTP GET Request Handler. The manipulation leads to cross-site request forgery. This vulnerability was named CVE-2022-39290. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, has been found in Bus Pass Management System 1.0. Affected by this issue is some unknown functionality. The manipulation of the argument searchdata leads to cross site scripting. This vulnerability is handled as CVE-2022-35155. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Mozilla Thunderbird up to 91.7 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2022-28289. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in SolarWinds Orion Platform 2018.4 HF3 up to 2020.2.5. This vulnerability affects unknown code of the component QoE Application. The manipulation leads to cross site scripting. This vulnerability was named CVE-2022-36965. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

Опыт Банка «Санкт-Петербург».

现代汽车引入了常见于流媒体服务的订阅模式，车主需要支付月费或年费才能解锁从免手动驾驶系统、加热座椅到自动记录事故摄像头等额外功能。但汽车订阅模式所需的额外网络连接可能会增加司机受到政府监控的风险，增加被警方调查的可能性。《连线（WIRED）》调查了逾二十份警方记录，显示警方定期接受如何利用联网汽车的培训，而订阅功能会大幅增加了警方调查期间可访问的数据量。文件显示，配备 OnStar 订阅服务的通用汽车传输的数据量是福特汽车的两倍，其传输的数据包括了泄漏汽车位置的信息。警方文件显示，汽车厂商经常会通过试用吸引车主使用订阅功能，即使车主没有选择订阅，车载设备仍然会与手机塔等设备进行通信。

根据 Akamai 的最新报告，2024 年Web 攻击增加了 33%，其中 API 成为主要攻击目标。

ProjectDiscovery作为2024年RSAC创新沙盒入围企业，专注于攻击面管理，以开源社区驱动的资产与漏洞发现工具著称。其明星项目Nuclei通过高效的模板扫描技术，助力企业快速识别风险，展...

根据 Akamai 的最新报告，2024 年Web 攻击增加了 33%，其中 API 成为主要攻击目标。

Kali предупреждает о критическом сбое в цепочке доверия.