Aggregator

HELLCAT's grep is Claiming to Sell RDP Access of an Unidentified Insurance Company in Turkey

A vulnerability was found in Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56/8.57. It has been classified as critical. Affected is an unknown function of the component OpenSSL. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2018-0734. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Oracle Enterprise Communications Broker PCz3.0/PCz3.1/PCz3.2. Affected by this issue is some unknown functionality of the component Security. The manipulation leads to key management error. This vulnerability is handled as CVE-2018-0734. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Oracle Enterprise Session Border Controller 7.5/8.0/8.1/8.2/8.3. This affects an unknown part of the component Security. The manipulation leads to key management error. This vulnerability is uniquely identified as CVE-2018-0734. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle Enterprise Manager Base Platform 12.1.0.5.0/13.2.0.0.0/13.3.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality of the component Discovery Framework. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2018-0734. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Oracle Enterprise Manager Ops Center 12.3.3. This affects an unknown part of the component Networking. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2018-0734. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Oracle API Gateway 11.1.2.4.0. Affected is an unknown function of the component OpenSSL. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2018-0734. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Oracle Tuxedo 12.1.1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OpenSSL. The manipulation leads to information disclosure. This vulnerability is known as CVE-2018-0734. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Enterprise Backup up to 3.12.3/4.1.2. It has been rated as critical. This issue affects some unknown processing of the component Enterprise Backup. The manipulation leads to information disclosure. The identification of this vulnerability is CVE-2018-0734. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

Findings reveal growing cybersecurity risks in ecommerce, exposing vulnerabilities in PII handling and lack of basic security protections like HTTPS and WAFs

Desertstorm Claims to have Leaked FTP Access of Radio Rencontre

From May 1 to July 31, 2024, ReliaQuest analyzed customer incident data and cybercriminal forums to identify common MITRE ATT&CK TTPs and gather additional intelligence.

Authors/Presenters: Stephen Sims

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – The Rise and Fall of Binary Exploitation appeared first on Security Boulevard.

On November 14, 2024, Cloudflare experienced a Cloudflare Logs outage, impacting the majority of customers using these products. During the ~3.5 hours that these services were impacted, about 55% of the logs we normally send to customers were not sent and were lost. The details of what went wrong and why are interesting both for customers and practitioners.

A vulnerability, which was classified as problematic, was found in Mortbay Jetty. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2009-4612. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

Botconf 2024 议题慢递 by Avenger

Chrome扩展攻击指南（三）：全局视角 by tmr

Chrome扩展攻击指南（二）：漏洞分析 by tmr

Chrome扩展攻击指南（一）：基础知识 by tmr

更多最新文章，请访问SecWiki

虽然网络安全行业裁员降薪一片哀嚎，但是网络犯罪组织却“求贤若渴”。 根据Cato Networks发布的《2024年第三季度SASE威胁报告》，网络犯罪趋于“专业化”，开始积极招募渗透测试员来优化勒索软件性能。同时，未授权的人工智能（影子AI）的流行正威胁企业数据安全和合规性。 报告总结了2024年网络安全领域的四大新趋势，如下： 1 勒索软件“研发升级”：积极招募渗透测试员 Cato Networks的报告揭示，勒索软件团伙正在积极招募渗透测试员，以测试和提高其勒索软件的可靠性。通过模拟攻击，渗透测试员可以大大提高勒索软件在企业环境中部署的成功率。 “勒索软件是当今网络安全领域最普遍的威胁之一，几乎所有企业和消费者都可能受到影响，”Cato Networks首席安全策略师Etay Maor指出，“我们观察到这些团伙正在努力通过招募渗透测试员来优化他们的攻击手段，为未来的攻击做好准备。” 这一趋势反映出勒索软件正在走向“企业化”和“专业化”，试图通过技术手段提升攻击成功率，这对企业网络安全防御提出了更高的要求。 2 数据隐私的头号威胁：影子AI 所谓影子AI，是指未经IT部门或安全团队批准的AI工具和应用程序在企业内部的私自使用。这种行为通常绕过正式的审查流程，给企业的安全合规性带来隐患。 Cato Networks监控的数百种AI应用中，有10款被企业用户广泛采用（如Bodygram、Craiyon、Otter.ai、Writesonic等）存在数据泄漏风险。报告指出，这些应用最主要的风险在于数据隐私问题。员工通过影子AI工具处理敏感信息，可能无意间导致信息泄露。 “影子AI是2024年浮现的一大安全威胁，”Maor表示，“企业必须警惕未授权AI工具的使用，并教育员工避免无意中暴露敏感数据。” 3 打击隐蔽威胁的关键：TLS流量检视 传输层安全（TLS）流量的加密使得恶意活动更难被检测到，但许多企业由于担心影响正常业务，选择不启用TLS流量的检视或只对部分流量进行检查。据Cato Networks的研究，只有45%的企业启用了TLS检视，其中仅有3%的企业对所有TLS加密会话进行全面检测。 报告显示，在启用TLS检视的企业中，阻止的恶意流量比未启用TLS检视的企业高出52%。此外，企业在TLS流量中成功拦截了60%的已知漏洞利用行为（包括Log4j、SolarWinds和ConnectWise相关的CVE漏洞）。 4 网络犯罪分子的首选策略：品牌滥用 网络犯罪分子也在积极利用知名品牌的影响力实施网络攻击。通过域名抢注（Cybersquatting），他们冒用知名品牌的域名，进行网络钓鱼、传播恶意软件、托管盗版软件，甚至实施欺诈。 攻击者冒充知名品牌不仅能增强攻击的可信度，还能绕过许多传统的安全检测手段，给企业和消费者带来巨大风险。企业需要加强品牌保护策略，同时通过安全教育提高用户对域名和网络钓鱼攻击的警惕性。       转自GoUpSec，原文链接：https://mp.weixin.qq.com/s/_pNLKfPKFQDvWFfUzYePPg 封面来源于网络，如有侵权请联系删除

供应链管理公司 Blue Yonder 警告称，勒索软件攻击对其服务造成了严重破坏，并影响了英国的杂货店连锁店。 Blue Yonder（前身为 JDA Software）是松下的子公司，年收入超过 10 亿美元，全球拥有 6,000 名员工。 该公司为零售商、制造商和物流供应商提供人工智能驱动的供应链解决方案，包括需求预测、库存优化和运输管理。 其 3,000 名客户中包括 DHL、雷诺、拜耳、莫里森、雀巢、3M、特易购、星巴克、Ace Hardware、宝洁、桑斯伯里和 7-Eleven 等知名组织。 勒索软件攻击破坏供应链 周五，该公司警告称，由于前一天（11 月 21 日）发生的勒索软件事件，其托管服务托管环境正在遭遇中断。 公告中写道：“2024 年 11 月 21 日，Blue Yonder 的托管服务托管环境出现中断，经确定是勒索软件事件导致的。” “自从得知这一事件以来，Blue Yonder 团队一直在与外部网络安全公司密切合作，以在恢复过程中取得进展。我们已经实施了多项防御和取证。” lue Yonder 声称在其公共云环境中未检测到任何可疑活动，并且仍在处理多种恢复策略。 托管服务环境是指 Blue Yonder 代表其客户运营的基础设施和系统，通常包括 SaaS 平台和用于供应链运营的云托管解决方案。 正如预期的那样，这直接影响到了客户，英国连锁杂货店 Morrisons 的一位发言人向媒体证实，他们已经恢复了较慢的备份流程。 Sainsbury 告诉 CNN，他们已经制定了应急计划来克服这一中断。 周六的更新通知客户，受影响的服务仍在继续恢复，但目前还不能透露全面恢复的具体时间表。 周日发布的另一条更新消息重申了同样的观点，敦促客户在未来几天内关注 Blue Yonder 网站上的客户更新页面。 截至发稿时，该公司尚未发布有关情况的最新消息，因此推测托管服务环境仍然受到影响。 尚未看到任何勒索软件团伙宣布对 Blue Yonder 攻击事件负责。     转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/wfhGm_pYJ1EjyddcmPJAiA 封面来源于网络，如有侵权请联系删除