Aggregator

模糊测试并未发现这一漏洞

The security researcher who notified the media of the breach will be free from the city's lawsuit, but not without a caveat.

A Threat Actor Has Allegedly Leaked Employee Data of Balcia Insurance SE

A vulnerability classified as problematic was found in Bruno up to 1.29.0. Affected by this vulnerability is the function shell.openExternal of the component electron. The manipulation leads to Privilege Escalation. This vulnerability is known as CVE-2024-48463. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in IBM WebSphere Application Server 8.5/9.0. Affected is an unknown function. The manipulation leads to xml external entity reference. This vulnerability is traded as CVE-2024-45086. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Samsung Mobile Processor, Wearable Processor and Modem Exynos. It has been rated as critical. This issue affects some unknown processing of the component GPRS Protocol Handler. The manipulation leads to out-of-bounds write. The identification of this vulnerability is CVE-2024-45185. The attack needs to be initiated within the local network. There is no exploit available.

A vulnerability was found in Chamilo LMS 1.11.26. It has been declared as problematic. This vulnerability affects unknown code of the file /main/social/home.php. The manipulation leads to cross-site request forgery. This vulnerability was named CVE-2024-30617. The attack can be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Chamilo LMS 1.11.26. It has been classified as problematic. This affects an unknown part of the file /main/inc/ajax/message.ajax.php?a=get_count_message. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-30619. The attack can only be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

The bug affected accounts with 52-character user names, and had several pre-conditions that needed to be met in order to be exploited.

Moroccan Conquest Team Targeted the Website of U.S. Department of Energy and Legacy Management

HIMARS DDOS Targeted the Website of Umnye Seti

Threat actors are abusing DocuSign's Envelopes API to create and mass-distribute fake invoices that appear genuine, impersonating well-known brands like Norton and PayPal. [...]

ShadowDefenders Targeted the Website of The Jewish voice

SYLHET GANG-SG Defaced the Website of Saudi Journalists Association

Companies are attaching the artificial intelligence term to everything these days, but in cybersecurity, machine learning is more than hype.

Understand the key differences between MDR and MSSP and choose the right cybersecurity service to protect your business.

The post MDR vs. MSSP: Making the Right Choice for Your Business appeared first on D3 Security.

The post MDR vs. MSSP: Making the Right Choice for Your Business appeared first on Security Boulevard.

Incident Responders Say Disruptions Help, See No Spike in Median Ransom Payments
For anyone dreaming of law enforcement agencies arresting ransomware bigwigs, or intelligence agencies taking them out with drone strikes, keep on hoping. But here's good news: ransom payments haven't skyrocketed, as disruptions by law enforcement appear to be having an impact.

Mozilla Researcher Uses Non-Natural Language to Jailbreak GPT-4o
Anyone can jailbreak GPT-4o's security guardrails with hexadecimal encoding and emojis. A Mozilla researcher demonstrated the jailbreaking technique, tricking OpenAI's latest model into generating python exploits and malicious SQL injection tools.

Authors/Presenters: Aviad Hahami

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – OH MY DC Abusing OIDC All The Way To Your Cloud appeared first on Security Boulevard.