Aggregator

一、境外厂商产品漏洞

本周信息安全漏洞威胁整体评价级别为中。

A new Mirai-based botnet, “Hail Cock Botnet,” has been exploiting vulnerable IoT devices, including DigiEver DVRs and TP-Link devices with CVE-2023-1389. The botnet, active since September 2024, leverages a variant of Mirai malware with enhanced encryption.  A recent uptick in attacks targeting the URI /cgi-bin/cgi_main.cgi, exploiting an RCE vulnerability in DigiEver DS-2105 Pro devices, aligns […]

The post DigiEver IoT Devices Exploited To Deliver Mirai-based Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A joint Cybersecurity Advisory (CSA) warns of ongoing exploitation attempts by Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors using the online persona “CyberAv3ngers.”  These actors are targeting and compromising Unitronics Vision Series programmable logic controllers (PLCs), specifically those manufactured by the Israeli company Unitronics. Water and Wastewater Systems (WWS) are among the many critical […]

The post Hackers Exploiting PLC Controllers In US Water Management System To Gain Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybersecurity threats are increasingly targeting vulnerabilities in publicly exposed assets like VPNs and firewalls, exploited by various actors, including APT groups and ransomware gangs.  While this focus is understandable, it’s crucial not to neglect traditional attack vectors like phishing emails, malicious websites, and social engineering, as they remain potent tools in the hands of attackers. […]

The post New Watering Hole Attack That Used Fake Adobe Flash Player Update To Deliver Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability was found in OpenEMR up to 5.0.1.3. It has been rated as critical. This issue affects some unknown processing of the file portal/import_template.php of the component Patient Portal. The manipulation of the argument docid as part of Directory leads to path traversal. The identification of this vulnerability is CVE-2018-15141. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in F-Secure Anti-Virus and classified as critical. Affected by this vulnerability is an unknown functionality of the component ZIP Archive Handler. The manipulation leads to improper privilege management. This vulnerability is known as CVE-2004-0771. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

Ever wished you could instantly extract all email addresses from a document or clean up messy data w

A vulnerability, which was classified as critical, was found in Cybozu Garoon. Affected is an unknown function. The manipulation of the argument iid leads to sql injection. This vulnerability is traded as CVE-2006-4444. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

因云存储配置不当

关注我们带你读懂网络安全据悉，暴露的数据库包含个人敏感数据和公司运营数据，事件归因为云存储配置不当。前情回顾·全球数据泄漏态势背调公司发生超大规模数据泄漏，一亿美国人隐私信息暴露国内某上市公司疑遭勒索

关注我们带你读懂网络安全美国政府发布了关于云服务安全实践实施的指导意见。2024年12月17日，美国网络安全与基础设施安全局（Cybersecurity and Infrastructure Secu

再次入选NDSS 2025！

再次入选NDSS 2025！

再次入选NDSS 2025！