Aggregator

想象一下轮子能滚过各种障碍物，甚至能爬楼梯。韩国机械与材料研究所（Korea Institute of Machinery and Materials）的研究人员研发出一种能变形的轮子，可以滚过 1.3 倍于其半径高度的障碍物。它的设计受到了水滴表面张力的启发，遇到障碍物时会从固态变成流体状态。变形轮由外圈链条和一系列通过轮毂的辐条组成。辐条的刚度会根据传感器对地形的反应自动调节。研究人员演示了配备变形轮的原型轮椅，能爬上 18 厘米高的台阶。

A vulnerability was found in Binance BTC, Crypto and NFTS 2.85.4. It has been classified as critical. Affected is an unknown function of the component Fingerprint Authentication. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2024-31695. The attack needs to be done within the local network. There is no exploit available.

Digital lending has emerged as a game-changer, reshaping the borrowing experience with unprecedented speed, convenience, and accessibility. Gone are the days of endless paperwork and prolonged waiting times—now, individuals can secure loans within minutes from the comfort of their homes. However, as financial transactions shift to digital platforms, the importance of adhering to compliance standards […]

The post What is Digital Lending Application (DLA) Audit? appeared first on Kratikal Blogs.

The post What is Digital Lending Application (DLA) Audit? appeared first on Security Boulevard.

A vulnerability was found in tsMuxer nightly-2024-03-14-01-51-12 and classified as critical. This issue affects some unknown processing of the component TS Video File Handler. The manipulation leads to stack-based buffer overflow. The identification of this vulnerability is CVE-2024-41206. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in tsMuxer nightly-2024-03-14-01-51-12 and classified as critical. This vulnerability affects unknown code of the component MOV Video File Handler. The manipulation leads to heap-based buffer overflow. This vulnerability was named CVE-2024-41209. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in tsMuxer nightly-2024-05-12-02-01-18. This affects an unknown part of the component MOV Video File Handler. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-49778. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in unclebob FitNesse 20220319. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-39610. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Virtuozzo Hybrid Server 1.7.1. Affected by this vulnerability is an unknown functionality. The manipulation of the argument hostname leads to cross site scripting. This vulnerability is known as CVE-2024-40579. The attack can be launched remotely. There is no exploit available.

《规定》 旨在规范关键信息基础设施商用密码的使用，确保其安全性和有效性。

A vulnerability classified as problematic has been found in Jobs for WordPress Plugin up to 2.7.7 on WordPress. Affected is an unknown function of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-10104. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Baxter Life2000 Ventilation System up to 06.08.00.00. It has been rated as critical. This issue affects some unknown processing of the component Serial Interface. The manipulation leads to improper physical access control. The identification of this vulnerability is CVE-2024-48973. It is possible to launch the attack on the physical device. There is no exploit available.

A vulnerability was found in Baxter Life2000 Ventilation System up to 06.08.00.00. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to hard-coded credentials. This vulnerability was named CVE-2024-48971. The attack needs to be approached locally. There is no exploit available.

A vulnerability was found in Baxter Life2000 Ventilation System up to 06.08.00.00. It has been classified as problematic. This affects an unknown part. The manipulation leads to insufficient logging. This vulnerability is uniquely identified as CVE-2024-48967. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Baxter Life2000 Ventilation System up to 06.08.00.00 and classified as critical. Affected by this issue is some unknown functionality of the component Internal JTAG Interface. The manipulation leads to on-chip debug and test interface with improper access control. This vulnerability is handled as CVE-2024-48970. It is possible to launch the attack on the physical device. There is no exploit available.

据Cyber Security News消息，研究人员最近在高级人工智能图像生成模型中发现了一个潜在的安全漏洞，能够在无意中泄露敏感系统指令，尤其是在高级扩散模型 Recraft 中。 近来，以Stable Diffusion 和 Midjourney 为代表的图像生成模型在人工智能生成图像领域掀起了一场革命。Invicti 的安全研究人员称，Invicti 公司的安全研究人员发现，这些模型的工作原理是通过一种称为 “去噪 “的过程，将随机噪音逐渐细化为清晰的图片。 目前在文本到图片排行榜上处于领先地位的 Recraft 所展示的功能已经超越了典型的扩散模型。研究人员注意到，Recraft 可以完成图像生成模型通常无法完成的语言任务。 例如，当提示数学运算或地理问题时，Recraft 会生成包含正确答案的图像，而其他模型则不同，它们只是将文本可视化，而无法理解。 此外，进一步的调查还发现，Recraft 采用了两级架构： 大型语言模型 (LLM) 处理和改写用户提示信息，以及将处理后的提示传递给扩散模型。这种独特的方法使 Recraft 能够处理复杂的查询，并生成更准确、更能感知上下文的图像。 不过也带来了一个潜在的漏洞。 通过仔细实验，研究人员发现某些提示可以诱使系统泄露部分内部指令。 通过生成带有特定提示的多个图像，研究人员能够拼凑出用于指导大模型行为的系统提示片段。 一些泄露的说明包括：以 “法师风格 “或 “形象风格 “开始描述、提供物体和人物的详细描述、将说明转化为描述性句子、包括具体的构图细节、避免使用 “太阳 “或 “阳光 “等词语、必要时将非英语文本翻译成英语。 这种无意中泄露系统提示的行为引起了人们对人工智能模型的安全性和隐私性的极大关注。 如果恶意行为者能够提取敏感指令，他们就有可能操纵系统、绕过安全措施或深入了解专有的人工智能技术。 这一事件为 AI 开发人员和研究人员敲响了警钟，随着 AI 不断进步并更深入地融入我们生活的各个方面，确保这些系统的安全性和完整性变得至关重要。     转自Freebuf，原文链接：https://www.freebuf.com/news/415336.html 封面来源于网络，如有侵权请联系删除

A vulnerability has been found in Baxter Life2000 Ventilation System up to 06.08.00.00 and classified as very critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. This vulnerability is known as CVE-2024-48966. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Insyde IHISI up to 05.29.18/05.38.18/05.46.18/05.54.18/05.61.18. Affected is an unknown function of the component UEFI Handler. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2024-39707. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Baxter Life2000 Ventilation System up to 06.08.00.00. This issue affects some unknown processing of the component Serial Interface. The manipulation leads to cleartext transmission of sensitive information. The identification of this vulnerability is CVE-2024-9834. The attack needs to be approached locally. There is no exploit available.

A vulnerability classified as critical was found in unclebob FitNesse 20220319. This vulnerability affects unknown code. The manipulation leads to path traversal. This vulnerability was named CVE-2024-42499. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as very critical has been found in GeoVision GV-VS12, GV-VS11, GV-DSP_LPR_V3, GVLX 4 V2 and GVLX 4 V3. This affects an unknown part. The manipulation leads to os command injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is uniquely identified as CVE-2024-11120. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to replace the affected component with an alternative.