Aggregator
Mastering Crypto Technical Analysis: A Journey To Informed Trading And Investment Strategies
1 year 7 months ago
Diving into the world of crypto technical analysis has been an exhilarating journey for me. The thrill of deciphering market patterns and making informed predictions is unmatched. It’s like piecing together a puzzle where each chart and indicator tells a story, guiding me through the volatile yet exciting landscape of cryptocurrencies. I remember the first […]
The post Mastering Crypto Technical Analysis: A Journey To Informed Trading And Investment Strategies appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Febia Sharon
Effective Crypto Risk Management: Strategies For Smart Investing
1 year 7 months ago
Navigating the world of cryptocurrency can feel like stepping into a thrilling new frontier. I remember my first foray into digital assets, filled with excitement and a touch of apprehension. The potential for growth was immense, but I quickly realised the importance of managing risks to protect my investments. Crypto risk management isn’t just about […]
The post Effective Crypto Risk Management: Strategies For Smart Investing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Febia Sharon
Master Crypto Portfolio Diversification For Risk Reduction And Growth Potential
1 year 7 months ago
Diving into the world of cryptocurrency can feel like stepping into a bustling bazaar, with a myriad of options vying for your attention. When I first started exploring crypto investments, it was clear that diversification was key to navigating this dynamic landscape. By spreading my investments across different cryptocurrencies, I discovered a way to balance […]
The post Master Crypto Portfolio Diversification For Risk Reduction And Growth Potential appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Febia Sharon
How Decentralised Finance (DeFi) Is Revolutionising The Financial World
1 year 7 months ago
Diving into the world of decentralised finance, or DeFi, feels like stepping into the future of finance itself. I’ve witnessed firsthand how DeFi is reshaping the way we think about money and financial services. Gone are the days when traditional banks held all the power; now, with just a smartphone and an internet connection, anyone […]
The post How Decentralised Finance (DeFi) Is Revolutionising The Financial World appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Febia Sharon
微软提醒，Windows 11 更新导致 SSH 连接中断
1 year 7 months ago
微软已经确认，上个月的Windows安全更新正在破坏Windows 11 22H2和23H2系统上的SSH连接。 这个新确认的问题影响了企业、物联网(IoT)和教育客户，微软表示，只有“有限数量”的设备受到影响。 微软还在调查使用Windows 11家庭版或专业版的消费者客户是否受到影响。 “在安装2024年10月安全更新后，一些客户报告称OpenSSH（开放安全外壳）服务无法启动，阻止了SSH连接。”公司在10月补丁星期二KB5044285累积更新和KB5044380预览更新的支持文档更新中解释道。 “该服务失败时没有详细的日志记录，需要手动干预才能运行sshd.exe进程。” 在修复可用之前，受影响的客户仍然可以通过更新受影响目录上的访问控制列表(ACL)权限来临时修复这些SSH连接问题，具体步骤如下： 1. 以管理员身份打开PowerShell。 2. 更新“C:\ProgramData\ssh和C:\ProgramData\ssh\logs”文件夹的权限（并对“C:\ProgramData\ssh\logs”重复这些步骤），允许SYSTEM和管理员组完全控制权限，同时允许经过身份验证的用户读取权限。如果需要，你可以通过修改权限字符串来限制特定用户或组的读取权限。 3. 使用以下Powershell脚本更新权限： 微软正在积极寻找解决方案，该方案将通过即将到来的Windows更新推出。 11月9日，公司透露10月补丁星期二更新解决了影响Windows 11 24H2设备的指纹传感器冻结问题。 在指纹问题解决后，还删除了阻止受影响系统上Windows 11 24H2升级的安全防护。 上个月，微软修复了9月预览累积更新中的一个已知问题，该问题阻止一些应用程序在非管理员账户下启动在Windows 10 22H2系统上运行。 还解决了另一个问题，该问题导致安装了7月安全更新后，Windows服务器在企业网络中中断远程桌面连接。 转自E安全，原文链接：https://mp.weixin.qq.com/s/C_1CleTFPGiEOkdGNUe8og 封面来源于网络，如有侵权请联系删除
内容转载
注意喚起: 2024年11月マイクロソフトセキュリティ更新プログラムに関する注意喚起 (公開)
1 year 7 months ago
盛邦安全API安全治理方案荣获 “金帽子”「年度优秀行业解决方案」奖
1 year 7 months ago
随着数字化转型的加速，API在能源行业中的应用日益广泛，已经覆盖了移动端业务转型、第三方服务支撑、前后端数据分离等各类业务场景。然而，API的广泛应用也带来了暴露面扩大的安全风险。
面向能源行业业务风险防控的API安全治理方案
以业务风险识别与防护控制为核心目标，该方案通过对业务流量识别分析、数据和行为建模、算法分析等技术，实现了API接口的全面识别与梳理、数据调用保护、接口访问安全控制及审计等全方位的安全能力；不仅显著增强了能源系统对外部接口交互的安全管控能力，更有效降低了业务运营中的安全风险，确保了能源系统的安全稳定运行与数据的安全流转。
应用场景一：重保期间的接口攻击防护
场景需求： 在重保期间，针对API接口的安全检查与攻击防范是重点专项，既需要能够详细记录攻击信息，还需要具备攻击画像与线索追溯的能力，同时能够实现主动的接口探查与自测。
解决方案： 盛邦安全方案提供主动接口测试、接口攻击监测及防护、多维攻击画像分析及溯源等功能，帮助用户全面防御恶意攻击。
接口主动测试自查：实现主动的接口试探，助力高效开展接口测试与自查工作。
接口攻击监测与防护：提供全面的接口安全防护，实时监测并防御接口注入、跨站脚本、逻辑漏洞、非法爬虫及恶意扫描等攻击。
攻击画像与线索追溯：深入进行攻击者多维画像分析，精准追溯攻击轨迹，为安全事件调查与响应提供有力支持。
应用场景二：接口暴露面收敛与监测
场景需求： 能源企业在快速发展的过程中，需要对外开放大量信息发布、功能调用或数据调取类的API接口，尤其是部分新型业务紧急上线，开发期间安全性未做充分考虑，因而造成互联网暴露面风险加剧。能源企业亟需控制API风险暴露面，避免数据泄露等事件的发生。
解决方案：该方案提供接口弱点探测、隐私信息监控以及针对接口的攻击防护，有效降低暴露面风险。
接口风险探测：实施周期性接口及相关系统的主动扫描与持续监测，确保及时发现并预警潜在的安全风险。
隐私信息监测：精准识别敏感数据，统计其调用频次与数量，并实施相应的调用限制措施，确保隐私信息的安全。
接口攻击防护：针对接口爬虫、越权访问、注入攻击等威胁，进行实时监测与旁路阻断拦截，全面提升接口安全防护能力。
应用场景三：数据流转安全合规监控
场景需求： 能源行业数据接口与数据中台涉及大量隐私与敏感数据，无论内外流转，均需确保调用权限合规及数据安全。而传统管理体系与技术手段不足，需强化核心数据调用的合规监控。
解决方案：该方案提供了详细的数据调用监控、调用行为识别及数据流转防护功能，保障数据在流转过程中的合规性和安全性。
数据调用全面监控：精确追踪账号身份、访问时间、地理位置、客户端或浏览器类型，以及目标系统（含系统名、域名、IP地址）的具体API接口和数据调用行为，实现数据调用全程可视化。
调用行为智能识别：基于事件记录深度分析，智能判断调用访问的合规性、业务逻辑性、接口安全性，同时监测数据泄露风险及跨境传输合规性，确保业务与数据双重安全。
数据流转接口防护：在精准识别接口的基础上，构建数据监控与保护体系，提升应急响应与跨部门协同能力。
目前，盛邦安全的API安全治理方案已成功应用于多家大型能源企业，大幅提升了用户系统在外部接口交互中的安全管控能力，显著降低了运营过程中的安全风险，保障了能源系统的稳健运行与数据的安全流通。
在全球数字化浪潮的推动下，中国数字经济迅速发展，网络安全在推动产业高质量发展中发挥着重要作用。嘶吼主办的“金帽子”年度评选旨在表彰在安全技术、产品创新和服务升级等方面做出卓越贡献的企业与机构，今年吸引了数百家安全厂商的积极参与。盛邦安全此次获奖，是对其在前沿技术探索和关键行业深耕方面的再次认可。
API安全治理不仅是防范风险的有力屏障，更是激发创新活力的关键。未来，盛邦安全将继续探索前沿技术，优化API安全治理方案，助力各行业用户在数字化转型中稳步迈进，实现创新与安全的共赢。
盛邦安全
CVE-2024-33803 | campcodes Complete Web-Based School Management System 1.0 /model/get_exam.php id sql injection
1 year 7 months ago
A vulnerability has been found in campcodes Complete Web-Based School Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /model/get_exam.php. The manipulation of the argument id leads to sql injection.
This vulnerability is known as CVE-2024-33803. The attack can be launched remotely. There is no exploit available.
vuldb.com
CVE-2023-30308 | Ruijie EG210G-P/EG105G-V2/NBR/EG105G TCP denial of service
1 year 7 months ago
A vulnerability was found in Ruijie EG210G-P, EG105G-V2, NBR and EG105G. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component TCP Handler. The manipulation leads to denial of service.
This vulnerability is known as CVE-2023-30308. The attack can be launched remotely. There is no exploit available.
vuldb.com
CVE-2024-31684 | Bitdefender Mobile Security 4.11.3-gms API access control
1 year 7 months ago
A vulnerability was found in Bitdefender Mobile Security 4.11.3-gms. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component API. The manipulation leads to improper access controls.
This vulnerability is known as CVE-2024-31684. It is possible to launch the attack on the physical device. There is no exploit available.
vuldb.com
CVE-2024-38394 | GNOME Settings Daemon up to 46.0 USB improper authorization (ID 780)
1 year 7 months ago
A vulnerability has been found in GNOME Settings Daemon up to 46.0 and classified as critical. This vulnerability affects unknown code of the component USB Handler. The manipulation leads to improper authorization.
This vulnerability was named CVE-2024-38394. It is possible to launch the attack on the physical device. There is no exploit available.
The real existence of this vulnerability is still doubted at the moment.
vuldb.com
CVE-2024-37086 | VMware ESXi/Cloud Foundation out-of-bounds
1 year 7 months ago
A vulnerability, which was classified as problematic, was found in VMware ESXi and Cloud Foundation. This affects an unknown part. The manipulation leads to out-of-bounds read.
This vulnerability is uniquely identified as CVE-2024-37086. An attack has to be approached locally. There is no exploit available.
It is recommended to apply a patch to fix this issue.
vuldb.com
CVE-2024-38480 | Kakao Piccoma Piccoma App prior 6.20.0 on Android/ API Key hard-coded credentials
1 year 7 months ago
A vulnerability was found in Kakao Piccoma Piccoma App on Android/. It has been classified as problematic. This affects an unknown part of the component API Key Handler. The manipulation leads to hard-coded credentials.
This vulnerability is uniquely identified as CVE-2024-38480. Attacking locally is a requirement. There is no exploit available.
It is recommended to upgrade the affected component.
vuldb.com
CVE-2024-36457 | Broadcom Symantec Privileged Access Management up to 3.4.6/4.1.7 PAM Endpoint improper authentication
1 year 7 months ago
A vulnerability was found in Broadcom Symantec Privileged Access Management up to 3.4.6/4.1.7. It has been classified as critical. Affected is an unknown function of the component PAM Endpoint. The manipulation leads to improper authentication.
This vulnerability is traded as CVE-2024-36457. It is possible to launch the attack remotely. There is no exploit available.
vuldb.com
CVE-2023-4699 | Mitsubishi Electric MELSEC-F/MELSEC iQ-F data authenticity (icsa-23-306-03)
1 year 7 months ago
A vulnerability, which was classified as very critical, has been found in Mitsubishi Electric MELSEC-F and MELSEC iQ-F. Affected by this issue is some unknown functionality. The manipulation leads to insufficient verification of data authenticity.
This vulnerability is handled as CVE-2023-4699. The attack may be launched remotely. There is no exploit available.
vuldb.com
以色列支付龙头遭 DDoS 攻击，各地超市加油站等 POS 机瘫痪
1 year 7 months ago
以色列各地的信用卡刷卡设备在周日（10日）出现故障，疑似由于网络攻击影响了支撑这些设备运行的通信服务。 超市和加油站的顾客因设备故障无法进行支付，事件持续了大约一个小时。 据《耶路撒冷邮报》报道，故障原因是当地支付网关公司Hyp旗下产品CreditGuard遭到分布式拒绝服务（DDoS）攻击。 这次攻击扰乱了信用卡终端与更广泛的支付系统之间的通信，但并未导致任何信息或支付数据被盗取。 Hyp公司发言人向《耶路撒冷邮报》透露，已排除了针对公司网络和基础设施进行更大规模干扰的可能性。发言人表示，DDoS攻击主要针对“公司部分服务及与公司连接的通信提供商”，但攻击在被发现后迅速得到了遏制，服务也很快恢复正常。 以伊冲突引爆网络威胁态势 目前尚不清楚谁是此次攻击的幕后主使。据《以色列时报》报道，以色列第12频道新闻和陆军电台均指出，一个与伊朗有关的黑客组织声称对此次攻击负责，但是并未提供具体信源。 此次事件与今年10月份发生的类似攻击事件相似。当时，支付公司Sheba也遭遇DDoS攻击。那次攻击持续了大约三小时，导致支付中断。由于Sheba在以色列国家支付系统中扮演重要角色，借记卡支付的审批过程也因此受到了延迟。 自10月7日恐怖袭击以来，因地区冲突，以色列的民用基础设施遭遇了更多网络攻击，主要是由与伊朗和真主党相关的黑客团体以及其他政治动机驱动的黑客活动主义者发起的。 这些团体发动的网络攻击不仅影响了以色列本土，还波及了该地区之外的民用基础设施。去年，爱尔兰西部的一个偏远地区因亲伊朗黑客组织攻击一台设备，导致当地居民两天无法用水。黑客声称该设备由以色列公司犹尼康（Unitronics）制造。 当时，美国联邦政府也发布警告，表示正在处理针对犹尼康可编程逻辑控制器（PLC）的活跃攻击。这些控制器广泛应用于包括宾夕法尼亚州阿里奎帕市政水务局在内的许多水务部门。 转自安全内参，原文链接：https://www.secrss.com/articles/72299 封面来源于网络，如有侵权请联系删除
内容转载
CVE-2008-5604 | Drennansoft My Simple Forum 4.1 index.php action path traversal (EDB-7342 / XFDB-47097)
1 year 7 months ago
A vulnerability, which was classified as critical, was found in Drennansoft My Simple Forum 4.1. Affected is an unknown function of the file index.php. The manipulation of the argument action leads to path traversal.
This vulnerability is traded as CVE-2008-5604. It is possible to launch the attack remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-5957 | Mydyngallery 1.4.2 index.php directory sql injection (EDB-7343 / XFDB-47087)
1 year 7 months ago
A vulnerability has been found in Mydyngallery 1.4.2 and classified as critical. This vulnerability affects unknown code of the file index.php. The manipulation of the argument directory leads to sql injection.
This vulnerability was named CVE-2008-5957. The attack can be initiated remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-5962 | Gravity-gtd 0.2/0.3/0.4/0.4.5 objectname path traversal (EDB-7344 / XFDB-47090)
1 year 7 months ago
A vulnerability classified as critical has been found in Gravity-gtd 0.2/0.3/0.4/0.4.5. This affects an unknown part. The manipulation of the argument objectname leads to path traversal.
This vulnerability is uniquely identified as CVE-2008-5962. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
vuldb.com