守住数据安全的第一道防线——权限管理全解析
现代企业信息化建设愈发深入，数据安全愈发重要，权限和账号管理制度已经成为数据安全体系中的重中之重。这套“权限账号管理”制度从多个层面出发，确保各岗位人员仅能访问其必要的系统和数据，严控操作权限....
Aggregator
CVE-2008-4516 | galerie 3.2 galerie.php pic sql injection (EDB-6675 / XFDB-45698)
1 year 7 months ago
A vulnerability, which was classified as critical, was found in galerie 3.2. This affects an unknown part of the file galerie.php. The manipulation of the argument pic leads to sql injection.
This vulnerability is uniquely identified as CVE-2008-4516. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-4517 | geccBBlite 2.0 leggi.php id sql injection (EDB-6677 / XFDB-45682)
1 year 7 months ago
A vulnerability has been found in geccBBlite 2.0 and classified as critical. This vulnerability affects unknown code of the file leggi.php. The manipulation of the argument id leads to sql injection.
This vulnerability was named CVE-2008-4517. The attack can be initiated remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-4518 | Fastpublish CMS 1.9.9.9.9d/1.9999d index2.php artikel sql injection (EDB-6678 / XFDB-45671)
1 year 7 months ago
A vulnerability was found in Fastpublish CMS 1.9.9.9.9d/1.9999d and classified as critical. This issue affects some unknown processing of the file index2.php. The manipulation of the argument artikel leads to sql injection.
The identification of this vulnerability is CVE-2008-4518. The attack may be initiated remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-4519 | Fastpublish CMS 1.9.9.9.9d/1.9999d index2.php target path traversal (EDB-6678 / XFDB-45673)
1 year 7 months ago
A vulnerability was found in Fastpublish CMS 1.9.9.9.9d/1.9999d. It has been classified as critical. Affected is an unknown function of the file index2.php. The manipulation of the argument target leads to path traversal.
This vulnerability is traded as CVE-2008-4519. It is possible to launch the attack remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-4510 | Microsoft Windows-nt up to Vista resource management (EDB-6671 / XFDB-45719)
1 year 7 months ago
A vulnerability was found in Microsoft Windows-nt up to Vista. It has been classified as problematic. This affects an unknown part. The manipulation leads to improper resource management.
This vulnerability is uniquely identified as CVE-2008-4510. An attack has to be approached locally. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-5870 | FastStone Image Viewer 3.6 input validation (EDB-6673)
1 year 7 months ago
A vulnerability classified as problematic has been found in FastStone Image Viewer 3.6. Affected is an unknown function. The manipulation leads to improper input validation.
This vulnerability is traded as CVE-2008-5870. It is possible to launch the attack remotely. Furthermore, there is an exploit available.
vuldb.com
CVE-2008-5937 | Zkesoft AyeView 2.20 input validation (EDB-6672 / XFDB-48183)
1 year 7 months ago
A vulnerability classified as critical was found in Zkesoft AyeView 2.20. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper input validation.
This vulnerability is known as CVE-2008-5937. The attack can be launched remotely. Furthermore, there is an exploit available.
vuldb.com
fortify sca rules分析
1 year 7 months ago
fortify sca rules分析
1 year 7 months ago
fortify sca rules分析
1 year 7 months ago
fortify sca rules分析
1 year 7 months ago
fortify sca rules分析
1 year 7 months ago
fortify sca rules分析
1 year 7 months ago
CVE-2015-2854 | Blue Coat SSL Visibility Appliance up to 3.8.3 WebUI input validation (VU#498348 / XFDB-103491)
1 year 7 months ago
A vulnerability was found in Blue Coat SSL Visibility Appliance up to 3.8.3. It has been rated as critical. Affected by this issue is some unknown functionality of the component WebUI. The manipulation leads to improper input validation.
This vulnerability is handled as CVE-2015-2854. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
vuldb.com
开价20000美元！黑客宣称窃取诺基亚内部数据并出售
1 year 7 months ago
近期，一位名叫Intel Broker的黑客宣称通过第三方承包商非法访问了电信巨头诺基亚的敏感信息，并在BreachForums论坛上以20000美元的价格出售。尽管黑客声称未获取任何客户信息，但诺基
平行切面联盟：升级技术合作，加速生态共建，助力数字化转型可持续发展
1 year 7 months ago
环境异常 当前环境异常，完成验证后即可继续访问。 去验证
野蛮fuzz：快照与代码覆盖率
1 year 7 months ago
一介绍上次我们写博客时，我们有一个简单的模糊测试器，它会测试一个故意有漏洞的程序，该程序会对文件进行一些检查，如果输入文件通过了检查，它会继续进行下一个检查，如果输入通过了所有检查，程序就会发生段错误
Check Point Research 揭露2024 年第三季度品牌网络钓鱼趋势
1 year 7 months ago
2024 年 11月，领先的云端 AI 网络安全平台提供商 Check Point® 软件技术有限公司（纳斯达克股票代码：CHKP）的威胁情报部门 Check Point Research (CPR) 发布了其最新的 2024 年第三季度品牌网络钓鱼排行榜。本报告揭示了网络犯罪分子在企图诱骗和窃取个人信息或支付凭证时最常冒充的品牌，强调了网络钓鱼攻击在当今数字化环境中持续构成风险。
在第三季度，Microsoft 仍是最常被冒充的品牌，在所有品牌网络钓鱼攻击中占比 61%。Apple 蝉联第二，占比 12%；谷歌跃居第三，占比 7%。此外，阿里巴巴首次进入前十榜单，列居第七；Adobe 重返排行榜，位列第八，这是它自 2022 年第二季度以来首次上榜。技术行业仍是最常被冒充的行业，其次是社交网络和银行业，这说明主要在线服务提供商时刻不能放松警惕。
Check Point 软件技术公司数据事业部经理 Omer Dembinsky 指出：“网络钓鱼攻击持续肆虐表明，大家亟需提高安全意识并增强安全措施。用户必须保持警惕，核实电子邮件来源，避免点击可疑链接，并采用多重身份验证 (MFA) 来保护其个人和财务信息免受网络威胁。”
主要网络钓鱼品牌
以下是 2024 年第三季度按照在网络钓鱼攻击中的总出现率进行排名的十大最常被冒充的品牌：
1. Microsoft - 61%
2. Apple - 12%
3. 谷歌 - 7%
4. Facebook - 3%
5. WhatsApp - 1.2%
6. Amazon - 1.2%
7. 阿里巴巴 - 1.1%
8. Adobe - 0.8%
9. Twitter - 0.8%
10. 阿迪达斯 - 0.6%
针对 WhatsApp 用户的网络钓鱼骗局
经确认，一个新的网络钓鱼网站 whatsapp-io.com 对 WhatsApp 用户构成了严重威胁。该网站现已无法访问，其设计模仿了 WhatsApp 安全中心。它打着解决账户异常问题的幌子引诱用户输入个人信息，包括电话号码和所在国家或地区。该网站背后是一场大规模欺诈活动。在同一时间段内，还有多个类似的域名被注册和曝光，例如 whatsapp-as.com、whatsapp-ia.com 及 whatsapp-li.com。
阿里巴巴仿冒攻击
另一起值得关注的案例是恶意网络钓鱼网站 alibabashopvip\.com 冒充阿里巴巴电子商务零售品牌，该网站使用越南语，意在通过模仿阿里巴巴官方品牌和提供假冒产品来欺骗用户，诱使访客登录或注册，进而窃取其个人信息和付款信息。值得注意的是，阿里巴巴在本季度首次进入前十榜单。
随着针对知名品牌的网络钓鱼攻击日益增多，用户必须及时了解最新动态并积极采取在线安全防护措施，确保设备配有最新的安全软件，并对未经请求的通信保持警惕，从而显著降低遭受网络攻击的风险。
Check Point
这家网络安全公司要背时！黑客300美元出手重大安全研究项目的访问权
1 year 7 months ago
名为Engineer（工程师）的黑客11月5日发帖称，以300美元出售Rapid7的Project Sonar项目中合作伙伴的访问账户。