Aggregator

国家标准一图读懂！

数据显示，2024年60岁及以上的美国人在网络诈骗中损失高达7亿美元，这标志着针对老年人的欺诈案件呈急剧上升趋势。

Pistachio CTO Zack Korman 披露微软 Windows AI 助手 M365 Copilot 的一个 bug，它对文件的访问会不记录在审计日志内，这意味着如果有人能操纵 Copilot 他们能匿名其访问痕迹，对企业而言这是一个严重的安全隐患。微软和其它科技公司一样，正全力押注 AI，将 AI 整合到旗下的各种产品中，Windows 11 就整合了 Copilot 助手。Zack Korman 发现如果要求 Copilot 访问一个文件，摘录其内容，在回复中不要链接文档地址，那么在日志里就不会留下访问记录。他在 7 月初向微软报告了该 bug，微软在 8 月中旬修复了 bug，但没有赋予 CVE 编号，也没有披露该 bug。

A vulnerability labeled as problematic has been found in Nutanix Prism Central. This vulnerability affects unknown code of the component Events. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2024-12223. The attack may be performed from a remote location. There is no available exploit. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Six Apart Movable Type, Movable Type Advanced and Movable Type Premium. This affects an unknown part of the component Password Reset. This manipulation causes use of less trusted source. This vulnerability is tracked as CVE-2025-53522. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as problematic has been discovered in Fujifilm Healthcare Americas Synapse Mobility 8.0.0/8.0.1/8.0.2/8.1.0/8.1.1. Affected by this issue is some unknown functionality of the component Search. The manipulation results in external control of assumed-immutable web parameter. This vulnerability is identified as CVE-2025-54551. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Six Apart Movable Type, Movable Type Advanced and Movable Type Premium. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Password Reset Page. The manipulation leads to open redirect. This vulnerability is referenced as CVE-2025-55706. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in Commvault CommCell up to 11.32.101/11.36.59. It has been declared as critical. Affected is an unknown function of the component API Call Handler. Executing manipulation can lead to use of hard-coded password. The identification of this vulnerability is CVE-2025-57788. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Commvault CommCell up to 11.32.101/11.36.59. It has been classified as critical. This impacts an unknown function. Performing manipulation results in argument injection. This vulnerability was named CVE-2025-57791. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in Commvault CommCell up to 11.32.101/11.36.59 and classified as very critical. This affects an unknown function. Such manipulation leads to absolute path traversal. This vulnerability is uniquely identified as CVE-2025-57790. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability has been found in Commvault CommCell up to 11.32.101/11.36.59 and classified as problematic. The impacted element is an unknown function of the component Administrator Login Handler. This manipulation causes storing passwords in a recoverable format. This vulnerability is handled as CVE-2025-57789. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in Microsoft Knack 0.12.0. The affected element is an unknown function of the component knack.introspection. The manipulation results in inefficient regular expression complexity. This vulnerability is known as CVE-2025-54364. Attacking locally is a requirement. No exploit is available.

A vulnerability, which was classified as problematic, has been found in Microsoft Knack 0.12.0. Impacted is an unknown function of the component knack.introspection. The manipulation leads to inefficient regular expression complexity. This vulnerability is traded as CVE-2025-54363. An attack has to be approached locally. There is no exploit available.

A vulnerability classified as critical was found in Google Chrome. This issue affects some unknown processing of the component V8. Executing manipulation can lead to out-of-bounds write. This vulnerability appears as CVE-2025-9132. The attack may be performed from a remote location. There is no available exploit. Upgrading the affected component is advised.

A sophisticated new Remote Access Trojan named GodRAT has emerged as a significant threat to financial institutions, leveraging deceptive screen saver files and steganographic techniques to infiltrate organizational networks. First detected in September 2024, this malware campaign has demonstrated remarkable persistence, with the most recent attacks observed as recently as August 12, 2025, indicating an […]

The post New GodRAT Weaponizing Screen Saver and Program Files to Attack Organizations appeared first on Cyber Security News.

A cybersecurity researcher has disclosed zero-day clickjacking vulnerabilities affecting eleven major password managers, potentially exposing tens of millions of users to credential theft through a single malicious click. The research, conducted by security expert Marek Tóth, reveals that attackers can exploit these vulnerabilities to steal credit card details, personal information, login credentials, and even two-factor […]

The post 0-Day Clickjacking Vulnerabilities Found in Major Password Managers like 1Password, LastPass and Others appeared first on Cyber Security News.

火绒安全团队收到多位用户反馈，称在安装某些工具类软件时遭遇广告弹窗及其他流氓行为。鉴于此前已有类似反馈，火绒工程师高度重视，对捕获的样本进行重点分析发现，其主要通过捆绑在Zip解压缩、PDF转换器及录屏软件等常用工具的安装包中进行传播。

LudusHound is an open-source tool that takes BloodHound data and uses it to set up a working Ludus Range for safe testing. It creates a copy of an Active Directory environment using previously gathered BloodHound data. Red teams can use this lab to map attack paths and test ways to exploit misconfigurations before trying them on real systems. Blue teams can use it to practice defense strategies and strengthen AD security, testing configuration changes in … More →

The post LudusHound: Open-source tool brings BloodHound data to life appeared first on Help Net Security.

Версия 2.51 хоронит SHA-1 и открывает новую эру безопасности для всех проектов.