Aggregator

GitHub is calling on maintainers of open source projects to apply for the newly opened Secure Open Source Fund, to get funding and knowledge to improve the security and sustainability of their software. The program is funded by companies (AmEx Chainguard, Microsoft, 1Password, Shopify, Stripe, etc.), venture funds (e.g., Mayfield Fund) and nonprofits (e.g., the Alfred P. Sloan Foundation). About the program Applicants that get chosen will receive, among other things: $10,000 per project (delivered … More →

The post GitHub Secure Open Source Fund: Project maintainers, apply now! appeared first on Help Net Security.

Oracle Linux offers a secure, streamlined platform for deploying and managing applications across on-premises, cloud, and edge environments. Designed for demanding workloads, it includes tools for automation, virtualization, high availability, cloud-native development, Kubernetes, and more. Oracle Linux, 9 Update 5 for the 64-bit Intel and AMD (x86_64) and 64-bit Arm (aarch64) platforms is now generally available. This release is packaged with the following kernel options: Unbreakable Enterprise Kernel (UEK) Release 7 Update 3, 5.15.0-302.167.6 for … More →

The post Oracle Linux 9 Update 5 brings security updates, OpenJDK 17, .NET 9.0 appeared first on Help Net Security.

半导体国际团体 SEMI 的资料显示，中国的半导体自给率从 2014 年的 14% 左右上升到 2023 年的 23%，预计到 2027 年将接近 27%。推动构建中国自主的半导体供应链的是政策性基金。首先 2014 年设立的“国家集成电路产业投资基金(大基金)”达到 1387 亿元规模设，2019 年追加了超过 2000 亿元的二期。今年 5 月推出的三期超过 3440 亿元，规模正不断扩大。随着国产化的进展，企业业绩表现强劲。据中国调查公司 Wind 的数据，中国内地半导体相关上市企业 2024 年 1～9 月财报显示，营业收入和净利润的合计与上年同期相比增加了约 20%。中芯国际的联合首席执行官赵海军在 8 日的财报说明会上表示，国产化需求急剧增加是强劲业绩的背景。

A vulnerability, which was classified as very critical, has been found in Zope. Affected by this issue is some unknown functionality. The manipulation leads to improper privilege management. This vulnerability is handled as CVE-2011-3587. The attack may be launched remotely. Furthermore, there is an exploit available.

Quantum announces the DXi9200, the latest generation of its flagship DXi9000 Series hybrid (flash + dense disk) data protection appliances, designed for scalable, efficient backup and recovery services for large organizations. With the continuing threat of ransomware attacks, organizations need to take a comprehensive and proactive approach to secure their data and data copies, continuously validate recovery operations, and quickly recover in case of attack. As the industry’s most scalable, feature-rich, and efficient data protection … More →

The post Quantum DXi9200 helps organizations manage and reduce cybersecurity risks appeared first on Help Net Security.

A vulnerability, which was classified as critical, has been found in Advanced Order Export For WooCommerce up to 1.5.3 on WordPress. This issue affects some unknown processing. The manipulation leads to injection. The identification of this vulnerability is CVE-2018-11525. Attacking locally is a requirement. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Advanced Order Export Plugin 3.1.3 on WooCommerce. Affected by this vulnerability is an unknown functionality of the file view/settings-form.php. The manipulation of the argument woe_post_type as part of Parameter leads to cross site scripting. This vulnerability is known as CVE-2020-11727. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Advanced Order Export up to 3.1.7 on WooCommerce. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2021-27349. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Advanced Order Export for WooCommerce Plugin up to 3.1.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Admin Panel. The manipulation of the argument tab leads to cross site scripting. This vulnerability is known as CVE-2021-24169. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in AlgolPlus Advanced Order Export for WooCommerce Plugin up to 3.3.1 on WordPress. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability was named CVE-2022-35275. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Advanced Order Export For WooCommerce Plugin up to 3.3.2 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. This vulnerability is handled as CVE-2022-40128. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in WP Project Manager Plugin up to 2.6.14 on WordPress. This issue affects some unknown processing of the component Task Handler. The manipulation leads to missing authorization. The identification of this vulnerability is CVE-2024-10520. The attack may be initiated remotely. There is no exploit available.

Threat actors are increasingly banking on a new technique that leverages near-field communication (NFC) to cash out victim's funds at scale. The technique, codenamed Ghost Tap by ThreatFabric, enables cybercriminals to cash-out money from stolen credit cards linked to mobile payment services such as Google Pay or Apple Pay and relaying NFC traffic. "Criminals can now misuse Google Pay and Apple

In today’s rapidly evolving digital landscape, ensuring the security of your software supply chain is more critical than ever. At ReversingLabs, we are excited to announce our latest integration with ServiceNow, designed to provide comprehensive Software Bill of Materials (SBOM) management and enhance your security operations. As a member of the ServiceNow Partner Program, ReversingLabs is dedicated to driving innovative solutions. The ServiceNow Partner Program is designed to foster collaboration and innovation among its partners. Building partnerships is a vital component of the Partner Program, which enables build partners like Reversinglabs to develop and integrate applications on the Now Platform.

The post Strengthening Supply Chains: ReversingLabs Now Integrates with ServiceNow appeared first on Security Boulevard.

“智能助理+智能检测+智能治理”一体化风险治理闭环

Как создаются обширные вредоносные сети на десятки тысяч IoT-девайсов?

微软于 11 月 20 日释出了《微软飞行模拟 2024》。在 Steam 平台玩家留下了“差评如潮”的评价，Xbox 玩家也留下了 2/5 星的评分。相比《微软飞行模拟 2020》可选择下载不同地区地图离线游戏，新版本减少了容量，改为强制性的通过微软 Azure 云服务在线串流数据，结果玩家在开始游戏时遭遇了各种问题。微软会继续支持《微软飞行模拟 2020》，而玩家在前作中购买的飞机或机场可以带到新版中，每游戏一小时玩家大约需要串流 5GB 左右的数据，新版改进了动物的反应行为，羊会避雨，鸟会迁徙，大象会注意你的飞行。

CrowdStrike unveiled a new Chinese-aligned hacking group allegedly spying on telecom providers

A vulnerability was found in Django CMS Attributes Fields up to 3.x. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-11406. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in UserPlus Plugin up to 2.0 on WordPress and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to incorrect privilege assignment. This vulnerability is handled as CVE-2024-52442. The attack may be launched remotely. There is no exploit available.