Aggregator

采购文件暗藏杀机——PureRAT木马针对电商定向窃密

原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅

Группировка провела около 100 успешных взломов со средним ущербом 10–12 млн рублей.

A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe. A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data leak. Security researchers Denis and Aleksander Rostilov of ExPatch found a stored cross-site scripting flaw in the […]

Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]

Алгоритм впервые взял на себя почти всю атомную сборку от поиска деталей до проверки результата.

Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11. Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a VPN device to access its Government Solution Service (GSS), potentially leaking personal information belonging to approximately 246,000 government employees, public […]

网安圆桌派|山石芯声系列 第三期 匠心铸芯·安全落地 山石网科ASIC芯片的硬核极致打磨之路

Debian 是全球最具影响力的开源 Linux 发行版项目之一，一口气更新106个软件包。

Секретная архитектура больше не спасает системы от чужого анализа.

ИИ породил вайбпентестинг и резко снизил порог для атакующих.

Работодатель видит одного человека, документы принадлежат другому, а работу через VPN выполняет третий участник схемы.

Для эксперимента не понадобились взлом, закрытые базы или доступ к избирательным машинам.

Currently trending CVE - Hype Score: 10

Currently trending CVE - Hype Score: 11 - Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network.

Currently trending CVE - Hype Score: 11 - OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency ...

Currently trending CVE - Hype Score: 14 - The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by ...

Currently trending CVE - Hype Score: 14 - The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via ...

Currently trending CVE - Hype Score: 14 - The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, ...