Aggregator

Webshell的文件免杀可参考以下链接，通过unicode编码就可以实现

https://xz.aliyun.com

RAD Security this week at the Black Hat USA 2024 conference revealed it has added artificial intelligence (AI) capabilities to its cloud detection and response (CDR) platform as part of an ongoing effort to reduce dependencies on signatures that need to be developed before threats can be detected.

The post RAD Security Combines AI With Behavioral Analytics to Improve Cybersecurity appeared first on Security Boulevard.

A vulnerability classified as critical has been found in FreeBSD. This affects an unknown part of the component OpenSSH. The manipulation leads to race condition. This vulnerability is uniquely identified as CVE-2024-7589. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

在拉斯维加斯举行的黑帽大会（BLACK HAT USA 2024）上，来自德国 CISPA 亥姆霍兹信息安全中心的一组研究人员披露了影响基于 RISC-V 架构的流行 CPU 的新漏洞细节。 RISC-V是一种开源指令集架构 (ISA)，旨在为各种类型的应用开发定制处理器，包括嵌入式系统、微控制器、数据中心和高性能计算机。 CISPA 研究人员发现中国芯片公司 T-Head （阿里巴巴旗下的平头哥半导体）生产的玄铁 C910 CPU 中存在漏洞。据专家介绍，玄铁 C910 是速度最快的 RISC-V CPU 之一。 这个被称为GhostWrite 的漏洞允许具有有限权限的攻击者读取和写入物理内存，从而可能使他们获得对目标设备的完全和不受限制的访问权限。 虽然 GhostWrite 漏洞特定于玄铁 C910 CPU，但已确认多种类型的系统受到影响，包括云服务器中的 PC、笔记本电脑、容器和虚拟机。 研究人员列出的易受攻击的设备列表包括 Scaleway Elastic Metal RV 裸机云实例；Sipeed Lichee Pi 4A、Milk-V Meles 和 BeagleV-Ahead 单板计算机 (SBC)；以及一些 Lichee 计算集群、笔记本电脑和游戏机。 “要利用此漏洞，攻击者需要在易受攻击的 CPU 上执行非特权代码。这对多用户和云系统构成威胁，或者在执行不受信任的代码时，甚至在容器或虚拟机中也是如此。”研究人员解释道。 为了展示他们的研究结果，研究人员展示了攻击者如何利用 GhostWrite 获取 root 权限或从内存中获取管理员密码。 与之前披露的许多CPU 攻击不同，GhostWrite 不是侧信道攻击，也不是瞬时执行攻击，而是一个架构错误。 研究人员向 T-Head 报告了他们的发现，但目前尚不清楚该供应商是否采取了任何行动。SecurityWeek在本文发表前几天联系了 T-Head 的母公司阿里巴巴征求意见，但尚未得到回复。 云计算和网络托管公司 Scaleway 也已收到通知，研究人员表示该公司正在向客户提供缓解措施。 值得注意的是，该漏洞是一个硬件错误，无法通过软件更新或补丁修复。禁用 CPU 中的矢量扩展可以减轻攻击，但也会影响性能。 研究人员告诉SecurityWeek，尚未为 GhostWrite 漏洞分配 CVE 标识符。 虽然没有迹象表明该漏洞已被利用，但 CISPA 研究人员指出，目前还没有特定的工具或方法来检测攻击。 研究人员发表的论文中提供了更多技术信息。他们还发布了一个名为 RISCVuzz 的开源框架，用于发现 GhostWrite 和其他 RISC-V CPU 漏洞。   转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/aO8kr865bmh1VSlC4fIPPQ 封面来源于网络，如有侵权请联系删除

和老周一起玩转赛博文化街~

A vulnerability was found in FreeBSD. It has been rated as problematic. Affected by this issue is the function readdir of the component NFS Client. The manipulation leads to injection. This vulnerability is handled as CVE-2024-6759. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in FreeBSD. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component ktrace. The manipulation leads to information disclosure. This vulnerability is known as CVE-2024-6760. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to apply a patch to fix this issue.

16 名居住在日本名古屋市等地的 10 至 20 多岁年轻人向名古屋地方法院提起诉讼，为抑制气候变化造成的负面影响，要求 10 家电厂削减火力发电产生的二氧化碳（CO2）排放。起诉书称，被告是国内最大规模的 CO2 排放企业，有义务遵循提出把全球平均气温升幅控制在比工业革命前高 1.5 度以内的《巴黎协定》目标进行减排。起诉书主张称，人为排放导致原告等面临气候变化引发的严重灾害危险，以及社团活动等时的中暑风险，且有预测显示今后会受到更严重影响。

A vulnerability was found in FreeBSD. It has been classified as critical. Affected is an unknown function of the component pf. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2024-6640. It is possible to launch the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

The ransomware strain known as BlackSuit has demanded as much as $500 million in ransoms to date, with one individual ransom demand hitting $60 million. That's according to an updated advisory from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). "BlackSuit actors have exhibited a willingness to negotiate payment amounts," the

A vulnerability was found in Kadence Gutenberg Blocks with AI Plugin up to 3.2.38 on WordPress and classified as problematic. This issue affects some unknown processing of the component Post Handler. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2024-6884. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Search & Filter Pro Plugin up to 2.5.17 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-6481. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-7272. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Unbound up to 1.19.3. Affected by this issue is the function cfg_mark_ports of the file config_file.c. The manipulation leads to heap-based buffer overflow. This vulnerability is handled as CVE-2024-43168. It is possible to launch the attack on the local host. There is no exploit available.

A vulnerability classified as problematic was found in Unbound. Affected by this vulnerability is an unknown functionality. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2024-43167. Access to the local network is required for this attack. There is no exploit available.

A vulnerability classified as problematic has been found in daniyalahmedk Fuse Social Floating Sidebar Plugin up to 5.4.10 on WordPress. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-5226. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in 10web Slider Plugin up to 1.2.57 on WordPress. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument id leads to sql injection. The identification of this vulnerability is CVE-2024-7150. The attack may be initiated remotely. There is no exploit available.

在美国黑帽大会上（Black Hat USA），Bitdefender和Transilvania Quantum的研究人员将展示攻击者如何针对基于量子技术的基础设施进行攻击。

已修复

奇安信中标某大型国有银行安全测试开源组件安全评估项目，再一次彰显了奇安信在开源安全治理领域的专业实力和市场认可度，同时也反映出金融行业对于提升信息技术基础设施安全性的重视程度。