Aggregator

基于价值理念的《中国数字安全价值图谱》更新版来了。

文章描述了一个名为CVE-2024-28080的Gitblit SSH服务认证绕过漏洞。该漏洞允许攻击者在未持有私钥的情况下通过空密码绕过身份验证。问题源于Gitblit与MINA SSHD库的交互设计，在公钥验证失败后未正确重置状态，导致后续密码验证被绕过。此漏洞影响所有支持SSH公钥认证的旧版本，并于2025年6月通过版本1.10修复。

A sophisticated supply chain attack has compromised the popular Nx build platform, affecting millions of weekly downloads and resulting in widespread credential theft.  The attack, dubbed “s1ngularity,” represents one of the most comprehensive credential harvesting campaigns targeting the developer ecosystem in 2025. GitGuardian observed that malicious actors infiltrated multiple Nx package versions (20.9.0 through 21.8.0) […]

The post Nx Packages With Millions of Weekly Downloads Hacked With Credential Stealer Malware appeared first on Cyber Security News.

根据发表在《科学》期刊上的一项研究，黄石公园内自由迁徙的野牛群不但改善了养分循环，而且提升了生态系统健康。北美历史上曾有着数千万头的野牛；它们的季节性迁徙改变了这片大陆广袤的草原生态系统。曾经数量庞大的野生、自由迁徙的野牛群如今已不复存在；它们目前仅存约 40 万头，且几乎全都以小群管控的形式存在于私人土地或公园和保护区内。野牛在黄石公园北部生态系统中的迁徙活动提供了一个难得的天然实验场所。研究人员在 2015 年至 2022 年间追踪了野牛在三大栖息地的 16 个地点的动态，测量了它们对碳氮动态、植物群落和土壤微生物学的影响。研究人员发现，野牛在加速氮循环、增加地上氮含量和改善景观营养品质的同时也稳定了植物的产量。研究结果表明，大型迁徙食草动物对生态的影响力不仅在于它们的体型，而且还在于它们的数量、密度和自由迁徙能力。

A vulnerability classified as critical has been found in code-projects Simple Grading System 1.0. This affects an unknown part of the file /delete_account.php of the component Admin Panel. Performing manipulation of the argument ID results in sql injection. This vulnerability was named CVE-2025-9667. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability described as critical has been identified in code-projects Simple Grading System 1.0. Affected by this issue is some unknown functionality of the file /delete_student.php of the component Admin Panel. Such manipulation of the argument ID leads to sql injection. This vulnerability is uniquely identified as CVE-2025-9666. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability marked as critical has been reported in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_student.php of the component Admin Panel. This manipulation of the argument ID causes sql injection. This vulnerability is handled as CVE-2025-9665. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability labeled as critical has been found in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. This vulnerability is known as CVE-2025-9664. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability identified as critical has been detected in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. This vulnerability is traded as CVE-2025-9663. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability categorized as critical has been discovered in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel. Executing manipulation can lead to sql injection. This vulnerability appears as CVE-2025-9662. The attack may be performed from a remote location. In addition, an exploit is available.

Cybercriminals are increasingly turning their sights from desktop to mobile, exploiting Meta’s advertising platform to distribute a sophisticated Android banking trojan disguised as a free TradingView Premium app. Bitdefender Labs warns that these threat actors have shifted tactics after months of targeting Windows users with fake trading and cryptocurrency ads, now focusing worldwide on smartphone […]

The post Threat Actors Use Facebook Ads to Deliver Android Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

《网络与信息系统安全指令2》（NIS 2）在意大利的实施标志着网络安全法律的重大变革。从“软法”到“硬法”的转变使最佳实践成为法律义务，改变了企业的责任框架。传统“组织过失”原则被更严格的客观标准取代，企业需证明合规性以避免法律责任。这一变革重塑了网络安全合规要求和企业治理结构。

Submit #637258 / VDB-321874

Submit #637257 / VDB-321873

Submit #637256 / VDB-321872

Submit #637255 / VDB-321871

Submit #637254 / VDB-321870

Submit #637252 / VDB-321869

美国商务部长 Howard Lutnick 宣布该部门将在区块链上发布经济数据，首批发布的数据将是 GDP。但他没有澄清使用哪种区块链，是比特币区块链还是某种定制的区块链。商务部长称这是特朗普总统推动美国成为“加密货币政府”计划的一部分。Lutnick 称特朗普是加密货币总统，他表示在商务部落实所有细节后，可能会扩大到其它联邦部门。

荷兰情报部门警告中国关联的APT组织"盐台风"针对当地关键基础设施进行网络间谍活动。该组织被多国情报机构追踪，攻击全球电信、政府、交通等领域。荷兰确认部分发现，并建议持续监控以减少风险。