每日安全资讯（2023-08-05）

• Sploitus.com Exploits RSS Feed
  • PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS exploit
  • Shelly PRO 4PM v0.11.0 - Authentication Bypass exploit
  • Adiscon LogAnalyzer 4.1.13 Cross Site Scripting exploit
  • Web Portal People CMS 2.8 Open Redirection exploit
  • Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting exploit
  • Voodoo Chat 1.0RC1b Information Disclosure exploit
  • VOC++ Business Special Edition Creatiff Original 1.3 Information Disclosure exploit
  • WordPress EventON Calendar 4.4 Insecure Direct Object Reference exploit
  • Joomla JLex Review 6.0.1 - Reflected XSS exploit
  • WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS exploit
  • Virtual Snipers DMS 1.0 SQL Injection exploit
  • Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS) exploit
  • Webedition CMS v2.9.8.8 - Stored XSS exploit
  • Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload exploit
  • Academy LMS 6.0 - Reflected XSS exploit
  • Canon PIXMA TR4550 1.020 / 1.080 Unencrypted Secret Storage exploit
  • VideoPRO CMS 2.0 Insecure Settings exploit
  • Coupons CMS 5.00 Open Redirect exploit
  • Webutler 3.2 Shell Upload exploit
  • Kolibri 2.0 Buffer Overflow exploit
  • Videoplay 1.3.0 Insecure Settings exploit
  • Diebold Nixdorf Vynamic View Console 5.3.1 DLL Hijacking exploit
  • Shelly PRO 4PM 0.11.0 Authentication Bypass exploit
  • Exploit for Race Condition in Linux Linux Kernel exploit
  • Exploit for Improper Authentication in Ivanti Endpoint Manager Mobile exploit
  • Exploit for Improper Access Control in Papercut Papercut Ng exploit
  • Exploit for Cross-site Scripting in Ninjaforms Ninja Forms exploit
  • Exploit for CVE-2023-38497 exploit
  • Exploit for Cross-site Scripting in Cpanel exploit
• SecWiki News
  • SecWiki News 2023-08-04 Review
• Trustwave Blog
  • CISO Connect: Insights on Strategic Partnerships and Threat Readiness
• HackerOne Hacker Activity
  • Privilege Escalation in kOps using GCE/GCP Provider
• Files ≈ Packet Storm
  • Debian Security Advisory 5466-1
  • Canon PIXMA TR4550 1.020 / 1.080 Unencrypted Secret Storage
  • Ubuntu Security Notice USN-6274-1
  • Intelliants Subrion CMS 4.2.1 Remote Code Execution
  • Citrix ADC (NetScaler) Remote Code Execution
  • GNU Transport Layer Security Library 3.7.10
  • Debian Security Advisory 5464-1
  • WordPress Adivaha Travel 2.3 Cross Site Scripting
  • Red Hat Security Advisory 2023-4475-01
  • Ubuntu Security Notice USN-6273-1
  • Debian Security Advisory 5465-1
  • Red Hat Security Advisory 2023-4471-01
  • Xlight FTP Server 3.9.3.6 Stack Buffer Overflow
  • Red Hat Security Advisory 2023-4472-01
  • Ubuntu Security Notice USN-5064-3
  • WordPress EventON Calendar 4.4 Insecure Direct Object Reference
  • WordPress Ninja Forms 3.6.25 Cross Site Scripting
  • Ubuntu Security Notice USN-6275-1
  • COURIER DEPRIXA 2.5 Cross Site Request Forgery
  • Webedition CMS 2.9.8.8 Cross Site Scripting
  • Webedition CMS 2.9.8.8 Remote Code Execution
  • Webutler 3.2 Shell Upload
  • Red Hat Security Advisory 2023-4461-01
  • Ubuntu Security Notice USN-6272-1
  • Videoplay 1.3.0 Insecure Settings
• unSafe.sh - 不安全
  • The 2023 MES Midmarket 100
  • 黑客解锁了特斯拉需要额外付费的软件功能
  • Kilimanjaro – Journal
  • 用RSSHub替代Feed43
  • 海表面温度创下了 20.96C 的新纪录
  • The end looms for Meta's behavioural advertising in Europe
  • Microsoft Teams used in phishing campaign to bypass multi-factor authentication
  • Decompile C++ using NSA Ghidra
  • CVE-2023-39143: PaperCut Path Traversal/File Upload RCE Vulnerability
  • The Good, the Bad and the Ugly in Cybersecurity – Week 31
  • IMDShift - Automates Migration Process Of Workloads To IMDSv2 To Avoid SSRF Attacks
  • 研究证实很多人感觉他们的工作毫无意义
• Twitter @Nicolas Krassas
  • chromecookiestealer: Steal/Inject Chrome cookies over the DevTools protocol https://securityonline.info/chromecookiestealer-steal-inject-chrome-cookie...
  • Researchers Jailbreak Tesla Vehicles, Gain Control Over Paid Features https://www.hackread.com/jailbreak-tesla-vehicles-access-paid-features/
  • Fake VMware vConnector package on PyPI targets IT pros https://www.bleepingcomputer.com/news/security/fake-vmware-vconnector-package-on-pypi-targets-i...
  • IMDShift - Automates Migration Process Of Workloads To IMDSv2 To Avoid SSRF Attacks http://www.kitploit.com/2023/08/imdshift-automates-migration-proce...
  • Malicious npm Packages Found Exfiltrating Sensitive Data from Developers https://thehackernews.com/2023/08/malicious-npm-packages-found.html
  • Political Milestones for AI https://www.schneier.com/blog/archives/2023/08/political-milestones-for-ai.html
  • Attackers use dynamic code loading to bypass Google Play store’s malware detections https://securityaffairs.com/149150/hacking/google-play-malware-ve...
  • Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform https://samcurry.net/points-com/
  • Targeted npm Malware Attempts to Steal Company Source Code https://www.reddit.com/r/netsec/comments/15hd257/targeted_npm_malware_attempts_to_steal_com...
  • Russia's Cozy Bear is back and hitting Microsoft Teams to phish top targets https://go.theregister.com/feed/www.theregister.com/2023/08/03/microsoft_t...
  • Nuked-MD-FPGA -- cycle-accurate Sega Genesis/MD hardware implementation based on reverse-engineering console's chips https://www.reddit.com/r/ReverseE...
  • Film companies lose battle to unmask Reddit users https://www.malwarebytes.com/blog/news/2023/08/old-reddit-posts-come-back-to-haunt-users-in-piracy-c...
  • Couple admit they laundered $4B in stolen Bitcoins after Bitfinex super-heist https://go.theregister.com/feed/www.theregister.com/2023/08/04/couple_bi...
  • New Microsoft Azure AD CTS feature can be abused for lateral movement https://www.bleepingcomputer.com/news/security/new-microsoft-azure-ad-cts-featur...
• Recent Commits to cve:main
  • Update Fri Aug 4 00:26:19 UTC 2023
• Security Boulevard
  • BSides Leeds 2023 – Dan Houghton – Web Browser Automation: How To Be More Robot, Easily!
  • Smart-Advertising Company Gains Visibility into Cloud Data
  • What is a SOC 2 Report? With Examples + Template
  • Threat Intelligence Sharing: 5 Best Practices
  • CISA Issues a Call to Action for Improved UEFI Security
  • Actionable Threat Intelligence: Generating Risk Reduction from CTI
  • Daniel Stori’s and Michael Tharrington’s – ‘First Day On The Job’
  • Google Report Reveals Most Widely Used Cloud Attack Vectors
  • Cybersecurity Insights with Contrast CISO David Lindner | 8/4
  • Five Key Reasons to Modernize Your PKI
• 安全脉搏
  • VMPWN的入门级别题目详解（一）
  • 监控、定位JavaScript操作cookie
  • VMPWN的入门级别题目详解（二）
  • Apache RocketMQ 远程代码执行漏洞（CVE-2023-33246）
  • 【漏洞预警】Apache NiFi 代码注入漏洞漏洞威胁通告
• 安全客-有思想的安全新媒体
  • 浅谈在GenAI时代掌握数据安全
  • API NEWS | 2023年必备：API安全关乎大局
• Google Online Security Blog
  • Pixel Binary Transparency: verifiable security for Pixel devices
• paper - Last paper
  • 揭秘南亚新 APT 组织 APT-K-47 “神秘象”
• 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
  • 奇安信连续两年入选Gartner® Hype Cycle™ 中国CPS安全代表供应商
  • 实力肯定！Coremail入选中国信通院“铸基计划”2023全景图
  • 技术干货|XDR+SOAR，安全无极放大器
  • SOAR零代码打造有声安全新闻播报服务，告别手动刷新资讯
  • ​CloudOps如何安全高效服务企业
  • 通过USB闪存盘发起的恶意软件攻击急剧增加
  • 开创大模型应用“试验田”，ISC 2023探索数字安全与AI技术更多可能
• Tenable Blog
  • Cybersecurity Snapshot: What, Me Worry? Businesses Adopt Generative AI, Security Risks Be Damned
• Horizon3.ai
  • The 2023 MES Midmarket 100
  • CVE-2023-39143: PaperCut Path Traversal/File Upload RCE Vulnerability
• CCC Event Blog
  • Camp 2023 – C3VOC.TV / Mobile Recording Setup
• SAP Blogs
  • Navigating the Next Steps in your SAP SuccessFactors Onboarding Journey: The Value of Transformation
  • Make your voice heard – take our survey on SAP’s Product Compliance Solutions!
  • Calling all Developers: Help Us Shape the Future of BTP with AI
  • Energizing Cloud ALM Transformation- Crave InfoTech Excels at SAP Cloud ALM Summit APJ 2023
  • India’s Innovation Puzzle – R&D Budget a ‘Cost or Investment’​?
  • Currency Conversion and Optimization for SAP BTP applications
  • XSA Blog Series – HDI Container, Persistence and CAP
  • RFQ process Coll. no. automation.
  • SAP Commerce Cloud – Unleashing the power of Ehcache
  • SAP Business Connector Migration 1: ELSTER/ERiC Scenarios
• Twitter @bytehx
  • Re @renniepak samsonite
  • Re @moe1n1 @Hacker0x01 Congrats!
• Malware-Traffic-Analysis.net - Blog Entries
  • 2023-08-03 - Google ad --> TurboTax site --> DanaBot
• Exodus Intelligence
  • Public Mobile Exploitation Training – Fall 2023
  • Public Browser Exploitation Training – Fall 2023
• Reverse Engineering
  • The X-Ray Tech That Reveals Chip Designs
  • Decompile C++ using NSA Ghidra
• Hex Rays
  • Igor’s Tip of the Week #151: Fixing “function frame is wrong”
• Microsoft Security Response Center
  • Microsoft mitigates Power Platform Custom Code information disclosure vulnerability
• Exploit-DB.com RSS Feed
  • [dos] Xlight FTP Server 3.9.3.6 - 'Stack Buffer Overflow' (DOS)
  • [webapps] WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
  • [webapps] WordPress adivaha Travel Plugin 2.3 - Reflected XSS
  • [webapps] Webedition CMS v2.9.8.8 - Stored XSS
  • [webapps] Webedition CMS v2.9.8.8 - Remote Code Execution (RCE)
  • [webapps] Webutler v3.2 - Remote Code Execution (RCE)
  • [webapps] Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
  • [webapps] Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
  • [remote] Shelly PRO 4PM v0.11.0 - Authentication Bypass
  • [webapps] Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload
  • [webapps] WordPress adivaha Travel Plugin 2.3 - SQL Injection
  • [webapps] Academy LMS 6.0 - Reflected XSS
  • [webapps] PHPJabbers Rental Property Booking 2.0 - Reflected XSS
  • [webapps] PHPJabbers Taxi Booking 2.0 - Reflected XSS
  • [webapps] PHPJabbers Cleaning Business 1.0 - Reflected XSS
  • [webapps] PHPJabbers Night Club Booking 1.0 - Reflected XSS
  • [webapps] PHPJabbers Service Booking Script 1.0 - Reflected XSS
  • [webapps] PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
  • [webapps] JLex GuestBook 1.6.4 - Reflected XSS
  • [webapps] Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
  • [webapps] Joomla JLex Review 6.0.1 - Reflected XSS
  • [webapps] WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS
  • [webapps] Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
  • [remote] ReyeeOS 1.204.1614 - MITM Remote Code Execution (RCE)
• SentinelOne
  • The Good, the Bad and the Ugly in Cybersecurity – Week 31
• 明天的乌云
  • 用RSSHub替代Feed43
• USENIX
  • Improving Logging to Reduce Permission Over-Granting Mistakes
  • V-Cloak: Intelligibility-, Naturalness- & Timbre-Preserving Real-Time Voice Anonymization
  • PatchVerif: Discovering Faulty Patches in Robotic Vehicles
  • DISTDET: A Cost-Effective Distributed Cyber Threat Detection System
  • The Impostor Among US(B): Off-Path Injection Attacks on USB Communications
  • Fuzztruction: Using Fault Injection-based Fuzzing to Leverage Implicit Domain Knowledge
  • NVLeak: Off-Chip Side-Channel Attacks via Non-Volatile Memory Systems
  • A Research Framework and Initial Study of Browser Security for the Visually Impaired
  • PUMM: Preventing Use-After-Free Using Execution Unit Partitioning
  • POLICYCOMP: Counterpart Comparison of Privacy Policies Uncovers Overbroad Personal Data Collection Practices
  • The Maginot Line: Attacking the Boundary of DNS Caching Protection
  • One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval
  • Exploring User Reactions and Mental Models Towards Perceptual Manipulation Attacks in Mixed Reality
  • Eavesdropping Mobile App Activity via Radio-Frequency Energy Harvesting
  • Side-Channel Attacks on Optane Persistent Memory
  • A Study of Multi-Factor and Risk-Based Authentication Availability
  • Person Re-identification in 3D Space: A WiFi Vision-based Approach
  • Fourteen Years in the Life: A Root Server’s Perspective on DNS Resolver Security
  • ClepsydraCache -- Preventing Cache Attacks with Time-Based Evictions
  • Guarding Serverless Applications with Kalium
  • DynSQL: Stateful Fuzzing for Database Management Systems with Complex and Valid SQL Query Generation
  • Automated Security Analysis of Exposure Notification Systems
  • xNIDS: Explaining Deep Learning-based Network Intrusion Detection Systems for Active Intrusion Responses
  • Pspray: Timing Side-Channel based Linux Kernel Heap Exploitation Technique
  • Strategies and Vulnerabilities of Participants in Venezuelan Influence Operations
  • Investigating Verification Behavior and Perceptions of Visual Digital Certificates
  • Remote Attacks on Speech Recognition Systems Using Sound from Power Supply
  • HOMESPY: The Invisible Sniffer of Infrared Remote Control of Smart TVs
  • FuzzJIT: Oracle-Enhanced Fuzzing for JavaScript Engine JIT Compiler
  • TPatch: A Triggered Physical Adversarial Patch
  • TAP: Transparent and Privacy-Preserving Data Services
  • UnGANable: Defending Against GAN-based Face Manipulation
  • Back to School: On the (In)Security of Academic VPNs
  • Squint Hard Enough: Attacking Perceptual Hashing with Adversarial Machine Learning
  • "All of them claim to be the best": Multi-perspective study of VPN users and VPN providers
  • GlitchHiker: Uncovering Vulnerabilities of Image Signal Transmission with IEMI
  • Device Tracking via Linux’s New TCP Source Port Selection Algorithm
  • The Writing on the Wall and 3D Digital Twins: Personal Information in (not so) Private Real Estate
  • PrivTrace: Differentially Private Trajectory Synthesis by Adaptive Markov Models
  • Egg Hunt in Tesla Infotainment: A First Look at Reverse Engineering of Qt Binaries
  • Learning Normality is Enough: A Software-based Mitigation against Inaudible Voice Attacks
  • FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules
  • CacheQL: Quantifying and Localizing Cache Side-Channel Vulnerabilities in Production Software
  • “If sighted people know, I should be able to know:” Privacy Perceptions of Bystanders with Visual Impairments around Camera-based Technology
  • Access Denied: Assessing Physical Risks to Internet Access Networks
  • Security and Privacy Failures in Popular 2FA Apps
  • A comprehensive, formal and automated analysis of the EDHOC protocol
  • Hash Gone Bad: Automated discovery of protocol attacks that exploit hash function weaknesses
  • (M)WAIT for It: Bridging the Gap between Microarchitectural and Architectural Side Channels
  • Content-Type: multipart/oracle - Tapping into Format Oracles in Email End-to-End Encryption
  • Glowing in the Dark: Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild
  • Every Signature is Broken: On the Insecurity of Microsoft Office’s OOXML Signatures
  • Humans vs. Machines in Malware Classification
  • How fast do you heal? A taxonomy for post-compromise security in secure-channel establishment
  • Assessing Anonymity Techniques Employed in German Court Decisions: A De-Anonymization Experiment
  • GLeeFuzz: Fuzzing WebGL Through Error Message Guided Mutation
  • Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps
  • The Space of Adversarial Strategies
  • Credit Karma: Understanding Security Implications of Exposed Cloud Services through Automated Capability Inference
  • That Person Moves Like A Car: Misclassification Attack Detection for Autonomous Systems Using Spatiotemporal Consistency
  • CipherH: Automated Detection of Ciphertext Side-channel Vulnerabilities in Cryptographic Implementations
  • "My Privacy for their Security": Employees' Privacy Perspectives and Expectations when using Enterprise Security Software
  • Combating Robocalls with Phone Virtual Assistant Mediated Interaction
  • On the Feasibility of Malware Unpacking via Hardware-assisted Loop Profiling
  • Distance-Aware Private Set Intersection
  • NeuroPots: Realtime Proactive Defense against Bit-Flip Attacks in Neural Networks
  • Towards a General Video-based Keystroke Inference Attack
  • URET: Universal Robustness Evaluation Toolkit (for Evasion)
  • You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks
  • Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues
  • SMACK: Semantically Meaningful Adversarial Audio Attack
  • Gradient Obfuscation Gives a False Sense of Security in Federated Learning
  • Automata-Guided Control-Flow-Sensitive Fuzz Driver Generation
  • Are Consumers Willing to Pay for Security and Privacy of IoT Devices?
  • PhyAuth: Physical-Layer Message Authentication for ZigBee Networks
  • Fairness Properties of Face Recognition and Obfuscation Systems
  • Beyond The Gates: An Empirical Analysis of HTTP-Managed Password Stealers and Operators
  • Decompiling x86 Deep Neural Network Executables
  • PolyFuzz: Holistic Greybox Fuzzing of Multi-Language Systems
  • Linear Private Set Union from Multi-Query Reverse Private Membership Test
  • An Efficient Design of Intelligent Network Data Plane
  • AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering
  • Inducing Authentication Failures to Bypass Credit Card PINs
  • Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js
  • Reassembly is Hard: A Reflection on Challenges and Strategies
  • PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack
  • VulChecker: Graph-based Vulnerability Localization in Source Code
  • Examining Consumer Reviews to Understand Security and Privacy Issues in the Market of Smart Home Devices
  • Timeless Timing Attacks and Preload Defenses in Tor's DNS Cache
  • Isolated and Exhausted: Attacking Operating Systems via Site Isolation in the Browser
  • Internet Service Providers' and Individuals' Attitudes, Barriers, and Incentives to Secure IoT
• FreeBuf网络安全行业门户
  • 本周新势力帮会推荐 | FreeBuf知识大陆
  • 【直播预告】渗透项目社工信息收集技巧 | FreeBuf知识大陆干货分享会
  • 演习前监测设备如何调优；传输加密有无新方案 | FB甲方群话题讨论
  • NSA、FBI、CISA联合发布：2022 最容易被利用的漏洞TOP12
  • 因配置错误，法国汉堡王网站敏感数据遭泄露！
• text/plain
  • Kilimanjaro – Getting There
  • Kilimanjaro – Journal
• Black Hills Information Security
  • Join Us for Camp BHIS @ DEF CON 31
• bishopfox.com
  • Analysis and Exploitation of CVE-2023-3519
• Light Cube
  • 再看 BLE：如何免费骑家楼下的共享电单车
• rtl-sdr.com
  • KrakenSDR: Finding Multiple GSM Base Station Transmit Towers with the Multi-VFO Feature
• 奇客Solidot–传递最新科技情报
  • 黑客解锁了特斯拉需要额外付费的软件功能
  • 海表面温度创下了 20.96C 的新纪录
  • 研究证实很多人感觉他们的工作毫无意义
  • 科学家在太空中发现氨基酸重要成分碳酸
  • 阿里巴巴开源其大语言模型通义千问
  • 太阳系的年龄可能比以前认为的老 110 万年
  • 特斯拉车主因公司夸大续航里程提起集体诉讼
  • 印度限制进口笔记本平板服务器
  • 韩国将成立委员会验证室温超导体声明
  • 研究称中国面临严重的慢阻肺病危机
• 安全牛
  • 我国牵头提出的两项网络安全国际标准正式发布
  • 保障容器应用安全的6个建议
  • 产业观察 | 《ISACA个人信息保护能力成熟度评估指南》白皮书发布
• SecPulse安全脉搏
  • 【漏洞预警】Apache NiFi 代码注入漏洞漏洞威胁通告
• KitPloit - PenTest & Hacking Tools
  • IMDShift - Automates Migration Process Of Workloads To IMDSv2 To Avoid SSRF Attacks
• 腾讯玄武实验室
  • 每日安全动态推送(8-4)
• 虎符智库
  • 实施五年后GAI大行其道 GDPR已过时？
• 绿盟科技研究通讯
  • 智能安全运营：大模型工具协同与学习框架
• 代码卫士
  • 五眼联盟发布2022年最常遭利用的12个漏洞
  • Milesight 工业路由器受数十个RCE漏洞影响
• 安全内参
  • 抓紧修复！2022年最常被利用漏洞清单，Fortinet五年老漏洞位列第一
  • 抢先预览！微软借助GPT-4打造安全运营助手
• 软件安全与逆向分析
  • eBPF干货内容共享计划第二期更新，eBPF文件隐藏、安卓10开eBPF、Rust开发eBPF、开发板eBPF与GPU云手机
• 暗影安全
  • CVE-2022-30887（文件上传漏洞）
• 奇安信威胁情报中心
  • 每周高级威胁情报解读(2023.07.27~08.03)
• 安全研究GoSSIP
  • G.O.S.S.I.P 阅读推荐 2023-08-04
• 数世咨询
  • 谷歌报告曝光：AI系统面临的六大攻击！
  • 业内诚聘 | IT企业诚招人才 2023.8.4
• 奇安信病毒响应中心
  • 每周勒索威胁摘要
• Seebug漏洞平台
  • 原创Paper | 揭秘南亚新 APT 组织 APT-K-47 “神秘象”
• HackerNews
  • 安全研究人员发现新的恶意软件 Redis p2pinfect
  • 俄罗斯 APT29 演变进程之新的攻击和技术被发现
  • 因配置错误，法国汉堡王网站敏感数据遭泄露
  • NSA、FBI、CISA 联合发布：2022 最容易被利用的漏洞 TOP12
  • 半数人工智能开源项目引用存在漏洞的软件包
  • 俄罗斯黑客组织威胁曝光 169GB 健康数据，波及美国千万用户
  • Chrome 扩展:他们能看到一切
• 网安杂谈
  • 征文 | 《信息安全研究》2023年“数字经济与安全”专刊征文通知
• 安全牛
  • 我国牵头提出的两项网络安全国际标准正式发布
  • 保障容器应用安全的6个建议
  • 产业观察 | 《ISACA个人信息保护能力成熟度评估指南》白皮书发布
• 极客公园
  • 对话「妙鸭」产品负责人：AIGC 的产品第一天不收钱，就可能收不到钱
  • 阿里云开源「通义千问」大模型；马斯克：特斯拉有望年底实现完全自动驾驶；妙鸭相机上线 B 端工作站 | 极客早知道
• 安全圈
  • 【安全圈】SSM 代理秒变木马！亚马逊云平台遭遇新型后渗透攻击
  • 【安全圈】通过USB闪存盘发起的恶意软件攻击急剧增加
  • 【安全圈】俄罗斯黑客组织威胁曝光169GB健康数据，波及美国千万用户
  • 【安全圈】几乎所有现代CPU都将数据泄漏给新的Collide+Power侧信道攻击
• 三六零CERT
  • 2023年7月勒索软件流行态势分析
  • 安全日报（2023.08.04）
• 看雪学苑
  • 安全开发·数智未来 | 武汉科锐，助力第七届安全开发者峰会（2023 SDC）
  • Android 取证之微信8.0.38版本数据库解密分析
  • CISA公布了2022年最常被利用的12个漏洞
  • 心仪职位 | 命运的齿轮开始转动......
• 我的安全视界观
  • 演习前红队暗泉涌动投毒
• Malwarebytes Labs
  • The end looms for Meta's behavioural advertising in Europe
  • Microsoft Teams used in phishing campaign to bypass multi-factor authentication
• 陌陌安全
  • 公告 | 创新类产品范围更新及业务范围汇总
• CNCERT国家工程研究中心
  • 完善数据产权制度 促进数据保护和利用
  • 几乎所有现代CPU都将数据泄漏给新的Collide+Power侧信道攻击
  • 俄罗斯黑客组织威胁曝光169GB健康数据，波及美国千万用户
• 长亭科技
  • 安全咨询能力获认可！长亭入选国际权威报告
  • 邀请函｜长亭科技邀您共赴2023商用密码大会！
• KCon 黑客大会
  • KCon演讲议题巡展｜Modern Linux sandboxing technology
• 慢雾科技
  • 慢雾：被盗急救指南之链上留言
• 中国信息安全
  • 提升人工智能安全治理水平迫在眉睫
  • 组建国家数据局：持续优化数据行政管理机构职责体系
  • 预告 | 开启人工智能时代数字安全新范式，ISC 2023这些内容值得关注
  • 关注 | 这两项由我国牵头提出的国际标准正式发布！
  • 专家解读 | 充分发挥审计在构建个人信息保护治理体系中的作用
  • 评论 | 让未成年人模式管用好用
  • 国际 | 新加坡通过新法案加强网络治理
• M01N Team
  • 每周蓝军技术推送（2023.7.29-8.4）
• 迪哥讲事
  • 实战阿里云OSS云攻防
• 字节跳动技术团队
  • ByteFUSE 的演进与落地
• 火绒安全
  • 【火绒安全周报】供应商因泄密《王者荣耀》内容遭三倍重罚/国际船舶制造巨头损失超6.1亿元
• Numen Cyber Labs
  • Numen独家: 利用函数原生指针绕过最新版V8沙箱 (附在野 exp CVE-2022–3723)
• 国家互联网应急中心CNCERT
  • 网络安全信息与动态周报2023年第31期（7月24日-7月30日）
• 关键基础设施安全应急响应中心
  • 国家网信办就《个人信息保护合规审计管理办法（征求意见稿）》公开征求意见（附全文）
  • 国际船舶制造巨头因网络攻击损失超6.1亿元
  • 半数人工智能开源项目引用存在漏洞的软件包
• Over Security - Cybersecurity news aggregator
  • Microsoft fixes flaw after being called irresponsible by Tenable CEO
  • Microsoft resolves vulnerability following criticism from Tenable CEO
  • Lawsuit accuses hospital of sharing patient health data with Facebook
  • New PaperCut critical bug exposes unpatched servers to RCE attacks
  • FBI investigating ransomware attack crippling hospitals across 4 states
  • FBI warns of scammers posing as NFT devs to steal your crypto
  • Discarded medical devices found to have troves of information on healthcare facilities
  • Microsoft kills Cortana in Windows 11 preview, long live AI!
  • Google explains how Android malware slips onto Google Play Store
  • “Crocodile of Wall Street” and her husband plead guilty to giant-sized cryptocrimes
  • Extended warranty robocallers fined $300 million after 5 billion scam calls
  • US ‘lagging behind’ on Border Gateway Protocol security practices, CISA and FCC chiefs say
  • Teach a Man to Phish and He’s Set for Life
  • Spotify down: music searches, pages, account signups not working
  • Dopo WormGPT arriva FraudGPT: il cybercrimine punta sui chatbot malevoli
  • Fake VMware vConnector package on PyPI targets IT pros
  • Violate e-mail di funzionari USA e UE, sale la tensione con la Cina: nuovi scenari di cyberwar
  • Emotet e Lokibot non mollano, e nascono nuove minacce: il report di Kaspersky
  • La cyber security per proteggere i sistemi di calcolo quantistico: minacce e soluzioni tecnologiche
  • Risky Biz News: Microsoft accused of negligence in dealing with security flaw, again
• Yak Project
  • YAK：“我变好看了，也变强了”
• 信安杂记
  • 加速人才流动 #6
• 网安寻路人
  • OpenAI安全措施被越过 ChatGPT被“诱导”提供违法信息
• /dev/random
  • [SANS ISC] Are Leaked Credentials Dumps Used by Attackers?
• 嘶吼专业版
  • 通过USB闪存盘发起的恶意软件攻击急剧增加
  • ​CloudOps如何安全高效服务企业
• Securityinfo.it
  • Dopo WormGPT arriva FraudGPT: il cybercrimine punta sui chatbot malevoli
  • Emotet e Lokibot non mollano, e nascono nuove minacce: il report di Kaspersky
• 360数字安全
  • 周鸿祎：建设“两脑三中心”，助力辽宁数字经济发展
  • ISC 2023即将启幕：全球智囊集结，探索AI时代数字安全新解法
  • ISC 2023重磅嘉宾“官宣”！
• Schneier on Security
  • Friday Squid Blogging: 2023 Squid Oil Global Market Report
  • Political Milestones for AI
• 补天平台
  • 鹰图平台v2.4.1版本更新啦！
• 深信服千里目安全技术中心
  • APT高级威胁七月热点跟踪
  • 【漏洞通告】Metabase远程代码执行漏洞（CVE-2023-37470）
  • Oracle发布2023年7月的安全公告
  • 上周关注度较高的产品安全漏洞(20230217-20230223)
  • 上周关注度较高的产品安全漏洞(20230724-20230730)
  • CNVD漏洞周报2023年第30期
• SANS Internet Storm Center, InfoCON: green
  • Are Leaked Credentials Dumps Used by Attackers?, (Fri, Aug 4th)
  • ISC Stormcast For Friday, August 4th, 2023 https://isc.sans.edu/podcastdetail/8602, (Fri, Aug 4th)
• bellingcat
  • Solving World War II Photo Mysteries With Open Source Techniques
• Full Disclosure
  • Kolibri GET request buffer Overflow [Stack Egghunter]
  • [SYSS-2023-011]: Canon PIXMA TR4550 and other inkjet printer models - Insufficient or Incomplete Data Removal, within Hardware Component (CWE-1301)
• Krebs on Security
  • Teach a Man to Phish and He’s Set for Life
• Security Affairs
  • A cyberattack impacted operations of multiple hospitals in several US states
  • Married couple pleaded guilty to laundering billions in cryptocurrency stolen from Bitfinex in 2016
  • Malicious packages in the NPM designed for highly-targeted attacks
  • Attackers use dynamic code loading to bypass Google Play store’s malware detections
  • CISA, FBI, and NSA published the list of 12 most exploited vulnerabilities of 2022
• Graham Cluley
  • Ransomware attacks cost manufacturing sector $46 billion in downtime since 2018, report claims
• Blackhat Library: Hacking techniques and research
  • Blackhat tickets?
  • Cousins IG account hacked now they’re messaging me for money. Got some of their info and trying to get back at them.
• Deeplinks
  • The Impending Privacy Threat of Self-Driving Cars
• Your Hacking Tutorial by Zempirians
  • I don't know if this is the right place. Please tell me if it isn't. I'm a writer working on a series of short stories about a pentester work works with company to test physical and digital security of locations. (Think like a hacker MacGyver).
  • Modify EXE without source code?
  • Integer Overflow Detected in Keyspace of Mask
• Technical Information Security Content & Discussion
  • Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform
  • Don’t you (forget NLP): Prompt injection with control characters in ChatGPT
  • Password Managers as Ethical Hacking Tools
• Pentestmag
  • GREENBONE OPENVAS, THE OPEN SOURCE TOOL THAT CLOSES VULNERABILITIES
  • WiFi Deauthers vs Signal Jammers
• Google Online Security Blog
  • Pixel Binary Transparency: verifiable security for Pixel devices
• Information Security
  • Introduction To Digital Forensics
  • Have you ever encountered a situation where your personal data was compromised in a data breach?
• Social Engineering
  • Best advice For building business friendship?
  • Here is my angry rant about “just be yourself”, and conformity
  • Harassing senior insecure
  • how to familiarize a process so someone will accept your view?
• The Hacker News
  • NYC Couple Pleads Guilty to Money Laundering in $3.6 Billion Bitfinex Hack
  • Webinar - Making PAM Great Again: Solving the Top 5 Identity Team PAM Challenges
  • Malicious npm Packages Found Exfiltrating Sensitive Data from Developers
  • Major Cybersecurity Agencies Collaborate to Unveil 2022's Most Exploited Vulnerabilities
• KitPloit - PenTest Tools!
  • IMDShift - Automates Migration Process Of Workloads To IMDSv2 To Avoid SSRF Attacks
• Computer Forensics
  • Cellebrite Physical Analyzer Thumbnail View Broken
• Security Weekly Podcast Network (Audio)
  • Surging Email Impersonation Threats, Creating Online Kids' Safety Community - Fareedah Shaheed, John Wilson - ESW #326
  • Midnight Blizzard, Cult of the Dead Cow, Five Eyes, Aaran Leyland, and More News - SWN #315
• Dark Space Blogspot
  • Chainlink Lancia Il CCIP (Cross Chain Interoperability Protocol)