[每日信息流] 2023-06-14

[chainreactorbot]

每日安全资讯（2023-06-14）

• SecWiki News
  • [ ] SecWiki News 2023-06-13 Review
• HackerOne Hacker Activity
  • [ ] [CPP]: Add query for CWE-805: Buffer Access with Incorrect Length Value using some functions
  • [ ] [Python]: Timing attack
  • [ ] Go : Add more JWT sinks
  • [ ] CPP: Add query for CWE-369: Divide By Zero.
  • [ ] [python]: Add some dangerous sinks for paramiko ssh clients
  • [ ] [Javascript]: Add new queries for Javascript Github Actions
  • [ ] [Python] Unsafe Unpacking and TarSlip bug slaying
  • [ ] [Python] Add Unicode Bypass Validation query tests and help
  • [ ] JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements)
  • [ ] cpp: if (a+b>c) a=c-b is incorrect if a+b overflows
• 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
  • [ ] 360智脑大模型重新定义AI数字人 国内首发有“灵魂”的数字人
  • [ ] Win32k 特权提升漏洞PoC公布
  • [ ] 系统管理员特权帐户3大威胁向量及7大最佳实践
  • [ ] 四叶草安全New Stage2023主题发布会邀您相见
  • [ ] 【会议通知】首届北京数字安全峰会将于6月15日在中关村软件园国际会议中心举办！
  • [ ] 重磅发布 |《零信任建设调研报告》
• Security Boulevard
  • [ ] Microsoft Patch Tuesday, June 2023 Edition
  • [ ] Cyber Threat Intelligence Index: May 2023
  • [ ] What is CNAPP, and what does it mean to developers?
  • [ ] 5 Ways to Reduce AWS EKS Compute Costs
  • [ ] Malicious Online Bots: More Than Just a Nuisance
  • [ ] Unchanging Undercurrents in the 2023 Verizon DBIR
  • [ ] Google Recruits Allies to Apply Generative AI to Cybersecurity
  • [ ] Randall Munroe’s XKCD ‘Musical Scales’
  • [ ] Understanding the Role of Identities in Cloud Breaches
  • [ ] Announcing Seceon “AI-SECURITY SCORE360” and “AI-SECURITY BI360”
• unSafe.sh - 不安全
  • [ ] 研究揭示减肥反弹的大脑秘密
  • [ ] 丰田计划在 2027 年推出电动汽车用全固态电池
  • [ ] 日本向更多海外劳工开放大门
  • [ ] Jasper Reports Library Code Injection
  • [ ] XORtigate: Pre-authentication Remote Code Execution on Fortigate VPN (CVE-2023-27997)
  • [ ] Dynamic Linq Injection Remote Code Execution Vulnerability (CVE-2023-32571)
  • [ ] 览色 Pro – 取色器与色卡制作工具[iPhone]
  • [ ] Exam-related Internet shutdowns in Iraq and Algeria put connectivity to the test
  • [ ] Defending From the Ground Up | How to Secure the Enterprise’s Digital Attack Surfaces
  • [ ] 西部数据对开机三年的硬盘发出更换警告引发争议
• Twitter @Nicolas Krassas
  • [ ] Pentesting Xamarin Android apps: DLLs and root check bypass https://security.humanativaspa.it/pentesting-xamarin-android-apps-dlls-and-root-check-bypa...
  • [ ] St. Margaret’s Health is the first hospital to cite a cyberattack as a reason for its closure https://securityaffairs.com/147430/cyber-crime/st-marga...
  • [ ] Last of the Gozi 3 sentenced over Windows info-stealing malware ops https://go.theregister.com/feed/www.theregister.com/2023/06/13/paunescu_sentence_g...
  • [ ] Chinese hackers used VMware ESXi zero-day to backdoor VMs https://www.bleepingcomputer.com/news/security/chinese-hackers-used-vmware-esxi-zero-day-to-...
  • [ ] Messing Around With AWS Batch For Privilege Escalations https://blog.doyensec.com//2023/06/13/messing-around-with-aws-batch-for-privilege-escalations....
  • [ ] CVE-2023-34000 flaw in WooCommerce Stripe Gateway WordPress plugin may affect 900k sites https://securityonline.info/cve-2023-34000-flaw-in-woocommerc...
  • [ ] Re @ggreve @GovCERT_CH Geo block then, the websites are mainly ( almost solely ) to be used internally. Block external traffic out of the country unti...
  • [ ] How to Run a ChatGPT-like AI on Your Own PC https://www.howtogeek.com/881317/how-to-run-a-chatgpt-like-ai-on-your-own-pc/
  • [ ] A Local Large Language Model https://blog.dshr.org/2023/06/a-local-large-language-model.html
  • [ ] deepsecrets: a better tool for secret scanning https://securityonline.info/deepsecrets-a-better-tool-for-secret-scanning/
  • [ ] Prudential Assurance Malaysia Berhad (PAMB) and Prudential BSN Takaful Berhad (PruBSN) can confirm that we are among many companies around the world t...
  • [ ] Massive phishing campaign uses 6,000 sites to impersonate 100 brands https://www.bleepingcomputer.com/news/security/massive-phishing-campaign-uses-6-0...
  • [ ] Beware: New DoubleFinger Loader Targets Cryptocurrency Wallets with Stealer https://thehackernews.com/2023/06/beware-new-doublefinger-loader-targets.h...
  • [ ] PoC Released for VMware Aria Operations for Networks RCE (CVE-2023-20887) Bug https://securityonline.info/poc-released-for-vmware-aria-operations-for-...
  • [ ] BreachForums Returns Under the Control of ShinyHunters Hackers https://www.hackread.com/breachforums-returns-with-shinyhunters-hackers/
  • [ ] RDP honeypot targeted 3.5 million times in brute-force attacks https://www.bleepingcomputer.com/news/security/rdp-honeypot-targeted-35-million-times-i...
  • [ ] RT SinSinology: While I'm at it, here is the @pdnuclei template for CVE-2023-20887 - #VMWare Aria Operations for Networks (vRealize Network Insight) p...
  • [ ] Jasper Reports Library Code Injection https://insinuator.net/2023/06/jasper-reports-library-code-injection/
  • [ ] RT SinSinology: 🚨 #VMWare Pre-Authenticated Remote Code Execution (CVE-2023-20887) #PoC is ready https://t.co/6fi4keigOE
  • [ ] RT web3 is going just great: Abandoned Atlantis Loans project exploited for $1.1 million June 12, 2023 https://web3isgoinggreat.com/?id=abandoned-atla...
• CXSECURITY Database RSS Feed - CXSecurity.com
  • [ ] Microsoft HVCIScan DLL Hijacking
  • [ ] TerraMaster TOS 4.2.15 Remote Code Execution
  • [ ] Anevia Flamingo XS 3.6.5 Authenticated Root Remote Code Execution
  • [ ] Anevia Flamingo XL/XS 3.6.x Default / Hardcoded Credentials
  • [ ] LearnDesk 1.0 Cross Site Scripting
  • [ ] WordPress Workreap 2.2.2 Shell Upload
  • [ ] Sales Tracker Management System v1.0 Multiple Vulnerabilities
• 安全脉搏
  • [ ] 代码审计 | Wavsep靶场审计防御
  • [ ] 一种高端的APP代码保护方案
  • [ ] 实战！一次平平无奇内网渗透记录
  • [ ] 神器！MySQL蜜罐服务GUI利用工具
  • [ ] 实战｜记一次寄生虫站点中的组件Getshell到白嫖day
• obaby@mars
  • [ ] 羊毛战记
• Trustwave Blog
  • [ ] Top 5 Ways Cybercriminals Engage in Credential Harvesting: Protecting Your Login Credentials
• Recent Commits to cve:main
  • [ ] Update Tue Jun 13 00:14:27 UTC 2023
• Sploitus.com Exploits RSS Feed
  • [ ] Sales Tracker Management System v1.0 - Multiple Vulnerabilities exploit
  • [ ] Online Examination System Project 1.0 - Cross-site request forgery Vulnerability exploit
  • [ ] Teachers Record Management System 1.0 - File Upload Type Validation Vulnerability exploit
  • [ ] Piyanas 0.1 Cross Site Request Forgery exploit
  • [ ] Online Examination System Project 1.0 - Cross-site request forgery (CSRF) exploit
  • [ ] Teachers Record Management System 1.0 - File Upload Type Validation exploit
  • [ ] phpAnalyzer 2.0.4 Insecure Settings exploit
  • [ ] TerraMaster TOS 4.2.29 Remote Code Execution exploit
  • [ ] Online Thesis Archiving System 1.0 SQL Injection exploit
  • [ ] EasyAnswer 1.0.1 Cross Site Request Forgery exploit
  • [ ] Xoops CMS 2.5.10 Cross Site Scripting exploit
  • [ ] ProLogin 1.9 Insecure Direct Object Reference exploit
  • [ ] Exploit for Code Injection in Apache Rocketmq exploit
  • [ ] Exploit for CVE-2023-20887 exploit
  • [ ] Exploit for CVE-2023-2986 exploit
  • [ ] Exploit for Improper Access Control in Papercut Papercut Ng exploit
• ElcomSoft blog
  • [ ] What Forensic Vendors Don’t Like To Tell Their Customers. Part 1
• Insinuator.net
  • [ ] Jasper Reports Library Code Injection
• • [ ] What Are WordPress Salts & Security Keys?
• Vulnerabilities and Threat Research – Qualys Security Blog
  • [ ] Microsoft Patch Tuesday, June 2023 Security Update Review
• Forcepoint
  • [ ] The MOVEit Zero-Day Vulnerability and the Importance of Cross Domain Solutions in Data Transfer
• SpiderLabs Blog from Trustwave
  • [ ] Honeypot Recon: Global Database Threat Landscape
• Tenable Blog
  • [ ] Microsoft’s June 2023 Patch Tuesday Addresses 70 CVEs (CVE-2023-29357)
  • [ ] CVE-2023-27997: Heap-Based Buffer Overflow in Fortinet FortiOS and FortiProxy SSL-VPN (XORtigate)
• Twitter @bytehx
  • [ ] RT Volodya: Here is one of the most exceptional and timeless articles on how to become a proficient smart contract auditor. ✨ https://cmichel.io/how-...
• Malware-Traffic-Analysis.net - Blog Entries
  • [ ] 2023-06-12 - 30 days of Formbook: Day 8, Monday 2023-06-12 - "EE2Q"
  • [ ] 2023-06-11 - 30 days of Formbook: Day 7, Sunday 2023-06-11 - GuLoader Formbook "XCHU"
  • [ ] 2023-06-10 - 30 days of Formbook: Day 6, Saturday 2023-06-10 - "SN84"
• Lexfo's security blog
  • [ ] XORtigate: Pre-authentication Remote Code Execution on Fortigate VPN (CVE-2023-27997)
• hn security
  • [ ] Pentesting Xamarin Android apps: DLLs and root check bypass
• SAP Blogs
  • [ ] Business Consolidation Add-On in the Context of SAP’s Portfolio for Corporate Close
  • [ ] Web Dynpro Application for Monthly Financial Planning in SAP Commercial Project Management
  • [ ] Git-enabled Change Supports More Git Servers and System Role-specific deployment
  • [ ] Kanban Replenishment From Embedded EWM to IM Storage Location Using LOSC
  • [ ] S/4HANA Group Reporting Historical Data Accelerator & How to Deploy in a Customer Landscape
  • [ ] Harnessing the Supernova: AI in 2023 and its Seismic Shift in Software Development
  • [ ] Keyboard Accessibility – How the SAP Analytics Cloud Data Analyzer Can Be Navigated Via the Keyboard
  • [ ] Supplier Proposal for Purchase Order Item in Machine Learning Cockpit
  • [ ] Roadmap Viewer Feedback Process
• SentinelOne
  • [ ] Defending From the Ground Up | How to Secure the Enterprise’s Digital Attack Surfaces
• Files ≈ Packet Storm
  • [ ] TerraMaster TOS 4.2.29 Remote Code Execution
  • [ ] American Fuzzy Lop plus plus 4.07c
  • [ ] Hydra Network Logon Cracker 9.5
  • [ ] Debian Security Advisory 5425-1
  • [ ] Debian Security Advisory 5424-1
  • [ ] Ubuntu Security Notice USN-6160-1
  • [ ] Ubuntu Security Notice USN-6159-1
  • [ ] Ubuntu Security Notice USN-6158-1
  • [ ] Ubuntu Security Notice USN-6143-2
  • [ ] Red Hat Security Advisory 2023-3495-01
  • [ ] Ubuntu Security Notice USN-6157-1
  • [ ] Ubuntu Security Notice USN-6148-1
  • [ ] Ubuntu Security Notice USN-6156-1
  • [ ] Ubuntu Security Notice USN-6155-1
  • [ ] Ubuntu Security Notice USN-6154-1
  • [ ] ProLogin 1.9 Insecure Direct Object Reference
  • [ ] Piyanas 0.1 Cross Site Request Forgery
  • [ ] phpAnalyzer 2.0.4 Insecure Settings
  • [ ] EasyAnswer 1.0.1 Cross Site Request Forgery
  • [ ] Online Thesis Archiving System 1.0 SQL Injection
  • [ ] Xoops CMS 2.5.10 Cross Site Scripting
  • [ ] MOVEit Transfer SQL Injection / Remote Code Execution
• Application Security Blog
  • [ ] Forrester recognizes Synopsys as a Leader in software composition analysis
• sergioprado.blog
  • [ ] RPMB, a secret place inside the eMMC
• Exploit-DB.com RSS Feed
  • [ ] [webapps] Sales Tracker Management System v1.0 - Multiple Vulnerabilities
  • [ ] [webapps] Teachers Record Management System 1.0 - File Upload Type Validation
  • [ ] [webapps] Online Examination System Project 1.0 - Cross-site request forgery (CSRF)
• Microsoft Security Response Center
  • [ ] 2023 年 6 月のセキュリティ更新プログラム (月例)
• Malwarebytes Labs
  • [ ] Edge browser feature sends images you view back to Microsoft
• Reverse Engineering
  • [ ] RetDec Decompiler plugin for LLDB
• FreeBuf网络安全行业门户
  • [ ] 马斯克入主推特后，网络安全都经历了些什么
  • [ ] FreeBuf 早报 | 勒索攻击致使知名大学IT设施瘫痪；Zacks数据泄露影响880万用户
  • [ ] 《基金管理公司网络和信息安全三年提升计划（2023-2025）》发布
  • [ ] 苹果将在 iOS 17 引入新功能，Safari隐私浏览有重大更新
  • [ ] 一波未平一波又起，瑞士政府机构遭遇持续的DDoS攻击
  • [ ] Zacks 数据泄露事件影响 880万用户
• 体验盒子
  • [ ] 2023年全球搜索引擎排名/全球搜索引擎市场份额
• Private Feed for M09Ic
  • [ ] spf13 started following jjcm
  • [ ] spf13 starred jjcm/soci-backend
  • [ ] CHYbeta starred AntonOsika/gpt-engineer
  • [ ] uknowsec starred duhirsch/sigspoox
  • [ ] uknowsec starred sinsinology/CVE-2023-20887
  • [ ] ourren starred huhexian/2012-huhexian
  • [ ] niudaii started following LandGrey
  • [ ] niudaii starred LandGrey/pydictor
  • [ ] WangYihang starred digitalocean/pydo
  • [ ] WangYihang starred koalalorenzo/python-digitalocean
  • [ ] Ak74-577 starred hmgle/graftcp
  • [ ] Ak74-577 starred Processus-Thief/HEKATOMB
  • [ ] zer0yu starred Malwareman007/CVE-2023-27326
  • [ ] yzddmr6 starred odomu/aliyunpan
  • [ ] zema1 starred odomu/aliyunpan
  • [ ] BeichenDream starred x364e3ab6/DudeSuite
  • [ ] zer0yu starred QiuChenlyOpenSource/MyMacsAppCrack
  • [ ] WangYihang starred aliyun/aliyun-oss-python-sdk
  • [ ] 0xbug started following cckuailong
  • [ ] 0xbug starred cckuailong/JNDI-Injection-Exploit-Plus
  • [ ] Ak74-577 starred nicocha30/ligolo-ng
  • [ ] Ak74-577 started following nicocha30
  • [ ] WAY29 starred xubiaolin/docker-zerotier-planet
  • [ ] Rvn0xsy starred ZeroMemoryEx/Bypass-Sandbox-Evasion
  • [ ] timwhitez starred zblurx/certsync
  • [ ] FunnyWolf starred outflanknl/Dumpert
• 安全牛
  • [ ] AT&T Business：零信任是化解AI应用风险的灵丹妙药
  • [ ] 产业观察 | 全知科技正式发布《数据安全作战地图》知识图谱
• 绿盟科技技术博客
  • [ ] 用友畅捷通T+ SQL注入漏洞和反序列化漏洞通告
• bishopfox.com
  • [ ] Introducing Cloudfoxable: A Gamified Cloud Hacking Sandbox
• 博客园 - 郑瀚Andrew
  • [ ] Chain-of-Thought Prompting in Large Language Models 论文学习 - 郑瀚Andrew
• 博客园 - 渗透测试中心
  • [ ] 安洵杯SYCCTF2023 writeup - 渗透测试中心
• ChaMd5安全团队
  • [ ] web3-solidity历史漏洞汇总
• 吾爱破解论坛
  • [ ] 吾爱破解论坛网络诊断修复工具 v2.5 New～【2023年06月13日更新】
• 奇客Solidot–传递最新科技情报
  • [ ] 研究揭示减肥反弹的大脑秘密
  • [ ] 丰田计划在 2027 年推出电动汽车用全固态电池
  • [ ] 日本向更多海外劳工开放大门
  • [ ] 西部数据对开机三年的硬盘发出更换警告引发争议
  • [ ] 太空飞行会对人脑结构产生无法恢复的影响
  • [ ] 伊朗的“量子”设备被发现是开发板
  • [ ] 欧盟监管机构考虑分拆 Google 的广告技术业务
  • [ ] 《自然》期刊禁止 AI 生成艺术
  • [ ] 大规模抗议导致 Reddit 崩溃三小时
  • [ ] FTC 寻求阻止微软收购动视暴雪
• 君哥的体历
  • [ ] 辞别腾讯，下一站知其安（创业）
• 代码卫士
  • [ ] 美国政府发布关于软件安全保证要求的指南
  • [ ] 瑞士政府提醒注意近期的 DDoS 攻击和数据泄露事件
• KitPloit - PenTest & Hacking Tools
  • [ ] Burpgpt - A Burp Suite Extension That Integrates OpenAI's GPT To Perform An Additional Passive Scan For Discovering Highly Bespoke Vulnerabilities, And Enables Running Traffic-Based Analysis Of Any Type
• Seebug漏洞平台
  • [ ] 心动的offer+1！继续招人
• 腾讯安全威胁情报中心
  • [ ] ​云安全风险情报（06.05-06.11）
• 七夜安全博客
  • [ ] 我回来了
• 腾讯玄武实验室
  • [ ] 每日安全动态推送(6-13)
• 看雪学苑
  • [ ] 移动应用安全与风控——应用的签名
  • [ ] 印度10亿人面临个人信息泄露风险，CoWIN疫苗平台暴露公民数据
  • [ ] 【新课预售】学习Windows平台漏洞挖掘，为企业安全保驾护航！
• 安全内参
  • [ ] 勒索攻击致使知名大学IT设施全瘫痪，近半年德国已有多所高校被黑
  • [ ] 之江实验室发布《生成式大模型安全与隐私白皮书》(附下载)
• 关键基础设施安全应急响应中心
  • [ ] 新一代云网融合数据中心关键技术研究
  • [ ] 隐秘的 SeroXen RAT 恶意软件越来越多地用于针对游戏玩家
  • [ ] 本田电商平台API漏洞暴露客户数据
• 360Quake空间测绘
  • [ ] 通过quake分析mongodb被勒索情况
• 安全研究GoSSIP
  • [ ] G.O.S.S.I.P 阅读推荐 2023-06-13 PROGRAPHER
• 复旦白泽战队
  • [ ] 成果分享｜MaSS: 基于语义和隐蔽性约束的知识图谱嵌入投毒攻击
• CNCERT国家工程研究中心
  • [ ] 以区块链等创新场景牵引助力密码科技高水平自立自强
  • [ ] 物联网“僵尸网络DDos攻击”增长惊人，威胁全球电信网络
  • [ ] 屡屡曝出重大安全问题，丰田新能源成“杂牌”？
• 京东安全应急响应中心
  • [ ] 【京麒沙龙第十期】腾讯、京东、翼支付、工商银行安全专家，共议不同行业视角下的金融支付安全
• 黑奇士
  • [ ] 周鸿祎发布“周鸿祎”，360版GPT将全面接入“全家桶”
• 数世咨询
  • [ ] 数世咨询：白帽必看 | 第三届数字安全大会
  • [ ] [直播] 第三届数字安全大会 | 数安有话说：一天两场！聚焦精准EDR及数据监测与响应
  • [ ] 数世咨询：第三届数字安全大会 | 倒计时4天
• 黑伞安全
  • [ ] CosMiss：Azure Cosmos DB Notebook 远程代码执行漏洞
  • [ ] 云攻防课程系列（三）：云上资产发现与信息收集
• 斗象智能安全
  • [ ] 漏洞情报 | 畅捷通T+ 前台远程命令执行漏洞
• 鱼凫游民随笔
  • [ ] 关于yara各种检测cobaltstrike
• 长亭安全应急响应中心
  • [ ] 漏洞风险提示｜Openfire控制台权限绕过漏洞（CVE-2023-32315）
• 国家互联网应急中心CNCERT
  • [ ] CNVD漏洞周报2023年第23期
  • [ ] 上周关注度较高的产品安全漏洞(20230605-20230611)
• 安全圈
  • [ ] 【安全圈】苹果将在 iOS 17 引入新功能，Safari隐私浏览有重大更新
  • [ ] 【安全圈】考后防诈，警惕自称黑客篡改分数！
  • [ ] 【安全圈】Zacks数据泄露事件影响880万用户
  • [ ] 【安全圈】勒索攻击致使知名大学IT设施全瘫痪
• 小米安全中心
  • [ ] GitLab CI 接入代码安全扫描技术实践
• 火线Zone
  • [ ] Zone在招聘 | 要HC吗？我们有几十个（不是骑手）
• 极客公园
  • [ ] 英伟达、甲骨文联手投资的 AI 独角兽，如何抢跑 OpenAI？
  • [ ] 科幻经典里的「恐怖巨兽」，怎么成了 AI 的新代言人？
  • [ ] 休战合作，传顺丰将入股极兔；马斯克：什么 AI，不过是数据统计；梅西取消所有活动，仅在淘宝直播带货 | 极客早知道
• 谛听ditecting
  • [ ] 谛听|国家重点研发计划《智能网联场景工业控制系统深度防御与安全处置技术》 中期检查准备工作会
• 中国信息安全
  • [ ] 论坛·原创 | 网络综合治理体系与未来数字社会形态重塑研究
  • [ ] 解读 | 北京商用密码行业协会：加强行业自律 持续推进北京商用密码产业健康发展
  • [ ] 评论 | 为惩治网暴进一步织密法网
  • [ ] 前沿 | 人工智能立法加快 产业布局提速
  • [ ] 观点 | 算法推荐法律规制的域外考察及审思
  • [ ] 评论 | 重视企业算法推荐合规体系建设
• Tails - News
  • [ ] Tails 5.14
• 黑海洋 - WIKI
  • [ ] Navicat Premium v15.0.25 中文最新破解版（附视频教程）
• 嘶吼专业版
  • [ ] 【会议通知】首届北京数字安全峰会将于6月15日在中关村软件园国际会议中心举办！
  • [ ] Win32k 特权提升漏洞PoC公布
  • [ ] 系统管理员特权帐户3大威胁向量及7大最佳实践
• TrustedSec
  • [ ] The Nightmare of Proc Hollow’s Exe
• 奶牛安全
  • [ ] 慎用！一个可绕过沙箱检测的工具
• Il Disinformatico
  • [ ] Mi tocca fare un po’ di body hacking: installo cristallini nuovi - seconda parte
• 山石网科安全技术研究院
  • [ ] openfire鉴权绕过漏洞原理解析
• Over Security - Cybersecurity news aggregator
  • [ ] Patch Tuesday fixes 4 critical RCE bugs, and a bunch of Office holes
  • [ ] What Are WordPress Salts & Security Keys?
  • [ ] Pirated Windows 10 ISOs install clipper malware via EFI partitions
  • [ ] State-owned bank in South Africa confirms ‘Akira’ ransomware attack
  • [ ] Microsoft Patch Tuesday, June 2023 Edition
  • [ ] Cyber Threat Intelligence Index: May 2023
  • [ ] Conferenza su Frodi nei Servizi di Pagamento per Legal Community Week
  • [ ] Microsoft: Windows 10 21H2 has reached end of servicing
  • [ ] CISA orders US civilian agencies to remove tools from public-facing internet
  • [ ] Two remote code execution vulnerabilities disclosed in Microsoft Excel
  • [ ] Senators say Biden administration isn’t close on overhauling surveillance law
  • [ ] Microsoft fixes Windows 11 issue causing copying, saving failures
  • [ ] Microsoft discloses 5 critical vulnerabilities in June's Patch Tuesday, no zero-days
  • [ ] Fortinet says VPN bug ‘may have been exploited in a limited number of cases’
  • [ ] Windows 11 KB5027231 cumulative update released with 34 changes
  • [ ] CISA orders federal agencies to secure Internet-exposed network devices
  • [ ] Windows 10 KB5026435 and KB5027215 updates released
  • [ ] Microsoft June 2023 Patch Tuesday fixes 78 flaws, 38 RCE bugs
  • [ ] Messing Around With AWS Batch For Privilege Escalations
  • [ ] Chinese hackers used VMware ESXi zero-day to backdoor VMs
  • [ ] Gozi banking malware “IT chief” finally jailed after more than 10 years
  • [ ] France accuses Russians of impersonating French government and media to spread disinformation
  • [ ] WordPress Stripe payment plugin bug leaks customer order details
  • [ ] BatCloak Engine: così il malware diventa invisibile agli antivirus
  • [ ] Threat Actor Targets Russian Gaming Community With WannaCry-Imitator
  • [ ] I castelli medievali e la cyber security, così lontani ma così vicini
  • [ ] Microsoft says Azure outage was caused by ‘anomalous’ traffic spike
  • [ ] RDP honeypot targeted 3.5 million times in brute-force attacks
  • [ ] Massive phishing campaign uses 6,000 sites to impersonate 100 brands
  • [ ] Blink Copilot Brings Generative AI to Security Automation
  • [ ] Bulletproof hoster gets 3 years for pushing Urfsnif, Zeus malware
  • [ ] DoubleFinger, il malware che mira ai criptowallet: ecco come difendersi
  • [ ] Biden administration officials tout Colonial Pipeline case in pushing for Section 702 renewal
  • [ ] La cultura della cybersecurity deve coinvolgere tutte le figure aziendali
  • [ ] Viaggio nei livelli nascosti del Deep Web, alla ricerca di minacce alle nostre digital identity
  • [ ] Attacchi contro il settore retail: l’area EMEA è la più colpita
  • [ ] ".zip" top-level domains draw potential for information leaks
  • [ ] GDPR e distribuzione assicurativa: ecco le cose da sapere sul registro dei trattamenti
  • [ ] La legge sull’intelligenza artificiale in Europa è a una svolta
  • [ ] Pentesting Xamarin Android apps: DLLs and root check bypass
• Securityinfo.it
  • [ ] La cultura della cybersecurity deve coinvolgere tutte le figure aziendali
  • [ ] Attacchi contro il settore retail: l’area EMEA è la più colpita
• Trend Micro - Security Advisories
  • [ ] AndroidOS_SpyNote.GCLX
• 三六零CERT
  • [ ] Tellyouthepass勒索软件利用财务管理系统漏洞成规模入侵
  • [ ] 安全日报（2023.06.13）
• LockBoxx
  • [ ] Book Review "Leader's Eat Last"
• 网安国际
  • [ ] 【InForSec2023 年会论坛回顾】周威：无硬件依赖新型全系统物联网设备固件虚拟化方案研究
• Qualys Security Blog
  • [ ] Microsoft Patch Tuesday, June 2023 Security Update Review
• Schneier on Security
  • [ ] Identifying the Idaho Killer
• Deeplinks
  • [ ] What Reddit Got Wrong
  • [ ] The FTC Forces Ring to Take User Privacy Seriously
• Security Current
  • [ ] Spotlight: Uri Dromi, Founder and President of the Jerusalem Press Club
  • [ ] CISOs Connect™ Goes Global with an Inaugural Trip to Cyber Week Israel
• SANS Internet Storm Center, InfoCON: green
  • [ ] June 2023 Microsoft Patch Tuesday, (Tue, Jun 13th)
  • [ ] ISC Stormcast For Tuesday, June 13th, 2023 https://isc.sans.edu/podcastdetail/8536, (Tue, Jun 13th)
• 安全学术圈
  • [ ] 南洋理工大学 | 安卓恶意软件的分类解释研究
• The Hacker News
  • [ ] Beware: New DoubleFinger Loader Targets Cryptocurrency Wallets with Stealer
  • [ ] Over Half of Security Leaders Lack Confidence in Protecting App Secrets, Study Reveals
  • [ ] Adversary-in-the-Middle Attack Campaign Hits Dozens of Global Organizations
  • [ ] Webinar - Mastering API Security: Understanding Your True Attack Surface
  • [ ] Two Russian Nationals Charged for Masterminding Mt. Gox Crypto Exchange Hack
  • [ ] Critical FortiOS and FortiProxy Vulnerability Likely Exploited - Patch Now!
• Trend Micro Research, News and Perspectives
  • [ ] Ransomware Insurance: Security Strategies to Obtain Coverage
  • [ ] Building a seamless and secure cloud environment with AWS
  • [ ] SRE vs DevOps: Differences & Similarities
• Graham Cluley
  • [ ] As MOVEit hackers’ deadline approaches, Ofcom reveals it is amongst victims
  • [ ] US charges two men with Mt. Gox heist, the world’s largest cryptocurrency hack
• Krebs on Security
  • [ ] Microsoft Patch Tuesday, June 2023 Edition
• TorrentFreak
  • [ ] Court: Comcast Must Identify Accused BitTorrent Pirate
  • [ ] EUIPO Study: 60% of Pirates Also Buy Content From Legal Sources
• mov ax,bx
  • [ ] CVE-2023-20887 VMWare Aria Operations for Networks (vRealize Network Insight) unauthenticated RCE
• Forensic Focus
  • [ ] The Power Of Auto Asset Tagging In DFIR
• The Register - Security
  • [ ] June Patch Tuesday: VMware vuln under attack by Chinese spies, Microsoft kinda meh
  • [ ] Last of the Gozi 3 sentenced over Windows info-stealing malware ops
  • [ ] The commonality of criminal intrusion
  • [ ] These Microsoft Office security signatures are 'practically worthless'
  • [ ] Russia-Ukraine war sending shockwaves into cyber-ecosystem
  • [ ] UK telco watchdog Ofcom, Minnesota Dept of Ed named as latest MOVEit victims
  • [ ] China's cyber now aimed at infrastructure, warns CISA boss
  • [ ] India probes medical info 'leak' to Telegram
• Tor Project blog
  • [ ] New Release: Tails 5.14
• KitPloit - PenTest Tools!
  • [ ] Burpgpt - A Burp Suite Extension That Integrates OpenAI's GPT To Perform An Additional Passive Scan For Discovering Highly Bespoke Vulnerabilities, And Enables Running Traffic-Based Analysis Of Any Type
• Information Security
  • [ ] Is there no TOTP option for Google account 2FA?
  • [ ] From Defense to Detection: A Comprehensive Discussion on the Evolution of APT Countermeasures
  • [ ] Kepler Safe is hosting an exclusive cybersecurity webinar that will provide you with actionable strategies to safeguard your organization from cyber threats. Also, Get a lucky chance to win awesome prizes and giveaways! 🎁
• Deep Web
  • [ ] What happened to r/onions
  • [ ] Question regarding package shipping
• Security Affairs
  • [ ] Microsoft Patch Tuesday for June 2023 fixes 6 critical flaws
  • [ ] St. Margaret’s Health is the first hospital to cite a cyberattack as a reason for its closure
  • [ ] A database containing data of +8.9 million Zacks users was leaked online
  • [ ] Fortinet urges to patch the critical RCE flaw CVE-2023-27997 in Fortigate firewalls
  • [ ] UK communications regulator Ofcom hacked with a MOVEit file transfer zero-day
  • [ ] Experts released PoC exploit for MOVEit Transfer CVE-2023-34362 flaw
• Computer Forensics
  • [ ] Windows.edb
  • [ ] Memory analysis
  • [ ] I just started learning memory analysis, i need advice on whether I have done it correctly
  • [ ] Fork in the road
  • [ ] Q:Difference between FTK Imager and Autopsy/Sleuth kit
• Social Engineering
  • [ ] I got some Social Engineering Content for you all
  • [ ] What actions make you appear adventurous?
  • [ ] Am I wrong for messaging her again?
  • [ ] Cultural Manipulation through "Elimination of Harmful Language." Solid Ground Live Stream 4
  • [ ] How do I make someone think I was introduced by someone they know?
  • [ ] What are the legal and ethical implications of social engineering?
  • [ ] Need help with a coworker
  • [ ] Why do some people who speak less look down and smile when a joke is cracked on them? Seems to be their reflect reaction.
• Your Hacking Tutorial by Zempirians
  • [ ] Very old computer NEED HELP(compaq portable) 1981
  • [ ] Best mobile friendly osint tools?
  • [ ] debugger addresses
  • [ ] Can you make requests here?
• NetSPI
  • [ ] Getting Started with API Security Best Practices
• Paul's Security Weekly
  • [ ] Mad Dogs & Paper Clips, Fortinet, MoveIt, BatCloak, More News, & Jason Wood - SWN #304

[github-actions[bot]]

This issue was closed because it has been inactive for 14 days since being marked as stale.