[每日信息流] 2023-08-09

[chainreactorbot]

每日安全资讯（2023-08-09）

• 喵喵喵喵
  • [ ] Download - HackTheBox
• 先知安全技术社区
  • [ ] WP Ultimate CSV Importer远程代码执行分析-CVE-2023-4142
• HackerOne Hacker Activity
  • [ ] Usernames still visible on report export pdf despite "I want to redact all usernames" is selected
• Files ≈ Packet Storm
  • [ ] Debian Security Advisory 5471-1
  • [ ] Ubuntu Security Notice USN-6277-1
  • [ ] Red Hat Security Advisory 2023-4531-01
  • [ ] GNOME Files 43.4 Privilege Escalation
  • [ ] Red Hat Security Advisory 2023-4456-01
  • [ ] Red Hat Security Advisory 2023-4536-01
  • [ ] Ubuntu Security Notice USN-6267-2
  • [ ] Red Hat Security Advisory 2023-4523-01
  • [ ] Varient News Magazine Script 2.2 Insecure Settings
  • [ ] Red Hat Security Advisory 2023-4459-01
  • [ ] Red Hat Security Advisory 2023-4539-01
  • [ ] Red Hat Security Advisory 2023-4529-01
  • [ ] Video Whisper Conference 1.01 Cross Site Scripting
  • [ ] Red Hat Security Advisory 2023-4535-01
  • [ ] Red Hat Security Advisory 2023-4520-01
  • [ ] Videoflix CMS 1.3 Insecure Settings
  • [ ] Red Hat Security Advisory 2023-4537-01
  • [ ] Red Hat Security Advisory 2023-4524-01
  • [ ] Red Hat Security Advisory 2023-4517-01
  • [ ] Virtues cpanelCMS 1.0 SQL Injection
  • [ ] Voodoo Chat 1.3 Cross Site Scripting
  • [ ] eneblur CMS 1.0 SQL Injection
  • [ ] Red Hat Security Advisory 2023-4527-01
  • [ ] Red Hat Security Advisory 2023-4541-01
  • [ ] CMS BMGI International 4.0 SQL Injection
• Trustwave Blog
  • [ ] The Risks and Rewards of ChatGPT in the Modern Business Environment
• SecWiki News
  • [ ] SecWiki News 2023-08-08 Review
• Tenable Blog
  • [ ] Microsoft’s August 2023 Patch Tuesday Addresses 73 CVEs (CVE-2023-38180)
  • [ ] Password Management and Authentication Best Practices
• Security Boulevard
  • [ ] OWASP’s CycloneDX SBOM | Contrast Security
  • [ ] Patch Tuesday Update – August 2023
  • [ ] BSides Leeds 2023 – Liam Follin – How To Get Away With Hacking
  • [ ] Using Automation to Hunt for the Elusive LOLBAS
  • [ ] Big News! Seceon Acquires Helixera, Hires Founder as VP of Cybersecurity Solutions Architecture
  • [ ] Outsmarting Advanced Cyber Threats: A Success Story of a Bank’s Defense Mechanism with Votiro Cloud for Email
  • [ ] The MSP’s Role in Cyber Insurance
  • [ ] Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’
  • [ ] Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnarav – #254 – The Psychological Safety Self-Assessment
  • [ ] How to prevent account takeovers: ATO prevention in 2023
• Sploitus.com Exploits RSS Feed
  • [ ] AMSS++ 6.11 SQL Injection exploit
  • [ ] eHato CMS 1.0 Open Redirection exploit
  • [ ] CMS BMGI International 4.0 SQL Injection exploit
  • [ ] Emagic Data Center Management Suite v6.0 - OS Command Injection exploit
  • [ ] GNOME Files 43.4 Privilege Escalation Vulnerability exploit
  • [ ] mooSocial 3.1.8 - Reflected XSS exploit
  • [ ] Varient News Magazine Script 2.2 Insecure Settings exploit
  • [ ] GNOME Files 43.4 Privilege Escalation exploit
  • [ ] Lucee 5.4.2.17 - Authenticated Reflected XSS exploit
  • [ ] Videoflix CMS 1.3 Insecure Settings exploit
  • [ ] Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated) exploit
  • [ ] Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated) Exploit exploit
  • [ ] PHPJabbers Vacation Rental Script 4.0 - CSRF Vulnerability exploit
  • [ ] Lucee 5.4.2.17 - Authenticated Reflected XSS Vulnerability exploit
  • [ ] Emagic Data Center Management Suite v6.0 - OS Command Injection Exploit exploit
  • [ ] eneblur CMS 1.0 SQL Injection exploit
  • [ ] mooSocial 3.1.8 - Reflected XSS Vulnerability exploit
  • [ ] Intelliants Subrion CMS 4.2.1 Remote Code Execution Exploit exploit
  • [ ] Video Whisper Conference 1.01 Cross Site Scripting exploit
  • [ ] Citrix ADC (NetScaler) Remote Code Execution Exploit exploit
  • [ ] Voodoo Chat 1.3 Cross Site Scripting exploit
  • [ ] EMIS WEB School CMS 1 SQL Injection exploit
  • [ ] Social-Commerce 3.1.6 - Reflected XSS exploit
  • [ ] Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure exploit
  • [ ] Data Driven CMS 0.4.1 Database Disclosure exploit
  • [ ] Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure Vulnerability exploit
  • [ ] Doubleclick Admin 1 Cross Site Request Forgery exploit
  • [ ] Virtues cpanelCMS 1.0 SQL Injection exploit
  • [ ] PHPJabbers Vacation Rental Script 4.0 - CSRF exploit
  • [ ] mooSocial Social-Commerce 3.1.6 - Reflected XSS Vulnerability exploit
• Chromium Blog
  • [ ] Smoothing out the scrolling experience in Chrome on Android
• SpyLogic.net
  • [ ] Management Hacking 102: Links and References
• • [ ] SiteCheck Remote Website Scanner — Mid-Year 2023 Report
• 博客园 - zha0gongz1
  • [ ] 防护程序研究乱记 - zha0gongz1
• Twitter @Nicolas Krassas
  • [ ] Citrix Zero-Day: 7K Instances Remain Exposed, 460 Compromised https://www.darkreading.com/vulnerabilities-threats/citrix-zero-day-update-7000-instance...
  • [ ] Raft of TETRA Zero-Day Vulnerabilities Endanger Industrial Communications https://www.darkreading.com/dr-global/tetra-zero-day-vulnerabilities-endange...
  • [ ] Intel BIOS Advisory – Memory Corruption in HID Drivers https://research.nccgroup.com/2023/08/08/intel-bios-advisory-memory-corruption-in-hid-drivers/
  • [ ] Spring WebFlux – CVE-2023-34034 – Write-Up and Proof-of-Concept https://jfrog.com/blog/spring-webflux-cve-2023-34034-write-up-and-proof-of-concept/
  • [ ] New Downfall attacks on Intel CPUs steal encryption keys, data https://www.bleepingcomputer.com/news/security/new-downfall-attacks-on-intel-cpus-steal...
  • [ ] Interpol takes down 16shop phishing-as-a-service platform https://www.bleepingcomputer.com/news/security/interpol-takes-down-16shop-phishing-as-a-serv...
  • [ ] Microsoft August 2023 Patch Tuesday warns of 2 zero-days, 87 flaws https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2023-patch-tuesday...
  • [ ] ARTToolkit is an interactive cheat sheet, containing an useful list of offensive security tools and their respective commands/payloads, to be used in ...
  • [ ] Predatory Pricing https://blog.dshr.org/2023/08/predatory-pricing.html
  • [ ] Evading signature-based phishing detections https://www.reddit.com/r/netsec/comments/15ljukw/evading_signaturebased_phishing_detections/
  • [ ] Android 14 to let you block connections to unencrypted cellular networks https://www.bleepingcomputer.com/news/google/android-14-to-let-you-block-conn...
  • [ ] QakBot Malware Operators Expand C2 Network with 15 New Servers https://thehackernews.com/2023/08/qakbot-malware-operators-expand-c2.html
  • [ ] BloodHound Community Edition: A New Era https://posts.specterops.io/bloodhound-community-edition-a-new-era-d64689806e90?source=rss----f05f8696e3cc---4
  • [ ] Google Fails To End $5 Billion Consumer Privacy Lawsuit https://packetstormsecurity.com/news/view/34878/Google-Fails-To-End-5-Billion-Consumer-Privacy...
  • [ ] Cryptomining and Malware Flourish on Misconfigured Kubernetes Clusters https://www.hackread.com/cryptomining-malware-misconfigured-kubernetes-clusters...
  • [ ] UK Electoral Commission data breach exposes 8 years of voter data https://www.bleepingcomputer.com/news/security/uk-electoral-commission-data-breach-e...
  • [ ] Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities https://www.sentinelone.com/blog/enterprise-security-essentials-top-1...
  • [ ] Kubernetes Exposed: One Yaml away from Disaster https://www.reddit.com/r/netsec/comments/15lgroi/kubernetes_exposed_one_yaml_away_from_disaster/
  • [ ] You Can’t Rush Post-Quantum-Computing Cryptography Standards https://www.schneier.com/blog/archives/2023/08/you-cant-rush-post-quantum-computing-stan...
  • [ ] China – which surveils everyone everywhere – floats facial recognition rules https://go.theregister.com/feed/www.theregister.com/2023/08/08/china_fa...
• Google Online Security Blog
  • [ ] Downfall and Zenbleed: Googlers helping secure the ecosystem
  • [ ] Android 14 introduces first-of-its-kind cellular connectivity security features
  • [ ] An update on Chrome Security updates – shipping security fixes to you faster
• Soroush Dalili (@irsdl) Blog
  • [ ] Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899)
• unSafe.sh - 不安全
  • [ ] Android 14 introduces first-of-its-kind cellular connectivity security features
  • [ ] An update on Chrome Security updates – shipping security fixes to you faster
  • [ ] 苹果购买了台积电 3 纳米工艺全部产能
  • [ ] 世界工厂的年轻人不愿进厂工作
  • [ ] 今年出生人口预计在 800 万左右
  • [ ] 接盘NUC后华硕放飞自我？这做的开发板都像是NUC板子
  • [ ] Zoom 要求员工重返办公室
  • [ ] 大会员行为：YouTube向所有已开会员的用户提供1080P高码率版本
• Recent Commits to cve:main
  • [ ] Update Tue Aug 8 00:24:53 UTC 2023
• Envato Tuts+ Code - Mobile Development
  • [ ] Kotlin From Scratch: Abstract Classes, Interfaces, Inheritance, and Type Alias
• 嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
  • [ ] 如何使用 Python 工具构建人工智能驱动的 SaaS 平台（下）
  • [ ] 梆梆安全出席2023中国(北京)国际视听大会，共话融媒发展的守正之道
  • [ ] 信创认证！梆梆API安全平台获麒麟软件适配认证
  • [ ] 夏日观影季：8部炙手可热的网络安全纪录片
• Perception Point
  • [ ] How to Conduct a Phishing Attack in a 5 Easy Steps
• CXSECURITY Database RSS Feed - CXSecurity.com
  • [ ] WordPress Ninja Forms 3.6.25 Cross Site Scripting
  • [ ] Adlisting Classified Ads 2.14.0 Information Disclosure
  • [ ] GNOME Files 43.4 Privilege Escalation
  • [ ] Emagic Data Center Management Suite v6.0 OS Command Injection
• Vulnerabilities and Threat Research – Qualys Security Blog
  • [ ] Microsoft Patch Tuesday, August 2023 Security Update Review
• gynvael.coldwind//vx.log (pl)
  • [ ] Konferencja Security Case Study 2023
• NVISO Labs
  • [ ] Introducing BitSight Automation Tool
• SpiderLabs Blog from Trustwave
  • [ ] WormGPT and FraudGPT – The Rise of Malicious LLMs
• Twitter @bytehx
  • [ ] RT haksec.io: Using Nuclei to uncover vulnerabilities in: 🚨 Raw TCP connections 🚨 DNS 🚨 Files 🚨 and more! Find out how 👇 https://blog.p...
• Forcepoint
  • [ ] Artificial Intelligence in Business: AI in Marketing
• SAP Blogs
  • [ ] Localization in SAP S/4HANA Cloud, Public Edition 2308
  • [ ] Life Cycle Management in SAP Datasphere: Transporting Content between Tenants
  • [ ] The Fundamentals of Material Traceability – Batch-Managed and Serialized Products
  • [ ] Auto Opt-In/Out Sync Between Emarsys and C4C
  • [ ] SAC – Creation of planning version from admin cockpit
  • [ ] Creating best in class documentation – together!
  • [ ] SAP Native HANA Procedure to Create and Populate a Transpose Table
  • [ ] Backoffice search performance improvement
  • [ ] Display Freight Amount for Asset PO in MIRO
• Malwarebytes Labs
  • [ ] Server breach could be fatal blow for LetMeSpy
  • [ ] Digital assets continue to be prime target for malvertisers
• Horizon3.ai
  • [ ] Horizon3.ai Raises $40M Series C to Confront Attackers with Proactive, Continuous Security Testing
• Application Security Blog
  • [ ] Developer-first security to prevent downstream risks
  • [ ] Synopsys and NowSecure join forces
• Intigriti
  • [ ] How Intigriti Optimizes Prato’s Software Security
• SentinelOne
  • [ ] Enterprise Security Essentials | Top 12 Most Routinely Exploited Vulnerabilities
• Microsoft Security Response Center
  • [ ] Congratulations to the MSRC 2023 Most Valuable Security Researchers!
  • [ ] Updating our Vulnerability Severity Classification for AI Systems
• daniel.haxx.se
  • [ ] Mastering the curl command line
• Exploit-DB.com RSS Feed
  • [ ] [webapps] Emagic Data Center Management Suite v6.0 - OS Command Injection
  • [ ] [webapps] PHPJabbers Vacation Rental Script 4.0 - CSRF
  • [ ] [webapps] Social-Commerce 3.1.6 - Reflected XSS
  • [ ] [webapps] mooSocial 3.1.8 - Reflected XSS
  • [ ] [webapps] Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
  • [ ] [webapps] Lucee 5.4.2.17 - Authenticated Reflected XSS
  • [ ] [webapps] Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
• HackerNews
  • [ ] 航旅业大地震：常旅客积分系统曝严重漏洞
  • [ ] 涉“违规泄露客户信息”等 6 项违法违规，中行被罚 210 万
  • [ ] 英国内阁：网络领域风险巨大，未来两年关基设施或发生重大网络攻击
  • [ ] 新型声学攻击通过键盘击键窃取数据，准确率高达 95%
  • [ ] 大多漏洞都有一个相同点：它们已经很旧了
  • [ ] Facebook 企业账号危机: Salesforce 漏洞成黑客入侵新通道
• Private Feed for M09Ic
  • [ ] phra starred susMdT/effective-waffle
  • [ ] ourren starred arkseclabs/fast-scanner
  • [ ] phith0n released v1.0.1 at vulhub/metersphere-plugin-Backdoor
  • [ ] Ridter starred BishopFox/CVE-2023-3519
  • [ ] Ridter starred nathanlopez/Stitch
  • [ ] theLSA starred FlowiseAI/Flowise
  • [ ] theLSA starred yangjianxin1/Firefly
  • [ ] theLSA starred jatrost/awesome-kubernetes-threat-detection
  • [ ] theLSA starred zgao264/AirFly
  • [ ] theLSA starred Maxul/Awesome-SGX-Open-Source
  • [ ] theLSA starred PortSwigger/BChecks
  • [ ] theLSA started following vladko312
  • [ ] theLSA starred Amulab/CAudit
  • [ ] theLSA starred 0x727/CloudSandbox
  • [ ] theLSA starred 3gstudent/Homework-of-Python
  • [ ] theLSA starred evilashz/PigScheduleTask
  • [ ] theLSA starred invoke-ai/InvokeAI
  • [ ] theLSA starred xorbitsai/inference
  • [ ] theLSA started following sari3l
  • [ ] theLSA starred DDizzzy79/Ret2GPT
  • [ ] theLSA starred geekan/MetaGPT
  • [ ] theLSA starred BishopFox/CVE-2023-3519
  • [ ] theLSA starred datackmy/FallingSkies-CVE-2023-35885
  • [ ] theLSA starred splunk/security_content
  • [ ] glzjin starred easychen/CookieCloud
  • [ ] Ridter forked Ridter/sshimpanzee from lexfo/sshimpanzee
  • [ ] niudaii starred niudaii/hik-ys-api-check
  • [ ] niudaii starred niudaii/rtspscan
  • [ ] niudaii released v1.0 at niudaii/hik-ys-api-check
  • [ ] niudaii created a repository niudaii/hik-ys-api-check
• 奇客Solidot–传递最新科技情报
  • [ ] AI 研究员称通过 Zoom 声音能以 93% 正确率识别按键
  • [ ] 工信部要求 APP 备案
  • [ ] 苹果购买了台积电 3 纳米工艺全部产能
  • [ ] 世界工厂的年轻人不愿进厂工作
  • [ ] 今年出生人口预计在 800 万左右
  • [ ] Zoom 要求员工重返办公室
  • [ ] 科学家观测到来自太阳的伽马射线
  • [ ] 新变种 EG.5 成为美国新冠主流变种
  • [ ] 东芝宣布了国内财团的收购要约
  • [ ] 间谍软件公司在黑客删除其服务器上的数据后倒闭
  • [ ] PayPal 推出美元支持的稳定币
  • [ ] 伊拉克因个人数据泄露屏蔽 Telegram
• 吾爱破解论坛
  • [ ] [已开售：【加售通知】2023年吾爱破解定制T恤第二次预售

手机用户请直接复制淘口令： 【淘宝】https://m.tb.cn/h.5Xpzt9C?tk=sPGJdEZpqE8 CZ0001 「2023 吾爱 定制T恤」

电脑购买链接： https://item.taobao.com/item.htm?id=732248734927](https://mp.weixin.qq.com/s?__biz=MjM5Mjc3MDM2Mw==&mid=2651139698&idx=1&sn=536dc9fc05670fb07bb23a1eb614ed7f&chksm=bd50be268a273730153c9716b94f3c27bcc0a38d2a8f1465d4196c332565434ab20b0c02be7b&scene=58&subscene=0#rd)

• 看雪学苑
  • [ ] 安全开发·数智未来 | 三六零天御，助力第七届安全开发者峰会（2023 SDC）
  • [ ] UPX 4.0.2 源码分析
  • [ ] 准确率高达95%，英国研究团队能从键盘敲击声中提取数据
  • [ ] 本周更新！CTF训练营-Web篇
• 腾讯安全应急响应中心
  • [ ] 七夕专项众测开冲，4倍奖励、多倍甜蜜！
• 微步在线研究响应中心
  • [ ] 漏洞通告|致远OA文件上传漏洞
  • [ ] 发现红队资产IP！2023攻防演练情报抢先看（第一波）
• 安全牛
  • [ ] 8部值得一看的网络安全主题纪录片
  • [ ] 《网络安全标准实践指南——网络安全产品互联互通 告警信息格式（征求意见稿）》公开征求意见
  • [ ] 《网络安全标准实践指南——生成式人工智能服务内容标识方法（征求意见稿）》公开征求意见
• 安全内参
  • [ ] 英国内阁：网络领域风险巨大，未来两年关基设施或发生重大网络攻击
  • [ ] 涉“违规泄露客户信息”等6项违法违规，中行被罚210万
• Checkmarx.com
  • [ ] Checkmarx Integrates Sysdig Runtime Insights for Faster Prioritization of Cloud-Native Application Vulnerabilities
• KitPloit - PenTest & Hacking Tools
  • [ ] Nac_Bypass_Agent - This Function Combines All The Above Functions And Takes Necessary Information From The User To Change The IP And MAC Address, Start The Responder And Tcpdump Tools, And Run The Nbtscan Tool
• 58安全应急响应中心
  • [ ] 榜单|7月英雄榜及额外奖励名单公布
• 赵武的自留地
  • [ ] 全面提效自力更生
• FreeBuf网络安全行业门户
  • [ ] FB 赠书第 99 期 | 王牌战队 ChaMd5 打造的《CTF实战：技术、解题与进阶》来了!
  • [ ] 涉“违规泄露客户信息”等6项违法违规，中行被罚210万
  • [ ] 国家网信办发布《人脸识别技术应用安全管理规定（试行）（征求意见稿）》
  • [ ] 新型声学攻击通过键盘击键窃取数据，准确率高达 95%
  • [ ] 2023 年北京市网络安全企业全景图（第一版）调研启动
  • [ ] FreeBuf早报 | 微软修复Power Platform缺陷；Points.com 故障导致数据泄露
• M01N Team
  • [ ] 2023攻防应知应会｜发布！细数Active Directory域攻击面十大安全风险
• 安全攻防团队
  • [ ] ​云安全风险情报（07.31-08.06）
• 关键基础设施安全应急响应中心
  • [ ] 全球数据跨境流动合规 半月观察（第十四期）
  • [ ] 国家互联网信息办公室关于《人脸识别技术应用安全管理规定（试行）（征求意见稿）》公开征求意见的通知
  • [ ] 网络安全人才职业化培养的创新与探索
  • [ ] 推动新时代网信事业高质量发展
  • [ ] 对手or盟友?朝鲜黑客秘密入侵俄罗斯火箭设计局网络盗取关键技术
• 极客公园
  • [ ] 谷歌的 RT-2，是不是机器人的 GPT-3 时刻？
  • [ ] 微信上线「朋友圈置顶」功能；上半年中国汽车出口全球第一；《芭比》票房破 10 亿美元，创女性导演记录｜极客早知道
• 三六零CERT
  • [ ] 安全日报（2023.08.08）
• 代码卫士
  • [ ] 被别家CEO狂怼，微软火速且老实地修复了严重漏洞后......回怼
  • [ ] CISA 发布未来三年的网络安全战略规划
• 腾讯玄武实验室
  • [ ] 每日安全动态推送(8-8)
• 情报分析师
  • [ ] 美国对关键矿产的全球追求（附蒙古资料下载）
  • [ ] 军情内参知识社群——你值得拥有的地缘情报中心
  • [ ] 关注小号，谨防失联！
• 渗透测试网络安全
  • [ ] 必备手册 | 应急响应与溯源导图
• 安全研究GoSSIP
  • [ ] G.O.S.S.I.P 阅读推荐 2023-08-08 It's all in your head(set)
• Ghostlulz
  • [ ] Powershell AMSI Bypass
• 雷神众测
  • [ ] 雷神众测漏洞周报2023.07.31-2023.08.06
• 微步在线
  • [ ] 高价收未公开详情漏洞！
  • [ ] 用测绘，把红队武器库扒个底朝天
• KCon 黑客大会
  • [ ] KCon演讲议题巡展｜梅塞德斯·奔驰汽车车机安全研究
• 补天平台
  • [ ] “最佳新人”大少爷的升级打怪之路 | 今晚打老虎专访
  • [ ] 筑梦未来，英雄集结！补天校园GROW计划报名启动！
• 奇安信 CERT
  • [ ] 攻防演练收敛已知漏洞攻击面，请更新这些软件到最新版本！
• 中国信息安全
  • [ ] 通知 | 国家网信办就《人脸识别技术应用安全管理规定（试行）（征求意见稿）》公开征求意见（附全文）
  • [ ] 行业 | 天懋信息：以“专精特新”优势筑就视频物联安全业务高速增长
  • [ ] 通知 | 信安标委就《网络安全标准实践指南——生成式人工智能服务内容标识方法（征求意见稿）》公开征求意见（附全文）
  • [ ] 专家观点 | 生成式人工智能法律监管的认识误区及匡正
  • [ ] 观点 | 提高用网治网水平 打造清朗网络空间
  • [ ] 评论 | 加快构建网络空间命运共同体
  • [ ] 评论 | “自媒体”并非不当非法言行的法外之地
• 中通安全应急响应中心
  • [ ] 关于中通SRC平台升级维护的通知
• 国家互联网应急中心CNCERT
  • [ ] CNVD漏洞周报2023年第31期
  • [ ] 上周关注度较高的产品安全漏洞(20230731-20230806)
• Beacon Tower Lab
  • [ ] 2023攻防演练重点漏洞关注列表
• 网络安全研究宅基地
  • [ ] 攻防对抗分析利器-云沙箱恶意配置提取
• 字节跳动安全中心
  • [ ] 多看一眼ByteSRC，命运的齿轮开始转动
• 斗象智能安全
  • [ ] 杀伤攻方“有生力量”｜演习期间云蜜罐布控策略指南，请注意查收！
• 嘶吼专业版
  • [ ] 夏日观影季：8部炙手可热的网络安全纪录片
  • [ ] 如何使用 Python 工具构建人工智能驱动的 SaaS 平台（下）
• 安全圈
  • [ ] 【安全圈】始于猎艳，终于诈骗！带你了解“约炮”APP
  • [ ] 【安全圈】汉堡王泄露大量敏感凭证
  • [ ] 【安全圈】Facebook企业账号危机:Salesforce漏洞成黑客入侵新通道
  • [ ] 【安全圈】明星行程信息被标价出售 获刑8人中5人是高铁站员工
• 山石网科安全技术研究院
  • [ ] 云天收夏色，木叶动秋声。
• LuxSci
  • [ ] 7 Essential Steps to Creating a HIPAA Website
• 网安寻路人
  • [ ] 解构《人脸识别技术应用安全管理规定（试行）》（征求意见稿）的监管逻辑
• Qualys Security Blog
  • [ ] Microsoft Patch Tuesday, August 2023 Security Update Review
  • [ ] Ensuring Compliance with DORA: How Qualys Solutions Can Help
• Over Security - Cybersecurity news aggregator
  • [ ] Interpol takes down phishing-as-a-service platform used by 70,000 people
  • [ ] Malicious extensions can abuse VS Code flaw to steal auth tokens
  • [ ] Microsoft Office update breaks actively exploited RCE attack chain
  • [ ] SiteCheck Remote Website Scanner — Mid-Year 2023 Report
  • [ ] Israeli hospital redirects new patients following ransomware attack
  • [ ] What Cisco Talos knows about the Rhysida ransomware
  • [ ] Six critical vulnerabilities included in August’s Microsoft security update
  • [ ] Serious Security: Why learning to touch-type could protect you from audio snooping
  • [ ] Windows 11 KB5029263 cumulative update released with 27 fixes
  • [ ] Windows 10 KB5029244 and KB5029247 updates released
  • [ ] Microsoft August 2023 Patch Tuesday warns of 2 zero-days, 87 flaws
  • [ ] Ukraine says it thwarted attempt to breach military tablets
  • [ ] Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’
  • [ ] Chinese military hackers targeted at least 17 countries across Asia, Europe and North America
  • [ ] New Downfall attacks on Intel CPUs steal encryption keys, data
  • [ ] Interpol takes down 16shop phishing-as-a-service platform
  • [ ] Android 14 to let you block connections to unencrypted cellular networks
  • [ ] New Inception attack leaks sensitive data from all AMD Zen CPUs
  • [ ] New Inception attack leaks secrets from all AMD Zen CPUs
  • [ ] Android 14 to block connections to unencrypted cellular networks
  • [ ] One woman's Orwellian experience with disinformation
  • [ ] UK Electoral Commission data breach exposes 8 years of voter data
  • [ ] What is commercial spyware?
  • [ ] Threat Hunting Report 2023: CrowdStrike rileva aumento degli attacchi basati sull’identità. L’intervista a Luca Nilo Livrieri
  • [ ] Zoom amends terms of service after pushback on using calls to train AI models
  • [ ] ‘Hostile actors’ hacked UK electoral register, accessed ‘high volume’ of data
  • [ ] Q2 2023 Cyber Attacks Statistics
  • [ ] CraftRise - 2,532,527 breached accounts
  • [ ] Mysterious Team Bangladesh tra i gruppi di hacktivisti più attivi
  • [ ] Il cyber crimine e le risposte inadeguate: perché è importante colmare il digital mismatch
  • [ ] Suspected Vietnamese hacker targets Chinese, Bulgarian organizations with new ransomware
• 火绒安全
  • [ ] 夏未尽，秋已至
• CNCERT国家工程研究中心
  • [ ] 全球数据跨境流动合规 半月观察（第十四期）
  • [ ] 国家互联网信息办公室关于《人脸识别技术应用安全管理规定（试行）（征求意见稿）》公开征求意见的通知
  • [ ] 网络攻击扰乱美国多州医院和医疗保健系统
  • [ ] 谷歌：安卓恶意软件通过版本控制潜藏在Google Play商店
  • [ ] Facebook企业账号危机:Salesforce漏洞成黑客入侵新通道
• 奇安盘古
  • [ ] 盘古实验室连续三年荣获华为终端安全突出贡献奖
• Forensic Focus
  • [ ] UK Urged To Combat Tech-Facilitated Domestic Abuse
  • [ ] Rachael Medhurst, Senior Lecturer In Digital Forensics, University Of South Wales
• SANS Internet Storm Center, InfoCON: green
  • [ ] Microsoft August 2023 Patch Tuesday, (Tue, Aug 8th)
  • [ ] ISC Stormcast For Tuesday, August 8th, 2023 https://isc.sans.edu/podcastdetail/8606, (Tue, Aug 8th)
• Schneier on Security
  • [ ] You Can’t Rush Post-Quantum-Computing Cryptography Standards
• Have I Been Pwned latest breaches
  • [ ] CraftRise - 2,532,527 breached accounts
• 黑伞安全
  • [ ] 要H好W，你必须要会！好项目分享：Mshell-攻防内存马研究
• HACKMAGEDDON
  • [ ] Q2 2023 Cyber Attacks Statistics
• Il Disinformatico
  • [ ] La cittadina che non ha mai conosciuto l’automobile e va solo in elettrico. Dagli anni '80
• Posts By SpecterOps Team Members - Medium
  • [ ] BloodHound Community Edition: A New Era
• Chaos Computer Club - last 100 events feed
  • [ ] CCCamp Reisehinweise (petitfoo)
• Palo Alto Networks Blog
  • [ ] Multiplying Force with Automation — Reducing the Soul Crushing Work
• Security Current
  • [ ] Information Sharing for the Common Good
  • [ ] Dror Kashti, CEO and Co-Founder, Sweet Security
• Security Affairs
  • [ ] Microsoft Patch Tuesday for August 2023 fixed 2 actively exploited flaws
  • [ ] UK Electoral Commission discloses a data breach
  • [ ] 43 Android apps in Google Play with 2.5M installs loaded ads when a phone screen was off
• Full Disclosure
  • [ ] GNOME Files silently extracts setuid files from ZIP archives
• KitPloit - PenTest Tools!
  • [ ] Nac_Bypass_Agent - This Function Combines All The Above Functions And Takes Necessary Information From The User To Change The IP And MAC Address, Start The Responder And Tcpdump Tools, And Run The Nbtscan Tool
• Blackhat Library: Hacking techniques and research
  • [ ] BSides @tuscany Roll Call, any u/'s here?
  • [ ] Stay away from TikTok advertising individually unless you read this and know the risks
• Trend Micro Research, News and Perspectives
  • [ ] Leverage the AWS Sustainability Pillar to Minimize Environmental Impact
  • [ ] Lower Data Breach Insurance Costs with These Tips
  • [ ] Cybersecurity Threat 1H 2023 Brief with Generative AI
• Technical Information Security Content & Discussion
  • [ ] Downfall attacks (another speculative execution attack on Intel silicon)
  • [ ] Kubernetes Exposed: One Yaml away from Disaster
  • [ ] Revealing VS Code's Vulnerability: Token Storage is Accessible Across All Extensions
  • [ ] Reverse Engineering the Apple MultiPeer Connectivity Framework
  • [ ] Multi-party computation is (sort of) changing the game
  • [ ] Evading signature-based phishing detections
  • [ ] Getting pwn'd by AI: Penetration Testing with Large Language Models
  • [ ] CVE-2023-34034 Spring WebFlux Security Bypass - Write-up & PoC
• Computer Forensics
  • [ ] Art of Memory Forensics
  • [ ] Need independent eyes on this Cellebrite report related to a murder case in Canton, Massachusetts. TYIA.
  • [ ] Modern Phones and Advanced Logical Acquisitions
• Social Engineering
  • [ ] Best Social Engineering Technique Ever?
• Instapaper: Unread
  • [ ] L'intelligenza artificiale può indovinare la tua password ascoltando il suono dei tasti che premi
  • [ ] Microsoft Signing Key Stolen by Chinese
  • [ ] As cars hoover up more and more driver data, is it time to regulate the industry
  • [ ] Browser-password-stealer - Get All The Saved Passwords, Credit Cards And Bookmarks From Chromium Based Browsers Supports Chromium 80 And Above!
• Krebs on Security
  • [ ] Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’
• TorrentFreak
  • [ ] Judge Gives MindGeek ‘Pirate’ Domains After Porn Pirate Violates Injunction
  • [ ] Warning: TorrentFreak’s Twitter / X Account Has Been Hijacked
  • [ ] Lead YouTube Content-ID Scammer Requests Reduced Prison Sentence
• Your Hacking Tutorial by Zempirians
  • [ ] Need assistance with sqlmap
  • [ ] General Advice and Thought Process.
• netsecstudents: Subreddit for students studying Network Security and its related subjects
  • [ ] Need assistance with sqlmap.
  • [ ] Node express body-parser error
  • [ ] Where do I go from here?
• Securityinfo.it
  • [ ] Mysterious Team Bangladesh tra i gruppi di hacktivisti più attivi
• Information Security
  • [ ] What precautions do you take when disposing of physical documents with sensitive information?
• The Hacker News
  • [ ] QakBot Malware Operators Expand C2 Network with 15 New Servers
  • [ ] Hackers Abusing Cloudflare Tunnels for Covert Communications
  • [ ] Understanding Active Directory Attack Paths to Improve Security
  • [ ] New Yashma Ransomware Variant Targets Multiple English-Speaking Countries
  • [ ] LOLBAS in the Wild: 11 Living-Off-The-Land Binaries That Could Be Used for Malicious Purposes
• The Register - Security
  • [ ] Microsoft, Intel lead this month's security fix emissions
  • [ ] Cyber-extortionists pillage Colorado education dept
  • [ ] UK voter data within reach of miscreants who hacked Electoral Commission
  • [ ] China – which surveils everyone everywhere – floats facial recognition rules
  • [ ] North Korean hackers had access to Russian missile maker for months, say researchers
• eXploit
  • [ ] DES Is Useful... Sometimes
• NetSPI
  • [ ] NetSPI Debuts ML/AI Penetration Testing, a Holistic Approach to Securing Machine Learning Models and LLM Implementations
• Deeplinks
  • [ ] California's DELETE Act Protects Us From Data Brokers
  • [ ] Announcing the Tor University Challenge
  • [ ] EFF Launches the Tor University Challenge
  • [ ] It's Summer Security Week at EFF
  • [ ] EFF at Las Vegas Hacker Summer Camp
• Security Weekly Podcast Network (Audio)
  • [ ] You've Got Appsec, But Do You Have ArchSec? - Merritt Baer - ASW #250
  • [ ] BilDad, points.com, Papercut, Prospect , SMS, Microsoft, DAAS, Jason Wood, and More - SWN #316
  • [ ] Deciphering The National Cyber Workforce and Education Strategy - Dr. José-Marie Griffiths - BSW #315

[github-actions[bot]]

This issue is stale because it has been open for 30 days with no activity.

[github-actions[bot]]

This issue was closed because it has been inactive for 14 days since being marked as stale.