In the latest patch security update, Microsoft disclosed a critical vulnerability in the Windows TCP/IP stack that requires urgent attention (CVE-2024-38063). the handling of IPv6 packets in the Windows TCP/IP stack. An unauthenticated attacker can exploit this vulnerability by sending specially crafted IPv6 packets to the target system, resulting in Remote Code Execution (RCE).

Apache Tomcat 9.0.0-M11 to 9.0.43 Apache Tomcat 8.5.7 to 8.5.63 CVE-2024-21733 Apache Tomcat information disclosure critical vulnerability risk

An unauthenticated remote attacker can achieve remote code execution, resulting in a threatening risk of compromising Windwos servers with Remote Desktop Licensing Services enabled.

The dark web is selling a Windows Local Privilege Escalation (LPE) zero-day vulnerability that reportedly affects multiple versions of the Windows operating system, including the latest version. This alarming development has been disclosed via an underground marketplace where threat actors have provided detailed specifications and capabilities of the vulnerability.

CVE-2024-32002 is a vulnerability in Git that enables RCE git clone during operation.By crafting repositories with submodules in a specific way, an attacker can execute malicious hooks by writing files to the directory .git/ using case-insensitive symbolic link handling on the file system.

An authentication bypass vulnerability in GitHub Enterprise Server (GHES) when using SAML single sign-on with optional cryptographic assertions can be exploited by an attacker to spoof a SAML response to configure and gain site administrator privileges. This allows an attacker to gain unauthorized access to an instance without prior authentication.

Artificial Intelligence Security Research released Inspect, an open-source testing platform designed to assess the safety and performance of AI models.Inspect detects the core knowledge, reasoning and autonomy of AI models, fostering the development of the global AI community, and Inspect becomes a cornerstone of AI security research.

According to The Guardian, Google Cloud Services recently suffered a major, never-before-seen misconfiguration incident that resulted in the deletion of a cloud subscription account for Australia's UniSuper fund and a week-long disruption in service.
UniSuper is a not-for-profit pension fund that manages a massive $125 billion with over half a million investors.
Although UniSuper made data backups in two cloud regions of Google Cloud, this major incident was caused by account deletions, resulting in the loss of both backups at the same time, which did not provide protection.
It was good that UniSuper had data backed up with other storage providers as well, which minimized the damage caused by this incident and accelerated the process of UniSuper's recovery of data on Google Cloud.

A critical zero-day vulnerability (CVE-2024-3400) in Palo Alto Networks PAN-OS software has been actively exploited by the hacker group UTA0218 in an attack campaign codenamed "Operation Midnight Eclipse". The vulnerability allows attackers to plant a Python backdoor program, gain system privileges, and perform lateral movement and data theft on the victim's network. Affected devices include PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls with the GlobalProtect gateway and device telemetry enabled.Palo Alto Networks has issued a security advisory with a remediation patch, and recommends users update as soon as possible.

The development of China's data factor market is on the road from resourceization to assetization, and the typical feature of data assetization is that data can play its role as a factor of production through circulation in a wider range outside the generating subject.
In terms of specific data asset valuation methods, the main ones elaborated in the existing literature are the cost method, the market method, the income method and the valuation technique method. For the cost method, although it has the characteristics of simple operation and easy landing, it also has the disadvantages of easy underestimation of value and difficult to accurately measure. For the market approach, although it can be more objective, truly reflect the value of data assets, and easy to be accepted by the market, but because of the need to have an open and active trading market, so it is difficult to practice on a wide scale in the short term. For the income approach, although it can better highlight the intrinsic value of the data, but due to the difficulty of reliable measurement of the future earnings of data assets, it is also difficult to land in the operation. For the valuation technique method, although it combines the advantages of fully reflecting the true value of data, not requiring an active market, and not having to accurately measure the future earnings of data assets, it is still in the exploratory stage because it requires a large amount of data on the value of data assets to be obtained in advance to train the model.