ATENTION‼ New - CVE-2019-20390
📖 Read
via "National Vulnerability Database".
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20389
📖 Read
via "National Vulnerability Database".
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-19721
📖 Read
via "National Vulnerability Database".
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-18666
📖 Read
via "National Vulnerability Database".
An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization.📖 Read
via "National Vulnerability Database".
🔐 How to enable SSL on Ubuntu Linux for testing 🔐
📖 Read
via "Security on TechRepublic".
Sometimes admins need to be able to test a web-based solution before deciding it's worth using. When that software requires SSL, you can enable a snake-oil SSL key for testing purposes.📖 Read
via "Security on TechRepublic".
TechRepublic
How to enable SSL on Ubuntu Linux for testing | TechRepublic
Sometimes admins need to be able to test a web-based solution before deciding it's worth using. When that software requires SSL, you can enable a snake-oil SSL key for testing purposes.
🔐 How to enable SSL on Ubuntu Linux for testing 🔐
📖 Read
via "Security on TechRepublic".
Sometimes admins need to be able to test a web-based solution before deciding it's worth using. When that software requires SSL, you can enable a snake oil SSL key for testing purposes.📖 Read
via "Security on TechRepublic".
TechRepublic
How to enable SSL on Ubuntu Linux for testing
Sometimes admins need to be able to test a web-based solution before deciding it's worth using. When that software requires SSL, you can enable a snake oil SSL key for testing purposes.
🕴 UK Supercomputing Service ARCHER Still Offline After Monday Attack 🕴
📖 Read
via "Dark Reading: ".
Incident comes amid US warnings about Chinese cybergroups targeting organizations involved in COVID-19-related research.📖 Read
via "Dark Reading: ".
Dark Reading
UK Supercomputing Service ARCHER Still Offline After Monday Attack
Incident comes amid US warnings about Chinese cybergroups targeting organizations involved in COVID-19-related research.
❌ Hoaxcalls Botnet Exploits Symantec Secure Web Gateways ❌
📖 Read
via "Threatpost".
The fast-moving botnet has added an exploit for an unpatched bug in an unsupported version of the security gateway.📖 Read
via "Threatpost".
Threat Post
Hoaxcalls Botnet Exploits Symantec Secure Web Gateways
The fast-moving botnet has added an exploit for an unpatched bug in an unsupported version of the security gateway.
🛠 TOR Virtual Network Tunneling Tool 0.4.3.5 🛠
📖 Go!
via "Security Tool Files ≈ Packet Storm".
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).📖 Go!
via "Security Tool Files ≈ Packet Storm".
Packetstormsecurity
TOR Virtual Network Tunneling Tool 0.4.3.5 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
ATENTION‼ New - CVE-2019-20802
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known direct way for an attacker to create a crafted directory name on a victim's device. However, a crafted directory name can occur if a victim extracts a ZIP archive that was provided by an attacker.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20801
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user's data) via cross-origin requests.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20800
📖 Read
via "National Vulnerability Database".
In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20799
📖 Read
via "National Vulnerability Database".
In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20798
📖 Read
via "National Vulnerability Database".
An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20797
📖 Read
via "National Vulnerability Database".
An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer overflow in client and server code responsible for handling received UDP packets, as demonstrated by I_SendPacket or I_SendPacketTo in i_network.c.📖 Read
via "National Vulnerability Database".
⚠ Monday review – the hot 17 stories of the week ⚠
📖 Read
via "Naked Security".
From DHL delivery phishes to the top 10 most exploited bugs - and everything in between. It's weekly roundup time.📖 Read
via "Naked Security".
Naked Security
Monday review – the hot 17 stories of the week
From DHL delivery phishes to the top 10 most exploited bugs – and everything in between. It’s weekly roundup time.
⚠ Shiny new Azure login attracts shiny new phishing attacks ⚠
📖 Read
via "Naked Security".
Admins working with Microsoft Azure beware: phishers are updating their assets to reflect changes on the company's cloud-based login screen.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🔐 GitLab survey suggests DevOps is becoming real, while DevSecOps has work to do 🔐
📖 Read
via "Security on TechRepublic".
Commentary: Developers are finally taking on more of an operational role, but they still aren't getting involved enough in security.📖 Read
via "Security on TechRepublic".
TechRepublic
GitLab survey suggests DevOps is becoming real, while DevSecOps has work to do
Commentary: Developers are finally taking on more of an operational role, but they still aren't getting involved enough in security.
🕴 The 3 Top Cybersecurity Myths & What You Should Know 🕴
📖 Read
via "Dark Reading: ".
With millions of employees now attempting to work from home, it's vital to challenge misconceptions about cybersecurity.📖 Read
via "Dark Reading: ".
Dark Reading
The 3 Top Cybersecurity Myths & What You Should Know
With millions of employees now attempting to work from home, it's vital to challenge misconceptions about cybersecurity.
⚠ Senate renews warrantless collection of web histories ⚠
📖 Read
via "Naked Security".
The government can keep on surveilling your online life without a warrant. An amendment to ban it failed by just one vote.📖 Read
via "Naked Security".
Naked Security
Senate renews warrantless collection of web histories
The government can keep on surveilling your online life without a warrant. An amendment to ban it failed by just one vote.
❌ Edison Mail iOS Bug Exposes Emails to Strangers ❌
📖 Read
via "Threatpost".
A bug introduced in an iOS software update on the Edison Mail app allowed emails to be viewed by strangers.📖 Read
via "Threatpost".
Threat Post
Edison Mail iOS Bug Exposes Emails to Strangers
A bug introduced in an iOS software update on the Edison Mail app allowed emails to be viewed by strangers.