🔐 Security expert weighs in on cybersecurity regulation and ransomware attacks of US cities 🔐
📖 Read
via "Security on TechRepublic".
Bryson Bort, founder and CEO of cybersecurity company SCYTHE, fears "death by a thousand paper cuts" more than than a digital apocalypse. He also shares his views on how well cyber-deterrence works.📖 Read
via "Security on TechRepublic".
TechRepublic
Security expert weighs in on cybersecurity regulation and ransomware attacks of US cities
Bryson Bort, founder and CEO of cybersecurity company SCYTHE, fears "death by a thousand paper cuts" more than than a digital apocalypse. He also shares his views on how well cyber-deterrence works.
🔐 Security expert weighs in on cybersecurity regulation and ransomware attacks of US cities 🔐
📖 Read
via "Security on TechRepublic".
Bryson Bort, founder and CEO of cybersecurity company SCYTHE, fears "death by a thousand paper cuts" more than than a digital apocalypse. He also shares his views on how well cyber-deterrence works.📖 Read
via "Security on TechRepublic".
TechRepublic
Security expert weighs in on cybersecurity regulation and ransomware attacks of US cities
Bryson Bort, founder and CEO of cybersecurity company SCYTHE, fears "death by a thousand paper cuts" more than than a digital apocalypse. He also shares his views on how well cyber-deterrence works.
❌ StrandHogg 2.0 Critical Bug Allows Android App Hijacking ❌
📖 Read
via "Threatpost".
a malicious app installed on a device can hide behind legitimate apps.📖 Read
via "Threatpost".
Threat Post
StrandHogg 2.0 Critical Bug Allows Android App Hijacking
a malicious app installed on a device can hide behind legitimate apps.
🕴 Turla Backdoor Adds Gmail Web Interface for Command-and-Control 🕴
📖 Read
via "Dark Reading: ".
The latest version of ComRAT is another sign of the threat actor's continued focus on targets in the government, military, and other sectors.📖 Read
via "Dark Reading: ".
Dark Reading
Turla Backdoor Adds Gmail Web Interface for Command-and-Control
The latest version of ComRAT is another sign of the threat actor's continued focus on targets in the government, military, and other sectors.
🕴 Americans Care About Security But Don't Follow Through 🕴
📖 Read
via "Dark Reading: ".
Most Americans say they're very concerned about online security but still behave in insecure ways, according to a new survey.📖 Read
via "Dark Reading: ".
Dark Reading
Americans Care About Security But Don't Follow Through
Most Americans say they're very concerned about online security but still behave in insecure ways, according to a new survey.
🕴 StrandHogg 2.0 Emerges as 'Evil Twin' to Android Threat 🕴
📖 Read
via "Dark Reading: ".
The vulnerability, which exists in almost every version of Android, is both more dangerous and harder to detect than its predecessor.📖 Read
via "Dark Reading: ".
Dark Reading
StrandHogg 2.0 Emerges as 'Evil Twin' to Android Threat
The vulnerability, which exists in almost every version of Android, is both more dangerous and harder to detect than its predecessor.
ATENTION‼ New - CVE-2020-13412 (controller)
📖 Read
via "National Vulnerability Database".
An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13398 (freerdp)
📖 Read
via "National Vulnerability Database".
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13397
📖 Read
via "National Vulnerability Database".
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13396
📖 Read
via "National Vulnerability Database".
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13394
📖 Read
via "National Vulnerability Database".
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetNetControlList list parameter for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13393
📖 Read
via "National Vulnerability Database".
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/saveParentControlInfo deviceId and time parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13392
📖 Read
via "National Vulnerability Database".
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13391
📖 Read
via "National Vulnerability Database".
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetSpeedWan speed_dir parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13390
📖 Read
via "National Vulnerability Database".
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/addressNat entrys and mitInterface parameters for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13389
📖 Read
via "National Vulnerability Database".
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/openSchedWifi schedStartTime and schedEndTime parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13388 (jw.util)
📖 Read
via "National Vulnerability Database".
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13384 (monstra)
📖 Read
via "National Vulnerability Database".
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-12397 (thunderbird)
📖 Read
via "National Vulnerability Database".
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-12396
📖 Read
via "National Vulnerability Database".
Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 76.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-12395
📖 Read
via "National Vulnerability Database".
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.📖 Read
via "National Vulnerability Database".