🔐 Most consumers do not trust big tech with their privacy 🔐
📖 Read
via "Security on TechRepublic".
Social media and online shopping sites top the list of services consumers feel do not adequately protect their personal information.📖 Read
via "Security on TechRepublic".
TechRepublic
Most consumers do not trust big tech with their privacy
Social media and online shopping sites top the list of services consumers feel do not adequately protect their personal information.
🔐 It's not OK, Cupid: Security flaws could expose user data and more 🔐
📖 Read
via "Security on TechRepublic".
Researchers found a number of vulnerabilities that could give attackers access to a treasure trove of personally identifying information about members.📖 Read
via "Security on TechRepublic".
TechRepublic
It's not OK, Cupid: Security flaws could expose user data and more
Researchers found a number of vulnerabilities that could give attackers access to a treasure trove of personally identifying information about members.
⚠ US tax service says, “2FA is a must!” ⚠
📖 Read
via "Naked Security".
We know it's an old drum, but we're not tired of beating it yet: 2FA is your friend.📖 Read
via "Naked Security".
Naked Security
US tax service says, “2FA is a must!”
We know it’s an old drum, but we’re not tired of beating it yet: 2FA is your friend.
❌ Critical Security Flaw in WordPress Plugin Allows RCE ❌
📖 Read
via "Threatpost".
WordPress plugin Comments – wpDiscuz, which is installed on over 70,000 sites, has issued a patch.📖 Read
via "Threatpost".
Threat Post
Critical Security Flaw in WordPress Plugin Allows RCE
WordPress plugin Comments – wpDiscuz, which is installed on over 70,000 sites, has issued a patch.
❌ Critical Bugs in Utilities VPNs Could Cause Physical Damage ❌
📖 Read
via "Threatpost".
Gear from Secomea, Moxa and HMS Networks are affected by remote code-execution flaws, researchers warn.📖 Read
via "Threatpost".
Threat Post
Critical Bugs in Utilities VPNs Could Cause Physical Damage
Gear from Secomea, Moxa and HMS Networks are affected by remote code-execution flaws, researchers warn.
🕴 Technical Challenges of IoT Cybersecurity in a Post-COVID-19 World 🕴
📖 Read
via "Dark Reading: ".
Effective management of vulnerabilities can be done only when information about supply chain dependencies is accurate and recent.📖 Read
via "Dark Reading: ".
Dark Reading
Technical Challenges of IoT Cybersecurity in a Post-COVID-19 World
Effective management of vulnerabilities can be done only when information about supply chain dependencies is accurate and recent.
🛠 Sifter 9 🛠
📖 Go!
via "Security Tool Files ≈ Packet Storm".
Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.📖 Go!
via "Security Tool Files ≈ Packet Storm".
Packetstormsecurity
Sifter 9 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 Hydra Network Logon Cracker 9.1 🛠
📖 Go!
via "Security Tool Files ≈ Packet Storm".
THC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.📖 Go!
via "Security Tool Files ≈ Packet Storm".
Packetstormsecurity
Hydra Network Logon Cracker 9.1 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
ATENTION‼ New - CVE-2020-11934
📖 Read
via "National Vulnerability Database".
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-11933
📖 Read
via "National Vulnerability Database".
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.📖 Read
via "National Vulnerability Database".
🕴 Dark Reading Video News Desk Returns to Black Hat 🕴
📖 Read
via "Dark Reading: ".
Coming to you prerecorded from in front of carefully arranged bookcases around the world ...!📖 Read
via "Dark Reading: ".
Dark Reading
Dark Reading Video News Desk Returns to Black Hat
Coming to you prerecorded from in front of carefully arranged bookcases around the world ...!
🕴 70,000+ WordPress Sites Affected by Critical Plug-in Flaw 🕴
📖 Read
via "Dark Reading: ".
A vulnerability in the wpDiscuz plug-in could let attackers remotely execute code on the servers of affected websites.📖 Read
via "Dark Reading: ".
Dark Reading
70,000+ WordPress Sites Affected by Critical Plug-in Flaw
A vulnerability in the wpDiscuz plug-in could let attackers remotely execute code on the servers of affected websites.
🔏 NYDFS Charges First Company for Violating Its Cybersecurity Regulation 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
NYDFS made its first enforcement action around its Cybersecurity Regulation, 23 NYCRR 500, alleging errors and deficient controls led to a breach at an insurance company.📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
NYDFS Charges First Company for Violating Its Cybersecurity Regulation
NYDFS made its first enforcement action around its Cybersecurity Regulation, 23 NYCRR 500, alleging errors and deficient controls led to a breach at an insurance company.
❌ Billions of Devices Impacted by Secure Boot Bypass ❌
📖 Read
via "Threatpost".
The "BootHole" bug could allow cyberattackers to load malware, steal information and move laterally into corporate, OT ,IoT and home networks.📖 Read
via "Threatpost".
Threat Post
Billions of Devices Impacted by Secure Boot Bypass
The "BootHole" bug could allow cyberattackers to load malware, steal information and move laterally into corporate, OT, IoT and home networks.
ATENTION‼ New - CVE-2019-20033
📖 Read
via "National Vulnerability Database".
On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access the DIM interface.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20032
📖 Read
via "National Vulnerability Database".
An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20031
📖 Read
via "National Vulnerability Database".
NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20030
📖 Read
via "National Vulnerability Database".
An attacker with knowledge of the modem access number on a NEC UM8000 voicemail system may use SSH tunneling or standard Linux utilities to gain access to the system's LAN port. All versions are affected.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20029
📖 Read
via "National Vulnerability Database".
An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including an undocumented developer level of access.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20028
📖 Read
via "National Vulnerability Database".
Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's WebPro administration interface.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-20027
📖 Read
via "National Vulnerability Database".
Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account.📖 Read
via "National Vulnerability Database".