❌ Cybersecurity Skills Gap Worsens, Fueled by Lack of Career Development ❌
📖 Read
via "Threatpost".
The fundamental causes for the skill gap are myriad, starting with a lack of training and career-development opportunities.📖 Read
via "Threatpost".
Threat Post
Cybersecurity Skills Gap Worsens, Fueled by Lack of Career Development
The fundamental causes for the skill gap are myriad, starting with a lack of training and career-development opportunities.
ATENTION‼ New - CVE-2020-14324
📖 Read
via "National Vulnerability Database".
A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-14313
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-14296
📖 Read
via "National Vulnerability Database".
Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-10780
📖 Read
via "National Vulnerability Database".
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.📖 Read
via "National Vulnerability Database".
⚠ Facial recognition – another setback for law enforcement ⚠
📖 Read
via "Naked Security".
"Something needs to be done," said the court. Where do you stand? For or against, have your say in our comments.📖 Read
via "Naked Security".
Naked Security
Facial recognition – another setback for law enforcement
“Something needs to be done,” said the court. Where do you stand? For or against, have your say in our comments.
❌ Critical Adobe Acrobat and Reader Bugs Allow RCE ❌
📖 Read
via "Threatpost".
Adobe patched critical and important-severity flaws tied to 26 CVEs in Acrobat and Reader.📖 Read
via "Threatpost".
Threat Post
Critical Adobe Acrobat and Reader Bugs Allow RCE
Adobe patched critical and important-severity flaws tied to 26 CVEs in Acrobat and Reader.
🕴 EU-US Privacy Shield Dissolution: What Happens Next? 🕴
📖 Read
via "Dark Reading: ".
In a world that isn't private by design, security and liability implications for US-based cloud companies are huge.📖 Read
via "Dark Reading: ".
Dark Reading
EU-US Privacy Shield Dissolution: What Happens Next?
In a world that isn't private by design, security and liability implications for US-based cloud companies are huge.
🕴 Is Edtech the Greatest APT? 🕴
📖 Read
via "Dark Reading: ".
Educational technology is critical but can come at huge costs to student and teacher privacy and security. Are those costs too high?📖 Read
via "Dark Reading: ".
Dark Reading
Is Edtech the Greatest APT?
Educational technology is critical but can come at huge costs to student and teacher privacy and security. Are those costs too high?
ATENTION‼ New - CVE-2020-13124
📖 Read
via "National Vulnerability Database".
SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-11552
📖 Read
via "National Vulnerability Database".
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.📖 Read
via "National Vulnerability Database".
❌ Critical Intel Flaw Afflicts Several Motherboards, Server Systems, Compute Modules ❌
📖 Read
via "Threatpost".
A critical privilege-escalation flaw affects several popular Intel motherboards, server systems and compute modules.📖 Read
via "Threatpost".
Threat Post
Critical Intel Flaw Afflicts Several Motherboards, Server Systems, Compute Modules
A critical privilege-escalation flaw affects several popular Intel motherboards, server systems and compute modules.
🕴 Zoom Vulnerabilities Demonstrated in DEF CON Talk 🕴
📖 Read
via "Dark Reading: ".
A security researcher demonstrated multiple vulnerabilities, two of which could let an attacker read and steal user data.📖 Read
via "Dark Reading: ".
Dark Reading
Zoom Vulnerabilities Demonstrated in DEF CON Talk
A security researcher demonstrated multiple vulnerabilities, two of which could let an attacker read and steal user data.
🕴 Symmetry Systems Emerges from Stealth 🕴
📖 Read
via "Dark Reading: ".
Company behind Data Store and Object Security (DSOS) becomes public knowledge following a $3 million seed round of funding.📖 Read
via "Dark Reading: ".
Dark Reading
Symmetry Systems Emerges from Stealth
Company behind Data Store and Object Security (DSOS) becomes public knowledge following a $3 million seed round of funding.
🔏 Iranian Hackers Targeting Networking Devices 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
The FBI warned organizations last week that an Iranian hacking group has been targeting vulnerable networking devices for a month.📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
Iranian Hackers Targeting Networking Devices
The FBI warned organizations last week that an Iranian hacking group has been targeting vulnerable networking devices for a month.
ATENTION‼ New - CVE-2020-13179
📖 Read
via "National Vulnerability Database".
Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in server memory, which may allow an attacker to read confidential information from a memory dump via forcing a crashing during the single sign-on procedure.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13178
📖 Read
via "National Vulnerability Database".
A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly validate the signature of an external binary, which could allow an attacker to gain elevated privileges via execution in the context of the PCoIP Agent process.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13177
📖 Read
via "National Vulnerability Database".
The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded paths for certain Windows binaries, which allows an attacker to gain elevated privileges via execution of a malicious binary placed in the system path.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13176
📖 Read
via "National Vulnerability Database".
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13175
📖 Read
via "National Vulnerability Database".
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2020-13174
📖 Read
via "National Vulnerability Database".
The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking.📖 Read
via "National Vulnerability Database".