ATENTIONβΌ New - CVE-2020-12058
π Read
via "National Vulnerability Database".
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2019-10679
π Read
via "National Vulnerability Database".
Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissions.π Read
via "National Vulnerability Database".
β Vishing scams use Amazon and Prime as lures β donβt get caught! β
π Read
via "Naked Security".
How do you deal with scam calls on a phone number you keep for emergencies?π Read
via "Naked Security".
Naked Security
Vishing scams use Amazon and Prime as lures β donβt get caught!
How do you deal with scam calls on a phone number you keep for emergencies?
π How IoT sensors and analytics can make inside air safer for schools and offices π
π Read
via "Security on TechRepublic".
Advanced building controls can help keep air clean to reduce the risk of the spreading coronavirus indoors while sensors can send an alert if a room goes over capacity.π Read
via "Security on TechRepublic".
TechRepublic
How IoT sensors and analytics can make inside air safer for schools and offices
Advanced building controls can help keep air clean to reduce the risk of the spreading coronavirus indoors while sensors can send an alert if a room goes over capacity.
β Google Ups Product-Abuse Bug Bounties β
π Read
via "Threatpost".
The top award for flaws that allow cybercriminals to abuse legitimate services has increased by 166 percent.π Read
via "Threatpost".
Threat Post
Google Ups Product-Abuse Bug Bounties
The top award for flaws that allow cybercriminals to abuse legitimate services has increased by 166 percent.
β Attackers Can Exploit Critical Cisco Jabber Flaw With One Message β
π Read
via "Threatpost".
An attacker can execute remote code with no user interaction, thanks to CVE-2020-3495.π Read
via "Threatpost".
Threat Post
Attackers Can Exploit Critical Cisco Jabber Flaw With One Message
An attacker can execute remote code with no user interaction, thanks to CVE-2020-3495.
π΄ Fake Data and Fake Information: A Treasure Trove for Defenders π΄
π Read
via "Dark Reading: ".
Cybersecurity professionals are using false data to deceive cybercriminals, enabling them to protect networks in new and innovative ways.π Read
via "Dark Reading: ".
π΄ New Email-Based Malware Campaigns Target Businesses π΄
π Read
via "Dark Reading: ".
Researchers who found "Salfram" say its campaigns use the same crypter to distribute payloads, including ZLoader, SmokeLoader, and AveMaria.π Read
via "Dark Reading: ".
Dark Reading
New Email-Based Malware Campaigns Target Businesses
Researchers who found Salfram say its campaigns use the same crypter to distribute payloads, including ZLoader, SmokeLoader, and AveMaria.
π Dell's security chief leads a converged SOC with IT, OT, and product experts in one room π
π Read
via "Security on TechRepublic".
Gartner says more companies should put all risk managers, IT, and OT security experts on one team to to create one view of the threat landscape.π Read
via "Security on TechRepublic".
TechRepublic
Dell's security chief leads a converged SOC with IT, OT, and product experts in one room
Gartner says more companies should put all risk managers, IT, and OT security experts on one team to to create one view of the threat landscape.
π΄ Typosquatting Intensifies Ahead of US Election π΄
π Read
via "Dark Reading: ".
Mistyped URLs can mean more than inconvenience when a candidate's name is involved.π Read
via "Dark Reading: ".
Dark Reading
Typosquatting Intensifies Ahead of US Election
Mistyped URLs can mean more than inconvenience when a candidate's name is involved.
π The Top Tips for IP Protection for Manufacturing Firms π
π Read
via "Subscriber Blog RSS Feed ".
With industrial espionage on the rise, we asked 24 manufacturing experts the best ways to protect intellectual property at manufacturing firms.π Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
The Top Tips for IP Protection for Manufacturing Firms
With industrial espionage on the rise, we asked 24 manufacturing experts the best ways to protect intellectual property at manufacturing firms.
ATENTIONβΌ New - CVE-2020-11579
π Read
via "National Vulnerability Database".
An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2020-10720
π Read
via "National Vulnerability Database".
A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.π Read
via "National Vulnerability Database".
π΄ Evilnum APT Group Employs New Python RAT π΄
π Read
via "Dark Reading: ".
The PyVil remote access Trojan enables attackers to exfiltrate data, perform keylogging, take screenshots, and deploy tools for credential theft.π Read
via "Dark Reading: ".
Dark Reading
Evilnum APT Group Employs New Python RAT
The PyVil remote access Trojan enables attackers to exfiltrate data, perform keylogging, take screenshots, and deploy tools for credential theft.
π΄ Facebook Announces Formal Vulnerability Disclosure Policy for Third-Party Bugs π΄
π Read
via "Dark Reading: ".
The social media giant has also launched a new website for sharing information on WhatsApp security.π Read
via "Dark Reading: ".
Dark Reading
Facebook Announces Formal Vulnerability Disclosure Policy for Third-Party Bugs
The social media giant has also launched a new website for sharing information on WhatsApp security.
π How project managers can help companies better navigate security risks from COVID-19 π
π Read
via "Security on TechRepublic".
Social distancing and remote working during COVID-19 have increased cybersecurity risks for companies worldwide, increasing the need for project managers to work on more security-related efforts.π Read
via "Security on TechRepublic".
TechRepublic
How project managers can help companies better navigate security risks from COVID-19
Social distancing and remote working during COVID-19 have increased cybersecurity risks for companies worldwide, increasing the need for project managers to work on more security-related efforts.
ATENTIONβΌ New - CVE-2019-11928
π Read
via "National Vulnerability Database".
An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message.π Read
via "National Vulnerability Database".
π΄ The Hidden Costs of Losing Security Talent π΄
π Read
via "Dark Reading: ".
One person's exit can set off a chain of costly events.π Read
via "Dark Reading: ".
Dark Reading
The Hidden Costs of Losing Security Talent
One person's exit can set off a chain of costly events.
β India Blocks High-Profile Chinese Apps on Political, Privacy Concerns β
π Read
via "Threatpost".
Technology minister bans, Baidu, WeChat Work, AliPay and 115 others for capturing using data and transmitting it to servers outside of the country without authorization.π Read
via "Threatpost".
Threat Post
India Blocks High-Profile Chinese Apps on Political, Privacy Concerns
Technology minister bans, Baidu, WeChat Work, AliPay and 115 others for capturing using data and transmitting it to servers outside of the country without authorization.
ATENTIONβΌ New - CVE-2020-12248
π Read
via "National Vulnerability Database".
In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2020-12247
π Read
via "National Vulnerability Database".
In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur.π Read
via "National Vulnerability Database".