ATENTION‼ New - CVE-2019-15974
📖 Read
via "National Vulnerability Database".
A vulnerability in the web interface of Cisco Managed Services Accelerator (MSX) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious web page. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15969
📖 Read
via "National Vulnerability Database".
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script or HTML code in the context of the interface, which could allow the attacker to gain access to sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15963
📖 Read
via "National Vulnerability Database".
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the web-based management interface of the affected software. The vulnerability is due to insufficient protection of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by accessing the interface and viewing restricted portions of the software configuration. A successful exploit could allow the attacker to gain access to sensitive information or conduct further attacks.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15959
📖 Read
via "National Vulnerability Database".
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15957
📖 Read
via "National Vulnerability Database".
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system. When processed, the commands will be executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by providing malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as the root user.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15289
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the video service of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted traffic to the video service of an affected endpoint. A successful exploit could allow the attacker to cause the video service to crash, resulting in a DoS condition on an affected device.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15287
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15285
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2019-15283
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.📖 Read
via "National Vulnerability Database".
🕴 12 Bare-Minimum Benchmarks for AppSec Initiatives 🕴
📖 Read
via "Dark Reading: ".
The newly published Building Security in Maturity Model provides the software security basics organizations should cover to keep up with their peers.📖 Read
via "Dark Reading: ".
Dark Reading
12 Bare-Minimum Benchmarks for AppSec Initiatives
The newly published Building Security in Maturity Model provides the software security basics organizations should cover to keep up with their peers.
🕴 7 Non-Technical Skills Threat Analysts Should Master to Keep Their Jobs 🕴
📖 Read
via "Dark Reading: ".
It's not just technical expertise and certifications that enable analysts to build long-term careers in cybersecurity.📖 Read
via "Dark Reading: ".
Dark Reading
7 Non-Technical Skills Threat Analysts Should Master to Keep Their Jobs
It's not just technical expertise and certifications that enable analysts to build long-term careers in cybersecurity.
🔐 Experts discuss ways IT can maximize budget amid COVID-19 shrinkage 🔐
📖 Read
via "Security on TechRepublic".
With revenue down, CIOs are rearranging their technology spending to prioritize return to office needs and security, executives say.📖 Read
via "Security on TechRepublic".
TechRepublic
Experts discuss ways IT can maximize budget amid COVID-19 shrinkage
With revenue down, CIOs are rearranging their technology spending to prioritize return to office needs and security, executives say.
🔐 FBI warns of cybercriminals spreading false info about 2020 election results 🔐
📖 Read
via "Security on TechRepublic".
Bad actors could create or change websites and social media content to discredit this year's electoral process, cautions the FBI and CISA.📖 Read
via "Security on TechRepublic".
TechRepublic
FBI warns of cybercriminals spreading false info about 2020 election results
Bad actors could create or change websites and social media content to discredit this year's electoral process, cautions the FBI and CISA.
🔐 How rogue TikTok accounts are promoting malicious mobile apps 🔐
📖 Read
via "Security on TechRepublic".
The accounts are pushing games, wallpaper, and other apps designed to deploy adware scams toward iOS and Android users, says Avast.📖 Read
via "Security on TechRepublic".
TechRepublic
How rogue TikTok accounts are promoting malicious mobile apps
The accounts are pushing games, wallpaper, and other apps designed to deploy adware scams toward iOS and Android users, says Avast.
❌ OldGremlin Ransomware Group Bedevils Russian Orgs ❌
📖 Read
via "Threatpost".
The cybercriminal group has plagued firms with ransomware, sent via spear phishing emails with COVID-19 lures, since March.📖 Read
via "Threatpost".
Threat Post
OldGremlin Ransomware Group Bedevils Russian Orgs
The cybercriminal group has plagued firms with ransomware, sent via spear phishing emails with COVID-19 lures, since March.
🕴 FBI, DHS Warn of 'Likely' Disinformation Campaigns About Election Results 🕴
📖 Read
via "Dark Reading: ".
Nation-state actors and cybercriminals could wage cyberattacks and spread false information about the integrity of the election results while officials certify the final vote counts.📖 Read
via "Dark Reading: ".
Dark Reading
FBI, DHS Warn of 'Likely' Disinformation Campaigns About Election Results
Nation-state actors and cybercriminals could wage cyberattacks and spread false information about the integrity of the election results while officials certify the final vote counts.
❌ CISA: LokiBot Stealer Storms Into a Resurgence ❌
📖 Read
via "Threatpost".
The trojan has seen a big spike in activity since August, the Feds are warning.📖 Read
via "Threatpost".
Threat Post
CISA: LokiBot Stealer Storms Into a Resurgence
The trojan has seen a big spike in activity since August, the Feds are warning.
❌ Critical Industrial Flaws Pose Patching Headache For Manufacturers ❌
📖 Read
via "Threatpost".
When it comes to patching critical flaws, industrial firms face various challenges - with some needing to shut down entire factories in order to apply updates.📖 Read
via "Threatpost".
Threat Post
Critical Industrial Flaws Pose Patching Headache For Manufacturers
When it comes to patching critical flaws, industrial firms face various challenges - with some needing to shut down entire factories in order to apply updates.
🔐 How to combat cyber threats amid the shift to remote working 🔐
📖 Read
via "Security on TechRepublic".
Some 85% of CISOs surveyed by Netwrix revealed that they sacrificed cybersecurity to quickly set up employees to work remotely.📖 Read
via "Security on TechRepublic".
TechRepublic
How to combat cyber threats amid the shift to remote working
Some 85% of CISOs surveyed by Netwrix revealed that they sacrificed cybersecurity to quickly set up employees to work remotely.
🕴 Making the Case for Medical Device Cybersecurity 🕴
📖 Read
via "Dark Reading: ".
With an increasing number of Internet-connected medical devices in use to manage diabetes, protection against a variety of wireless network attacks could very well be a matter of life and death for patients.📖 Read
via "Dark Reading: ".
Dark Reading
Making the Case for Medical Device Cybersecurity
With an increasing number of Internet-connected medical devices in use to manage diabetes, protecting against a variety of wireless network attacks could very well be a matter of life and death.
🕴 My Journey Toward SAP Security 🕴
📖 Read
via "Dark Reading: ".
When applications are critical to the business's core functions, the CISO and their staff better get the security right.📖 Read
via "Dark Reading: ".
Dark Reading
My Journey Toward SAP Security
When applications are critical to the business's core functions, the CISO and their staff better get the security right.