‼ CVE-2020-25827 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25812 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25814 ‼
📖 Read
via "National Vulnerability Database".
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked.📖 Read
via "National Vulnerability Database".
⚠ Naked Security Live – “SMS scams: keep yourself and your family safe!” ⚠
📖 Read
via "Naked Security".
Naked Security Live - here's the recorded version of our latest video. Enjoy.📖 Read
via "Naked Security".
Naked Security
Naked Security Live – “SMS scams: keep yourself and your family safe!”
Naked Security Live – here’s the recorded version of our latest video. Enjoy.
🕴 MFA-Minded Attackers Continue to Figure Out Workarounds 🕴
📖 Read
via "Dark Reading".
While MFA can improve overall security posture, it's not a "silver bullet" -- and hacks continue.📖 Read
via "Dark Reading".
Dark Reading
MFA-Minded Attackers Continue to Figure Out Workarounds
While MFA can improve overall security posture, it's not a silver bullet -- and hacks continue.
🕴 Safeguarding Schools Against RDP-Based Ransomware 🕴
📖 Read
via "Dark Reading".
How getting online learning right today will protect schools, and the communities they serve, for years to come.📖 Read
via "Dark Reading".
Dark Reading
Safeguarding Schools Against RDP-Based Ransomware
How getting online learning right today will protect schools, and the communities they serve, for years to come.
🕴 9 Tips to Prepare for the Future of Cloud & Network Security 🕴
📖 Read
via "Dark Reading".
Cloud and network security analysts outline trends and priorities businesses should keep top of mind as they grow more reliant on cloud.📖 Read
via "Dark Reading".
Dark Reading
9 Tips to Prepare for the Future of Cloud & Network Security
Cloud and network security analysts outline trends and priorities businesses should keep top of mind as they grow more reliant on cloud.
⚠ REvil ransomware crew dangles $1,000,000 cybercrime carrot ⚠
📖 Read
via "Naked Security".
When a company pays a multimillion dollar ransomware blackmail demand, where do you think the money goes?📖 Read
via "Naked Security".
Naked Security
REvil ransomware crew dangles $1,000,000 cybercrime carrot
When a company pays a multimillion dollar ransomware blackmail demand, where do you think the money goes?
❌ Joker Trojans Flood the Android Ecosystem ❌
📖 Read
via "Threat Post".
September saw dozens of Joker malware variants hitting Google Play and third-party app stores.📖 Read
via "Threat Post".
Threat Post
Joker Trojans Flood the Android Ecosystem
September saw dozens of Joker malware variants hitting Google Play and third-party app stores.
🛠 Sifter 10_r2 🛠
📖 Read
via "Packet Storm Security".
Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Sifter 10_r2 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🦿 How to install common security tools via Homebrew on a Mac 🦿
📖 Read
via "Tech Republic".
We'll guide you through the process of using Homebrew package manager to install common security tools on macOS computers to assess and aid in hardening devices on your network.📖 Read
via "Tech Republic".
TechRepublic
How to install common security tools via Homebrew on a Mac
We'll guide you through the process of using Homebrew package manager to install common security tools on macOS computers to assess and aid in hardening devices on your network.
❌ Universal Health Services Ransomware Attack Impacts Hospitals Nationwide ❌
📖 Read
via "Threat Post".
The Ryuk ransomware is suspected to be the culprit.📖 Read
via "Threat Post".
Threat Post
Universal Health Services Ransomware Attack Impacts Hospitals Nationwide
The Ryuk ransomware is suspected to be the culprit.
🔏 Ransomware Reportedly Behind Nationwide UHS Hospital Outage 🔏
📖 Read
via "Digital Guardian".
The full scope of the incident isn't yet known but as a result, many facilities have been left without access to computer systems.📖 Read
via "Digital Guardian".
Digital Guardian
Ransomware Reportedly Behind Nationwide UHS Hospital Outage
The full scope of the incident isn't yet known but as a result, many facilities have been left without access to computer systems.
❌ Mac, Linux Users Now Targeted by FinSpy Variants ❌
📖 Read
via "Threat Post".
FinSpy has returned in new campaigns targeting dissident organizations in Egypt - and researchers uncovered new samples of the spyware targeting macOS and Linux users.📖 Read
via "Threat Post".
Threat Post
Mac, Linux Users Now Targeted by FinSpy Variants
FinSpy has returned in new campaigns targeting dissident organizations in Egypt – and researchers uncovered new samples of the spyware targeting macOS and Linux users.
❌ Windows 7 ‘Upgrade’ Emails Steal Outlook Credentials ❌
📖 Read
via "Threat Post".
Researchers warn of emails pretending to help business employees upgrade to Windows 10 - and then stealing their Outlook emails and passwords.📖 Read
via "Threat Post".
Threat Post
Windows 7 ‘Upgrade’ Emails Steal Outlook Credentials
Researchers warn of emails pretending to help business employees upgrade to Windows 10 - and then stealing their Outlook emails and passwords.
🦿 How companies can meet the needs of the future workforce 🦿
📖 Read
via "Tech Republic".
The workforce is changing in the wake of a global pandemic. Learn some insights from industry executives about what companies and employees should be doing to evolve accordingly.📖 Read
via "Tech Republic".
TechRepublic
How companies can meet the needs of the future workforce
The workforce is changing in the wake of a global pandemic. Learn some insights from industry executives about what companies and employees should be doing to evolve accordingly.
🕴 Ivanti Acquires Two Security Companies 🕴
📖 Read
via "Dark Reading".
Purchase of MobilIron and Pulse Secure announced simultaneously.📖 Read
via "Dark Reading".
Dark Reading
Ivanti Acquires Two Security Companies
Purchase of MobilIron and Pulse Secure announced simultaneously.
‼ CVE-2020-25770 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24565 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770.📖 Read
via "National Vulnerability Database".
❌ Telehealth Poll: How Risky Are Remote Doctor Visits? ❌
📖 Read
via "Threat Post".
Threatpost's latest poll probes telehealth security risks and asks for IT cures.📖 Read
via "Threat Post".
Threat Post
Telehealth Poll: How Risky Are Remote Doctor Visits?
Threatpost's latest poll probes telehealth security risks and asks for IT cures.
🕴 The Shared Irresponsibility Model in the Cloud Is Putting You at Risk 🕴
📖 Read
via "Dark Reading".
Step up, put the architecture and organization in place, and take responsibility. If you don't, who will?📖 Read
via "Dark Reading".
Dark Reading
The Shared Irresponsibility Model in the Cloud Is Putting You at Risk
Step up, put the architecture and organization in place, and take responsibility. If you don't, who will?