‼ CVE-2020-25781 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25816 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13336 ‼
📖 Read
via "National Vulnerability Database".
An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature.📖 Read
via "National Vulnerability Database".
🕴 The No Good, Very Bad Week for Iran's Nation-State Hacking Ops 🕴
📖 Read
via "Dark Reading".
A look at the state of Iran's cyber operations as the US puts the squeeze on it with a pile of indictments and sanctions.📖 Read
via "Dark Reading".
Dark Reading
The No Good, Very Bad Week for Iran's Nation-State Hacking Ops
A look at the state of Iran's cyber operations as the US puts the squeeze on it with a pile of indictments and sanctions.
‼ CVE-2019-20902 ‼
📖 Read
via "National Vulnerability Database".
Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-20903 ‼
📖 Read
via "National Vulnerability Database".
The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.📖 Read
via "National Vulnerability Database".
❌ InterPlanetary Storm Botnet Infects 13K Mac, Android Devices ❌
📖 Read
via "Threat Post".
In addition to Windows and Linux machines, a new variant of the malware now targets Mac and Android devices.📖 Read
via "Threat Post".
Threat Post
InterPlanetary Storm Botnet Infects 13K Mac, Android Devices
In addition to Windows and Linux machines, a new variant of the malware now targets Mac and Android devices.
⚠ #BeCyberSmart – why friends don’t let friends get scammed ⚠
📖 Read
via "Naked Security".
Friends don't let friends get scammed. Because cybercrime hurts us all.📖 Read
via "Naked Security".
Naked Security
#BeCyberSmart – why friends don’t let friends get scammed
Friends don’t let friends get scammed. Because cybercrime hurts us all.
🕴 COVID-19: Latest Security News & Commentary 🕴
📖 Read
via "Dark Reading".
Check out Dark Reading's updated, exclusive news and commentary surrounding the coronavirus pandemic.📖 Read
via "Dark Reading".
Dark Reading
COVID-19: Latest Security News & Commentary
Check out Dark Reading's updated, exclusive news and commentary surrounding the coronavirus pandemic.
🕴 Cryptojacking: The Unseen Threat 🕴
📖 Read
via "Dark Reading".
Mining malware ebbs and flows with the price of cryptocurrencies, and given the momentum on price is upward, cryptojacking is a very present threat.📖 Read
via "Dark Reading".
Dark Reading
Cryptojacking: The Unseen Threat
Mining malware ebbs and flows with the price of cryptocurrencies, and given the momentum on price is upward, cryptojacking is a very present threat.
🦿 Cisco Talos researchers explain psychology behind election disinformation posts on social media 🦿
📖 Read
via "Tech Republic".
With the 2020 presidential election looming, here are questions to consider before posting on social media.📖 Read
via "Tech Republic".
TechRepublic
Cisco Talos researchers explain psychology behind election disinformation posts on social media
With the 2020 presidential election looming, here are questions to consider before posting on social media.
‼ CVE-2020-8109 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior versions.📖 Read
via "National Vulnerability Database".
🛠 WhatWeb Scanner 0.5.3 🛠
📖 Read
via "Packet Storm Security".
WhatWeb is a next-generation web scanner. WhatWeb recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognize something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. WhatWeb supports an aggression level to control the trade off between speed and reliability.📖 Read
via "Packet Storm Security".
Packetstormsecurity
WhatWeb Scanner 0.5.3 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
👍1
❌ Spammers Smuggle LokiBot Via URL Obfuscation Tactic ❌
📖 Read
via "Threat Post".
Researchers say that the campaign sidesteps end user detection and security solutions.📖 Read
via "Threat Post".
Threat Post
Spammers Smuggle LokiBot Via URL Obfuscation Tactic
Researchers say that the campaign sidesteps end user detection and security solutions.
🕴 Russian National Sentenced to 7+ Years for Hacking US Tech Firms 🕴
📖 Read
via "Dark Reading".
Yevgeniy Nikulin received an 88-month sentence for breaking into LinkedIn, Dropbox, and the now-defunct social platform Formspring.📖 Read
via "Dark Reading".
Dark Reading
Russian National Sentenced to 7+ Years for Hacking US Tech Firms
Yevgeniy Nikulin received an 88-month sentence for breaking into LinkedIn, Dropbox, and the now-defunct social platform Formspring.
‼ CVE-2020-24860 ‼
📖 Read
via "National Vulnerability Database".
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.📖 Read
via "National Vulnerability Database".
🔏 What is Data Loss Prevention (DLP)? A Definition of Data Loss Prevention 🔏
📖 Read
via "Digital Guardian".
Learn more about data loss prevention software in Data Protection 101, our series covering the fundamentals of data security.📖 Read
via "Digital Guardian".
Digitalguardian
What is Data Loss Prevention (DLP)? Definition, Types & Tips
Data loss prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. Learn more about data loss prevention software in Data Protection 101, our series covering the fundamentals…
❌ NFL, NBA Players Hacked in Would-Be Cyber-Slam-Dunk ❌
📖 Read
via "Threat Post".
Federal prosecutors charged two men with crimes that carry up to 20 years in prison.📖 Read
via "Threat Post".
Threat Post
NFL, NBA Players Hacked in Would-Be Cyber-Slam-Dunk
Federal prosecutors charged two men with crimes that carry up to 20 years in prison.
🕴 'It Won't Happen to Me': Employee Apathy Prevails Despite Greater Cybersecurity Awareness 🕴
📖 Read
via "Dark Reading".
To protect your organization from all emerging file-borne threats, the security and leadership teams must align to develop a streamlined approach to file security.📖 Read
via "Dark Reading".
Dark Reading
'It Won't Happen to Me': Employee Apathy Prevails Despite Greater Cybersecurity Awareness
To protect your organization from all emerging file-borne threats, the security and leadership teams must align to develop a streamlined approach to file security.
❌ Microsoft Office 365 Phishing Attack Uses Multiple CAPTCHAs ❌
📖 Read
via "Threat Post".
Cybercriminals set up three different CAPTCHAs that Office 365 targets must click through before the final phishing page.📖 Read
via "Threat Post".
Threat Post
Microsoft Office 365 Phishing Attack Uses Multiple CAPTCHAs
Cybercriminals set up three different CAPTCHAs that Office 365 targets must click through before the final phishing page.
‼ CVE-2020-16844 ‼
📖 Read
via "National Vulnerability Database".
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.📖 Read
via "National Vulnerability Database".