‼ CVE-2020-26166 ‼
📖 Read
via "National Vulnerability Database".
The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.📖 Read
via "National Vulnerability Database".
❌ Video-Game Piracy Group ‘Team Xecuter’ Leaders in Custody ❌
📖 Read
via "Threat Post".
The two alleged leaders of Team Xecuter targeted popular consoles like the Nintendo Switch, the Sony PlayStation Classic and Microsoft Xbox.📖 Read
via "Threat Post".
Threat Post
Video-Game Piracy Group ‘Team Xecuter’ Leaders in Custody
The two alleged leaders of Team Xecuter targeted popular consoles like the Nintendo Switch, the Sony PlayStation Classic and Microsoft Xbox.
❌ Tenda Router Zero-Days Emerge in Spyware Botnet Campaign ❌
📖 Read
via "Threat Post".
A variant of the Mirai botnet, called Ttint, has added espionage capabilities to complement its denial-of-service functions.📖 Read
via "Threat Post".
Threat Post
Tenda Router Zero-Days Emerge in Spyware Botnet Campaign
A variant of the Mirai botnet, called Ttint, has added espionage capabilities to complement its denial-of-service functions.
‼ CVE-2020-25635 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8228 ‼
📖 Read
via "National Vulnerability Database".
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.📖 Read
via "National Vulnerability Database".
⚠ Naked Security Live – Stay on top of phishing scams ⚠
📖 Read
via "Naked Security".
Naked Security Live - here's the recorded version of our latest video. Enjoy.📖 Read
via "Naked Security".
Naked Security
Naked Security Live – Stay on top of phishing scams
Naked Security Live – here’s the recorded version of our latest video. Enjoy.
❌ Rare Bootkit Malware Targets North Korea-Linked Diplomats ❌
📖 Read
via "Threat Post".
The MosaicRegressor espionage framework is newly discovered and appears to be the work of Chinese-speaking actors.📖 Read
via "Threat Post".
Threat Post
Rare Bootkit Malware Targets North Korea-Linked Diplomats
The MosaicRegressor espionage framework is newly discovered and appears to be the work of Chinese-speaking actors.
🔏 Telework Tips to Help Organizations Grappling with WFH Life 🔏
📖 Read
via "Digital Guardian".
The Cybersecurity & Infrastructure Security Agency has released a collection of tips and best practices to help companies and employees better secure the new extended network perimeter.📖 Read
via "Digital Guardian".
Digital Guardian
Telework Tips to Help Organizations Grappling with WFH Life
The Cybersecurity & Infrastructure Security Agency has released a collection of tips and best practices to help companies and employees better secure the new extended network perimeter.
❌ Malware Families Turn to Legit Pastebin-Like Service ❌
📖 Read
via "Threat Post".
AgentTesla, LimeRAT, W3Cryptolocker and Redline Stealer are now using Paste.nrecom in spear-phishing attacks.📖 Read
via "Threat Post".
Threat Post
Malware Families Turn to Legit Pastebin-Like Service
AgentTesla, LimeRAT, W3Cryptolocker and Redline Stealer are now using Paste.nrecom in spear-phishing attacks.
🕴 'Virtual Cyber Carnival' Kicks off Cybersecurity Awareness Month 🕴
📖 Read
via "Dark Reading".
A new initiative will run throughout the month of October, invites the general public to play cybersecurity games (and win fabulous prizes).📖 Read
via "Dark Reading".
Dark Reading
'Virtual Cyber Carnival' Kicks off Cybersecurity Awareness Month
A new initiative will run throughout the month of October, invites the general public to play cybersecurity games (and win fabulous prizes).
‼ CVE-2020-24231 ‼
📖 Read
via "National Vulnerability Database".
Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on all interfaces. An attacker can interact with JMX: get system info, and invoke MBean methods. It is possible to install additional MBeans from a remote host using MLet that leads to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15235 ‼
📖 Read
via "National Vulnerability Database".
In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.📖 Read
via "National Vulnerability Database".
🦿 Top 5 things to know about Confidential Computing 🦿
📖 Read
via "Tech Republic".
The Confidential Computing Consortium, formed under The Linux Foundation, could revolutionize the way companies share data. Tom Merritt lists five things to know about Confidential Computing.📖 Read
via "Tech Republic".
TechRepublic
Top 5 things to know about Confidential Computing
The Confidential Computing Consortium, formed under The Linux Foundation, could revolutionize the way companies share data. Tom Merritt lists five things to know about Confidential Computing.
❌ Black-T Malware Emerges From Cryptojacker Group TeamTNT ❌
📖 Read
via "Threat Post".
Researchers have discovered the latest cryptojacking malware gambit from TeamTNT, called Black-T. The variant builds on the group’s typical approach, with a few new — and sophisticated — extras. TeamTNT is known for its targeting of Amazon Web Services (AWS) credentials, to break into the cloud and use it to mine for the Monero cryptocurrency. […]📖 Read
via "Threat Post".
Threat Post
Black-T Malware Emerges From Cryptojacker Group TeamTNT
The cryptojacking malware variant builds on the TeamTNT group’s typical approach, with a few new — and sophisticated — extras.
‼ CVE-2020-16226 ‼
📖 Read
via "National Vulnerability Database".
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15237 ‼
📖 Read
via "National Vulnerability Database".
In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.📖 Read
via "National Vulnerability Database".
❌ Post Grid WordPress Plugin Flaws Allow Site Takeovers ❌
📖 Read
via "Threat Post".
Team Showcase, a sister plugin, is also vulnerable to the XSS and PHP object-injection bugs -- together they have 66,000 installs.📖 Read
via "Threat Post".
Threat Post
Post Grid WordPress Plugin Flaws Allow Site Takeovers
Team Showcase, a sister plugin, is also vulnerable to the XSS and PHP object-injection bugs — together they have 66,000 installs.
🕴 Android Camera Bug Under the Microscope 🕴
📖 Read
via "Dark Reading".
Critical Android vulnerability CVE-2019-2234 could enable attackers to take control of a victim's camera and take photos, record videos, and learn location.📖 Read
via "Dark Reading".
Dark Reading
Android Camera Bug Under the Microscope
Critical Android vulnerability CVE-2019-2234 could enable attackers to take control of a victim's camera and take photos, record videos, and learn location.
🕴 Meet 'Egregor,' a New Ransomware Family to Watch 🕴
📖 Read
via "Dark Reading".
Egregor's operators promise to decrypt victims' files and provide security recommendations in exchange for ransom payment.📖 Read
via "Dark Reading".
Dark Reading
Meet 'Egregor,' a New Ransomware Family to Watch
Egregor's operators promise to decrypt victims' files and provide security recommendations in exchange for ransom payment.
🕴 John McAfee Indicted on Tax Charges 🕴
📖 Read
via "Dark Reading".
The indictment alleging tax evasion and failure to file returns was unsealed after his arrest in Spain.📖 Read
via "Dark Reading".
Dark Reading
John McAfee Indicted on Tax Charges
The indictment alleging tax evasion and failure to file returns was unsealed after his arrest in Spain.
‼ CVE-2020-26572 ‼
📖 Read
via "National Vulnerability Database".
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.📖 Read
via "National Vulnerability Database".