‼ CVE-2020-7159 ‼
📖 Read
via "National Vulnerability Database".
A customtemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).📖 Read
via "National Vulnerability Database".
🕴 Microsoft Tops Q3 List of Most-Impersonated Brands 🕴
📖 Read
via "Dark Reading".
The technology sector was also the most likely targeted industry for brand phishing attacks, according to Check Point's latest report on brand phishing.📖 Read
via "Dark Reading".
Darkreading
Microsoft Tops Q3 List of Most-Impersonated Brands
The technology sector was also the most likely targeted industry for brand phishing attacks, according to Check Point's latest report on brand phishing.
🕴 GravityRAT Spyware Targets Android & MacOS in India 🕴
📖 Read
via "Dark Reading".
The Trojan once used in attacks against Windows systems has been transformed into a multiplatform tool targeting macOS and Android.📖 Read
via "Dark Reading".
Dark Reading
GravityRAT Spyware Targets Android & MacOS in India
The Trojan once used in attacks against Windows systems has been transformed into a multiplatform tool targeting macOS and Android.
‼ CVE-2020-15262 ‼
📖 Read
via "National Vulnerability Database".
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-9263 ‼
📖 Read
via "National Vulnerability Database".
HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with common privilege, successful exploit could cause code execution.📖 Read
via "National Vulnerability Database".
🕴 Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns 🕴
📖 Read
via "Dark Reading".
US Department of Justice charges members of Sandworm/APT28 for BlackEnergy, NotPetya, Olympic Destroyer, and other major attacks.📖 Read
via "Dark Reading".
Dark Reading
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
US Department of Justice charges members of Sandworm/APT28 for BlackEnergy, NotPetya, Olympic Destroyer, and other major attacks.
🕴 NSS Labs Shuttered 🕴
📖 Read
via "Dark Reading".
The testing firm's website says it has 'ceased operations' as of Oct. 15.📖 Read
via "Dark Reading".
Dark Reading
NSS Labs Shuttered
The testing firm's website says it has ceased operations as of Oct. 15.
‼ CVE-2020-15261 ‼
📖 Read
via "National Vulnerability Database".
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15256 ‼
📖 Read
via "National Vulnerability Database".
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-5640 ‼
📖 Read
via "National Vulnerability Database".
Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.📖 Read
via "National Vulnerability Database".
❌ Google’s Waze Can Allow Hackers to Identify and Track Users ❌
📖 Read
via "Threat Post".
The company already patched an API flaw that allowed a security researcher to use the app to find the real identity of drivers using it.📖 Read
via "Threat Post".
Threat Post
Google’s Waze Can Allow Hackers to Identify and Track Users
The company already patched an API flaw that allowed a security researcher to use the app to find the real identity of drivers using it.
‼ CVE-2020-7748 ‼
📖 Read
via "National Vulnerability Database".
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.📖 Read
via "National Vulnerability Database".
❌ Mobile Browser Bugs Open Safari, Opera Users to Malware ❌
📖 Read
via "Threat Post".
A set of address-spoofing bugs affect users of six different types of mobile browsers, with some remaining unpatched.📖 Read
via "Threat Post".
Threat Post
Mobile Browser Bugs Open Safari, Opera Users to Malware
A set of address-spoofing bugs affect users of six different types of mobile browsers, with some remaining unpatched.
🕴 Trickbot Tenacity Shows Infrastructure Resistant to Takedowns 🕴
📖 Read
via "Dark Reading".
Both the US Cyber Command and a Microsoft-led private-industry group have attacked the infrastructure used by attackers to manage Trickbot -- but with only a short-term impact.📖 Read
via "Dark Reading".
Dark Reading
Vulnerabilities & Threats recent news | Dark Reading
Explore the latest news and expert commentary on Vulnerabilities & Threats, brought to you by the editors of Dark Reading
🦿 Homebrew: How to install reconnaissance tools on macOS 🦿
📖 Read
via "Tech Republic".
We'll guide you through the process of using Homebrew package manager to install security tools on macOS to perform reconnaissance, discovery, and fingerprinting of the devices on your network.📖 Read
via "Tech Republic".
TechRepublic
Homebrew: How to install reconnaissance tools on macOS
We'll guide you through the process of using Homebrew package manager to install security tools on macOS to perform reconnaissance, discovery, and fingerprinting of the devices on your network.
🕴 Building the Human Firewall 🕴
📖 Read
via "Dark Reading".
Cybersecurity was a challenge before COVID-19 sent millions of employees home to work from their own devices and networks. Now what?📖 Read
via "Dark Reading".
Dark Reading
Building the Human Firewall
Cybersecurity was a challenge before COVID-19 sent millions of employees home to work from their own devices and networks. Now what?
❌ Office 365 OAuth Attack Targets Coinbase Users ❌
📖 Read
via "Threat Post".
Attackers are targeting Microsoft Office 365 users with a Coinbase-themed attack, aiming to take control of their inboxes via OAuth.📖 Read
via "Threat Post".
Threat Post
Office 365 OAuth Attack Targets Coinbase Users
Attackers are targeting Microsoft Office 365 users with a Coinbase-themed attack, aiming to take control of their inboxes via OAuth.
🕴 Businesses Rethink Endpoint Security for 2021 🕴
📖 Read
via "Dark Reading".
The mass movement to remote work has forced organizations to rethink their long-term plans for endpoint security. How will things look different next year?📖 Read
via "Dark Reading".
Dark Reading
Businesses Rethink Endpoint Security for 2021
The mass movement to remote work has forced organizations to rethink their long-term plans for endpoint security. How will things look different next year?
❌ Pharma Giant Pfizer Leaks Customer Prescription Info, Call Transcripts ❌
📖 Read
via "Threat Post".
Hundreds of medical patients taking cancer drugs, Premarin, Lyrica and more are now vulnerable to phishing, malware and identity fraud.📖 Read
via "Threat Post".
Threat Post
Pharma Giant Pfizer Leaks Customer Prescription Info, Call Transcripts
Hundreds of medical patients taking cancer drugs, Premarin, Lyrica and more are now vulnerable to phishing, malware and identity fraud.
‼ CVE-2020-4748 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6367 ‼
📖 Read
via "National Vulnerability Database".
There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.📖 Read
via "National Vulnerability Database".