‼ CVE-2020-15256 ‼
📖 Read
via "National Vulnerability Database".
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-5640 ‼
📖 Read
via "National Vulnerability Database".
Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.📖 Read
via "National Vulnerability Database".
❌ Google’s Waze Can Allow Hackers to Identify and Track Users ❌
📖 Read
via "Threat Post".
The company already patched an API flaw that allowed a security researcher to use the app to find the real identity of drivers using it.📖 Read
via "Threat Post".
Threat Post
Google’s Waze Can Allow Hackers to Identify and Track Users
The company already patched an API flaw that allowed a security researcher to use the app to find the real identity of drivers using it.
‼ CVE-2020-7748 ‼
📖 Read
via "National Vulnerability Database".
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.📖 Read
via "National Vulnerability Database".
❌ Mobile Browser Bugs Open Safari, Opera Users to Malware ❌
📖 Read
via "Threat Post".
A set of address-spoofing bugs affect users of six different types of mobile browsers, with some remaining unpatched.📖 Read
via "Threat Post".
Threat Post
Mobile Browser Bugs Open Safari, Opera Users to Malware
A set of address-spoofing bugs affect users of six different types of mobile browsers, with some remaining unpatched.
🕴 Trickbot Tenacity Shows Infrastructure Resistant to Takedowns 🕴
📖 Read
via "Dark Reading".
Both the US Cyber Command and a Microsoft-led private-industry group have attacked the infrastructure used by attackers to manage Trickbot -- but with only a short-term impact.📖 Read
via "Dark Reading".
Dark Reading
Vulnerabilities & Threats recent news | Dark Reading
Explore the latest news and expert commentary on Vulnerabilities & Threats, brought to you by the editors of Dark Reading
🦿 Homebrew: How to install reconnaissance tools on macOS 🦿
📖 Read
via "Tech Republic".
We'll guide you through the process of using Homebrew package manager to install security tools on macOS to perform reconnaissance, discovery, and fingerprinting of the devices on your network.📖 Read
via "Tech Republic".
TechRepublic
Homebrew: How to install reconnaissance tools on macOS
We'll guide you through the process of using Homebrew package manager to install security tools on macOS to perform reconnaissance, discovery, and fingerprinting of the devices on your network.
🕴 Building the Human Firewall 🕴
📖 Read
via "Dark Reading".
Cybersecurity was a challenge before COVID-19 sent millions of employees home to work from their own devices and networks. Now what?📖 Read
via "Dark Reading".
Dark Reading
Building the Human Firewall
Cybersecurity was a challenge before COVID-19 sent millions of employees home to work from their own devices and networks. Now what?
❌ Office 365 OAuth Attack Targets Coinbase Users ❌
📖 Read
via "Threat Post".
Attackers are targeting Microsoft Office 365 users with a Coinbase-themed attack, aiming to take control of their inboxes via OAuth.📖 Read
via "Threat Post".
Threat Post
Office 365 OAuth Attack Targets Coinbase Users
Attackers are targeting Microsoft Office 365 users with a Coinbase-themed attack, aiming to take control of their inboxes via OAuth.
🕴 Businesses Rethink Endpoint Security for 2021 🕴
📖 Read
via "Dark Reading".
The mass movement to remote work has forced organizations to rethink their long-term plans for endpoint security. How will things look different next year?📖 Read
via "Dark Reading".
Dark Reading
Businesses Rethink Endpoint Security for 2021
The mass movement to remote work has forced organizations to rethink their long-term plans for endpoint security. How will things look different next year?
❌ Pharma Giant Pfizer Leaks Customer Prescription Info, Call Transcripts ❌
📖 Read
via "Threat Post".
Hundreds of medical patients taking cancer drugs, Premarin, Lyrica and more are now vulnerable to phishing, malware and identity fraud.📖 Read
via "Threat Post".
Threat Post
Pharma Giant Pfizer Leaks Customer Prescription Info, Call Transcripts
Hundreds of medical patients taking cancer drugs, Premarin, Lyrica and more are now vulnerable to phishing, malware and identity fraud.
‼ CVE-2020-4748 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6367 ‼
📖 Read
via "National Vulnerability Database".
There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.📖 Read
via "National Vulnerability Database".
❌ Facebook: A Top Launching Pad For Phishing Attacks ❌
📖 Read
via "Threat Post".
Amazon, Apple, Netflix, Facebook and WhatsApp are top brands leveraged by cybercriminals in phishing and fraud attacks - including a recent strike on a half-million Facebook users.📖 Read
via "Threat Post".
Threat Post
Facebook: A Top Launching Pad For Phishing Attacks
Amazon, Apple, Netflix, Facebook and WhatsApp are top brands leveraged by cybercriminals in phishing and fraud attacks - including a recent strike on a half-million Facebook users.
🕴 Farsight Labs Launched as Security Collaboration Platform 🕴
📖 Read
via "Dark Reading".
Farsight Security's platform will offer no-cost access to certain tools and services.📖 Read
via "Dark Reading".
Dark Reading
Farsight Labs Launched as Security Collaboration Platform
Farsight Security's platform will offer no-cost access to certain tools and services.
⚠ Naked Security Live – Ping of Death: are you at risk? ⚠
📖 Read
via "Naked Security".
Here's the latest Naked Security Live video - enjoy (and please share with your friends)!📖 Read
via "Naked Security".
Naked Security
Naked Security Live – Ping of Death: are you at risk?
Here’s the latest Naked Security Live video – enjoy (and please share with your friends)!
⚠ Russian “government hackers” charged with cybercrimes by the US ⚠
📖 Read
via "Naked Security".
What can we learn from the US DOJ indictments against the "Sandworm Team"?📖 Read
via "Naked Security".
Naked Security
Russian “government hackers” charged with cybercrimes by the US
What can we learn from the US DOJ indictments against the “Sandworm Team”?
❌ Adobe Fixes 16 Critical Code-Execution Bugs Across Portfolio ❌
📖 Read
via "Threat Post".
The out-of-band patches follow a lighter-than-usual Patch Tuesday update earlier this month.📖 Read
via "Threat Post".
Threat Post
Adobe Fixes 16 Critical Code-Execution Bugs Across Portfolio
The out-of-band patches follow a lighter-than-usual Patch Tuesday update earlier this month.
‼ CVE-2020-3992 ‼
📖 Read
via "National Vulnerability Database".
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7370 ‼
📖 Read
via "National Vulnerability Database".
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions.📖 Read
via "National Vulnerability Database".