❌ Scammers Abuse Google Drive to Send Malicious Links ❌
📖 Read
via "Threat Post".
Cybercriminals are sending malicious links to hundreds of thousands of users via Google Drive notifications.📖 Read
via "Threat Post".
Threat Post
Scammers Abuse Google Drive to Send Malicious Links
Cybercriminals are sending malicious links to hundreds of thousands of users via Google Drive notifications.
❌ Texas Gold-Dealer Mined for Payment Details in Months-Long Data Breach ❌
📖 Read
via "Threat Post".
JM Bullion fell victim to a payment-card skimmer, which was in place for five months.📖 Read
via "Threat Post".
Threat Post
Texas Gold-Dealer Mined for Payment Details in Months-Long Data Breach
JM Bullion fell victim to a payment-card skimmer, which was in place for five months.
🛠 SQLMAP - Automatic SQL Injection Tool 1.4.11 🛠
📖 Read
via "Packet Storm Security".
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.📖 Read
via "Packet Storm Security".
Packetstormsecurity
SQLMAP - Automatic SQL Injection Tool 1.4.11 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 Samhain File Integrity Checker 4.4.3 🛠
📖 Read
via "Packet Storm Security".
Samhain is a file system integrity checker that can be used as a client/server application for centralized monitoring of networked hosts. Databases and configuration files can be stored on the server. Databases, logs, and config files can be signed for tamper resistance. In addition to forwarding reports to the log server via authenticated TCP/IP connections, several other logging facilities (e-mail, console, and syslog) are available. Tested on Linux, AIX, HP-UX, Unixware, Sun and Solaris.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Samhain File Integrity Checker 4.4.3 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🦿 It's an urgent plea this Election Eve: Don't click on ransomware disguised as political ads 🦿
📖 Read
via "Tech Republic".
Remote work and social media have made it easier for businesses to be impacted by security breaches. Here's why, and how organizations can protect themselves.📖 Read
via "Tech Republic".
TechRepublic
It's an urgent plea this Election Day: Don't click on ransomware disguised as political ads
Remote work and social media have made it easier for businesses to be impacted by security breaches. Here's why, and how organizations can protect themselves.
‼ CVE-2018-19951 ‼
📖 Read
via "National Vulnerability Database".
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-19955 ‼
📖 Read
via "National Vulnerability Database".
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.📖 Read
via "National Vulnerability Database".
❌ WordPress Pushes Out Multiple Flawed Security Updates ❌
📖 Read
via "Threat Post".
WordPress bungles critical security 5.5.2 fix and saves face next day with 5.5.3 update.📖 Read
via "Threat Post".
Threat Post
WordPress Pushes Out Multiple Flawed Security Updates
WordPress bungles critical security 5.5.2 fix and saves face next day with 5.5.3 update.
🔏 Digital Guardian Provides Customers Protection Following Spread of Ryuk Ransomware 🔏
📖 Read
via "Digital Guardian".
We’ve released a free policy pack to help customers, especially those in the healthcare and public health sector, protect against the latest Ryuk ransomware campaign.📖 Read
via "Digital Guardian".
Digital Guardian
Digital Guardian Provides Customers Protection Following Spread of Ryuk Ransomware
We’ve released a free policy pack to help customers, especially those in the healthcare and public health sector, protect against the latest Ryuk ransomware campaign.
🕴 Windows Zero-Day Used with Chrome Flaw in Targeted Attacks 🕴
📖 Read
via "Dark Reading".
Google's Project Zero has disclosed a Windows kernel zero-day vulnerability being used with a known Chrome bug in targeted attacks.📖 Read
via "Dark Reading".
Darkreading
Windows Zero-Day Used with Chrome Flaw in Targeted Attacks
Google's Project Zero has disclosed a Windows kernel zero-day vulnerability being used with a known Chrome bug in targeted attacks.
❌ Survey: Cybersecurity Skills Shortage is ‘Bad,’ But There’s Hope ❌
📖 Read
via "Threat Post".
Automation, strategic process design and an investment in training are the keys to managing the cybersecurity skills gap, according to a recent survey from Trustwave.📖 Read
via "Threat Post".
Threat Post
Survey: Cybersecurity Skills Shortage is ‘Bad,’ But There’s Hope
Automation, strategic process design and an investment in training are the keys to managing the cybersecurity skills gap, according to a recent survey from Trustwave.
❌ $100M Botnet Scheme Lands Cybercriminal 8 Years in Jail ❌
📖 Read
via "Threat Post".
Aleksandr Brovko faces jail time after stealing $100 million worth of personal identifiable information (PII) and financial data over the course of more than 10 years.📖 Read
via "Threat Post".
Threat Post
$100M Botnet Scheme Lands Cybercriminal 8 Years in Jail
Aleksandr Brovko faces jail time after stealing $100 million worth of personal identifiable information (PII) and financial data over the course of more than 10 years.
🕴 Russian National Sentenced to 8 Years in Prison for Role in Botnet Operation 🕴
📖 Read
via "Dark Reading".
Cybercrime scheme netted more than $100 million.📖 Read
via "Dark Reading".
Dark Reading
Russian National Sentenced to 8 Years in Prison for Role in Botnet Operation
Cybercrime scheme netted more than $100 million.
🦿 Hackers have only just wet their whistle. Expect more ransomware and data breaches in 2021. 🦿
📖 Read
via "Tech Republic".
The COVID-19 pandemic provided a huge opening for bad actors this year, thanks to remote work. Security experts expect more advanced cybersecurity threats in the coming year.📖 Read
via "Tech Republic".
TechRepublic
Hackers have only just wet their whistle. Expect more ransomware and data breaches in 2021.
The COVID-19 pandemic provided a huge opening for bad actors this year, thanks to remote work. Security experts expect more advanced cybersecurity threats in the coming year.
🕴 New Tools Make North Korea's Kimsuky Group More Dangerous 🕴
📖 Read
via "Dark Reading".
Threat actor actively targeting US organizations in global intelligence-gathering campaign, government says.📖 Read
via "Dark Reading".
Dark Reading
New Tools Make North Korea's Kimsuky Group More Dangerous
Threat actor actively targeting US organizations in global intelligence-gathering campaign, government says.
‼ CVE-2020-26939 ‼
📖 Read
via "National Vulnerability Database".
In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27982 ‼
📖 Read
via "National Vulnerability Database".
IceWarp 11.4.5.0 allows XSS via the language parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7758 ‼
📖 Read
via "National Vulnerability Database".
This affects all versions of package browserless-chrome. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-9368 ‼
📖 Read
via "National Vulnerability Database".
The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8183 ‼
📖 Read
via "National Vulnerability Database".
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-6014 ‼
📖 Read
via "National Vulnerability Database".
Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate.📖 Read
via "National Vulnerability Database".