‼ CVE-2020-27691 ‼
📖 Read
via "National Vulnerability Database".
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27692 ‼
📖 Read
via "National Vulnerability Database".
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings (responsible for managing devices remotely). This makes it possible to remotely reboot the device or upload malicious firmware.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-26207 ‼
📖 Read
via "National Vulnerability Database".
DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to arbitrary code execution if a user is tricked into opening a specially crafted `.dbschema` file. The patch was released in v2.7.4.3. As a workaround, ensure `.dbschema` files from untrusted sources are not opened.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27690 ‼
📖 Read
via "National Vulnerability Database".
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is sent to /boaform/admin/formDOMAINBLK with a large blkDomain value, the Boa server crashes.📖 Read
via "National Vulnerability Database".
🕴 Ransom Payment No Guarantee Against Doxxing 🕴
📖 Read
via "Dark Reading".
Several organizations that paid a ransom to keep attackers from releasing stolen data saw it leaked anyway, according to Coveware.📖 Read
via "Dark Reading".
Dark Reading
Ransom Payment No Guarantee Against Doxxing
Several organizations that paid a ransom to keep attackers from releasing stolen data saw it leaked anyway, according to Coveware.
‼ CVE-2020-25201 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27387 ‼
📖 Read
via "National Vulnerability Database".
An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.📖 Read
via "National Vulnerability Database".
❌ Malspam Campaign Milks Election Uncertainty ❌
📖 Read
via "Threat Post".
Emails try to lure victims with malicious documents claiming to have information about voting interference.📖 Read
via "Threat Post".
Threat Post
Malspam Campaign Milks Election Uncertainty
Emails try to lure victims with malicious documents claiming to have information about voting interference.
‼ CVE-2020-7761 ‼
📖 Read
via "National Vulnerability Database".
This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.📖 Read
via "National Vulnerability Database".
⚠ S3 Ep5: Chrome, Flash and malware for sale [Podcast] ⚠
📖 Read
via "Naked Security".
Here's the latest podcast - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep5: Chrome, Flash and malware for sale [Podcast]
Here’s the latest podcast – listen now!
🕴 The One Critical Element to Hardening Your Employees' Mobile Security 🕴
📖 Read
via "Dark Reading".
COVID-19 has exposed longstanding gaps in enterprise mobile security. Creating a comprehensive mobile security plan and mandating compliance with that plan are essential to closing them.📖 Read
via "Dark Reading".
Dark Reading
The One Critical Element to Hardening Your Employees' Mobile Security
COVID-19 has exposed longstanding gaps in enterprise mobile security. Creating a comprehensive mobile security plan and mandating compliance with that plan are essential to closing them.
❌ Cisco Zero-Day in AnyConnect Secure Mobility Client Remains Unpatched ❌
📖 Read
via "Threat Post".
Cisco also disclosed high-severity vulnerabilities in its Webex and SD-WAN products.📖 Read
via "Threat Post".
Threat Post
Cisco Zero-Day in AnyConnect Secure Mobility Client Remains Unpatched
Cisco also disclosed high-severity vulnerabilities in its Webex and SD-WAN products.
‼ CVE-2020-7763 ‼
📖 Read
via "National Vulnerability Database".
This affects the package phantom-html-to-pdf before 0.6.1.📖 Read
via "National Vulnerability Database".
🕴 Online Users Feel Safe, But Risky Behavior Abounds 🕴
📖 Read
via "Dark Reading".
New research also shows a divide between younger and older users in their security practices, including use of two-factor authentication and how often software updates are performed.📖 Read
via "Dark Reading".
Dark Reading
Online Users Feel Safe, But Risky Behavior Abounds
New research also shows a divide between younger and older users in their security practices, including use of two-factor authentication and how often software updates are performed.
🦿 Don't click on ransomware disguised as political ads 🦿
📖 Read
via "Tech Republic".
Remote work and social media have made it easier for businesses to be impacted by security breaches. Here's why, and how organizations can protect themselves.📖 Read
via "Tech Republic".
TechRepublic
It's an urgent plea this Election Day: Don't click on ransomware disguised as political ads
Remote work and social media have made it easier for businesses to be impacted by security breaches. Here's why, and how organizations can protect themselves.
‼ CVE-2020-27402 ‼
📖 Read
via "National Vulnerability Database".
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15949 ‼
📖 Read
via "National Vulnerability Database".
Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.📖 Read
via "National Vulnerability Database".
🕴 Cado Security Gets $1.5 Million Seed 🕴
📖 Read
via "Dark Reading".
The seed funding round was led by Ten Eleven Ventures.📖 Read
via "Dark Reading".
Dark Reading
Cado Security Gets $1.5 Million Seed
The seed funding round was led by Ten Eleven Ventures.
🦿 How to defend your organization against social engineering attacks 🦿
📖 Read
via "Tech Republic".
A security awareness program backed by multi-factor authentication can help protect your critical assets, says NordVPN Teams.📖 Read
via "Tech Republic".
TechRepublic
How to defend your organization against social engineering attacks
A security awareness program backed by multi-factor authentication can help protect your critical assets, says NordVPN Teams.
🕴 Digital Transformation Means Security Must Also Transform 🕴
📖 Read
via "Dark Reading".
Being successful in this moment requires the ability to evolve in terms of team management, visibility, and crisis management.📖 Read
via "Dark Reading".
Dark Reading
Digital Transformation Means Security Must Also Transform
Being successful in this moment requires the ability to evolve in terms of team management, visibility, and crisis management.
🦿 How to enable end-to-end encryption for the Nextcloud app 🦿
📖 Read
via "Tech Republic".
Learn how you can enable the new Nextcloud end-to-end encryption.📖 Read
via "Tech Republic".
TechRepublic
Nextcloud app: How to enable end-to-end encryption
Learn how you can enable the new Nextcloud end-to-end encryption.