🕴 Ransomware Operator Promotes Distributed Storage for Stolen Data 🕴
📖 Read
via "Dark Reading".
The criminals behind the DarkSide ransomware-as-a-service operation say the system will be harder to take down.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Operator Promotes Distributed Storage for Stolen Data
The criminals behind the DarkSide ransomware-as-a-service operation say the system will be harder to take down.
‼ CVE-2020-28687 ‼
📖 Read
via "National Vulnerability Database".
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7774 ‼
📖 Read
via "National Vulnerability Database".
This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25746 ‼
📖 Read
via "National Vulnerability Database".
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28647 ‼
📖 Read
via "National Vulnerability Database".
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7841 ‼
📖 Read
via "National Vulnerability Database".
Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto://📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28688 ‼
📖 Read
via "National Vulnerability Database".
The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.📖 Read
via "National Vulnerability Database".
❌ Cisco Patches Critical Flaw After PoC Exploit Code Release ❌
📖 Read
via "Threat Post".
A critical path-traversal flaw (CVE-2020-27130) exists in Cisco Security Manager that lays bare sensitive information to remote, unauthenticated attackers.📖 Read
via "Threat Post".
Threat Post
Cisco Patches Critical Flaw After PoC Exploit Code Release
A critical path-traversal flaw (CVE-2020-27130) exists in Cisco Security Manager that lays bare sensitive information to remote, unauthenticated attackers.
🕴 An Inside Look at an Account Takeover 🕴
📖 Read
via "Dark Reading".
AI threat find: Phishing attack slips through email gateway and leads to large-scale compromise.📖 Read
via "Dark Reading".
Dark Reading
An Inside Look at an Account Takeover
AI threat find: Phishing attack slips through email gateway and leads to large-scale compromise.
🛠 GNU Privacy Guard 2.2.24 🛠
📖 Read
via "Packet Storm Security".
GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.📖 Read
via "Packet Storm Security".
Packetstormsecurity
GNU Privacy Guard 2.2.24 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 Security Risks Discovered in Tesla Backup Gateway 🕴
📖 Read
via "Dark Reading".
Cybersecurity researchers report on the security and privacy risks of leaving a Tesla Backup Gateway exposed to the Internet.📖 Read
via "Dark Reading".
Dark Reading
Security Risks Discovered in Tesla Backup Gateway
Cybersecurity researchers report on the security and privacy risks of leaving a Tesla Backup Gateway exposed to the Internet.
‼ CVE-2020-27558 ‼
📖 Read
via "National Vulnerability Database".
Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27554 ‼
📖 Read
via "National Vulnerability Database".
Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensitive information transmitted between the mobile app and the camera device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27553 ‼
📖 Read
via "National Vulnerability Database".
A directory traversal vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to gain access to sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25798 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13958 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27555 ‼
📖 Read
via "National Vulnerability Database".
Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands as the root user.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27556 ‼
📖 Read
via "National Vulnerability Database".
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27557 ‼
📖 Read
via "National Vulnerability Database".
Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming username and password via SQLite files containing plain text credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21665 ‼
📖 Read
via "National Vulnerability Database".
In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection.📖 Read
via "National Vulnerability Database".
❌ Zoom Takes on Zoom-Bombers Following FTC Settlement ❌
📖 Read
via "Threat Post".
The videoconferencing giant has upped the ante on cybersecurity with three fresh disruption controls.📖 Read
via "Threat Post".
Threat Post
Zoom Takes on Zoom-Bombers Following FTC Settlement
The videoconferencing giant has upped the ante on cybersecurity with three fresh disruption controls.