‼ CVE-2020-13799 ‼
📖 Read
via "National Vulnerability Database".
Western Digital iNAND devices through 2020-06-03 allow Authentication Bypass via a capture-replay attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25454 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-5947 ‼
📖 Read
via "National Vulnerability Database".
In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. Only these platforms are affected: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8279 ‼
📖 Read
via "National Vulnerability Database".
Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15710 ‼
📖 Read
via "National Vulnerability Database".
Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8278 ‼
📖 Read
via "National Vulnerability Database".
Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-20933 ‼
📖 Read
via "National Vulnerability Database".
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8277 ‼
📖 Read
via "National Vulnerability Database".
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.📖 Read
via "National Vulnerability Database".
🦿 Microsoft gives Linux a security boost with these new attack detection tools 🦿
📖 Read
via "Tech Republic".
Linux endpoint detection and response will help Microsoft Defender customers secure Linux servers and networks against security nasties.📖 Read
via "Tech Republic".
❌ Cybercriminals Batter Automakers With Ransomware, IP Theft Cyberattacks ❌
📖 Read
via "Threat Post".
While the industry focus is on vehicle hacking, when it comes to the automotive industry cybercriminals are opting for less complex and sophisticated attacks - from phishing to ransomware.📖 Read
via "Threat Post".
Threat Post
Cybercriminals Batter Automakers With Ransomware, IP Theft Cyberattacks
While the industry focus is on vehicle hacking, when it comes to the automotive industry cybercriminals are opting for less complex and sophisticated attacks - from phishing to ransomware.
🕴 Unpatched Browsers Abound, Study Shows 🕴
📖 Read
via "Dark Reading".
Google Chrome users don't always take time to relaunch browser updates, and some legacy applications don't support new versions of Chrome, Menlo Security says.📖 Read
via "Dark Reading".
Dark Reading
Unpatched Browsers Abound, Study Shows
Google Chrome users don't always take time to relaunch browser updates, and some legacy applications don't support new versions of Chrome, Menlo Security says.
❌ APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies ❌
📖 Read
via "Threat Post".
Threat actors mount year-long campaign of espionage, exfiltrating data, stealing credentials and installing backdoors on victims’ networks.📖 Read
via "Threat Post".
Threat Post
APT Exploits Microsoft Zerologon Bug: Targets Japanese Companies
Threat actors mount year-long campaign of espionage, exfiltrating data, stealing credentials and installing backdoors on victims’ networks.
🕴 2021 Cybersecurity Spending: How to Maximize Value 🕴
📖 Read
via "Dark Reading".
This is a pivotal moment for CISOs. As their influence increases, so does the pressure for them to make the right decisions.📖 Read
via "Dark Reading".
Dark Reading
2021 Cybersecurity Spending: How to Maximize Value
This is a pivotal moment for CISOs. As their influence increases, so does the pressure for them to make the right decisions.
🦿 Consumers share their top frustrations about online retail purchasing 🦿
📖 Read
via "Tech Republic".
People say they've abandoned purchases at online retail stores because of the hassle of dealing with passwords, according to the FIDO Alliance.📖 Read
via "Tech Republic".
TechRepublic
Consumers share their top frustrations about online retail purchasing
People say they've abandoned purchases at online retail stores because of the hassle of dealing with passwords, according to the FIDO Alliance.
🛠 TestSSL 3.0.3 🛠
📖 Read
via "Packet Storm Security".
testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws, and much more. It is written in (pure) bash, makes only use of standard Unix utilities, openssl and last but not least bash sockets.📖 Read
via "Packet Storm Security".
Packetstormsecurity
TestSSL 3.0.3 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 TCMalloc Inspector Tool 🛠
📖 Read
via "Packet Storm Security".
TCMalloc is an inspection tool that lets you parse and inspect tcmalloc internals, and detect lost memory, meaning memory which is not reachable via any (internal) pointers.📖 Read
via "Packet Storm Security".
Packetstormsecurity
TCMalloc Inspector Tool ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 New Proposed DNS Security Features Released 🕴
📖 Read
via "Dark Reading".
Verisign's R&D team has developed new ways to authenticate and optimize DNS traffic on the client side of the domain-name resolution process.📖 Read
via "Dark Reading".
Dark Reading
New Proposed DNS Security Features Released
Verisign's R&D team has developed new ways to authenticate and optimize DNS traffic on the client side of the domain-name resolution process.
❌ IoT Cybersecurity Improvement Act Passed, Heads to President’s Desk ❌
📖 Read
via "Threat Post".
Security experts praised the newly approved IoT law as a step in the right direction for insecure connected federal devices.📖 Read
via "Threat Post".
Threat Post
IoT Cybersecurity Improvement Act Passed, Heads to President’s Desk
Security experts praised the newly approved IoT law as a step in the right direction for insecure connected federal devices.
❌ Food-Supply Giant Americold Admits Cyberattack ❌
📖 Read
via "Threat Post".
A reported ransomware attack took down operations at the company, which in talks for COVID-19 vaccine-distribution contracts.📖 Read
via "Threat Post".
Threat Post
Food-Supply Giant Americold Admits Cyberattack
A reported ransomware attack took down operations at the company, which in talks for COVID-19 vaccine-distribution contracts.
‼ CVE-2020-11830 ‼
📖 Read
via "National Vulnerability Database".
QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-11831 ‼
📖 Read
via "National Vulnerability Database".
OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.📖 Read
via "National Vulnerability Database".