‼ CVE-2020-26236 ‼
📖 Read
via "National Vulnerability Database".
In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login.📖 Read
via "National Vulnerability Database".
🕴 How Industrial IoT Security Can Catch Up With OT/IT Convergence 🕴
📖 Read
via "Dark Reading".
Ransomware can easily make a connection between IT and OT already. How can blue teams do the same?📖 Read
via "Dark Reading".
Dark Reading
How Industrial IoT Security Can Catch Up With OT/IT Convergence
Ransomware can easily make a connection between IT and OT already. How can blue teams do the same?
🕴 Facebook Messenger Flaw Enabled Spying on Android Callees 🕴
📖 Read
via "Dark Reading".
A critical flaw in Facebook Messenger on Android would let someone start an audio or video call without the victim's knowledge.📖 Read
via "Dark Reading".
Dark Reading
Facebook Messenger Flaw Enabled Spying on Android Callees
A critical flaw in Facebook Messenger on Android would let someone start an audio or video call without the victim's knowledge.
🕴 Security Pros Push for More Pervasive Threat Modeling 🕴
📖 Read
via "Dark Reading".
With the release of the "Threat Modeling Manifesto," a group of 16 security professionals hope to prompt more companies to consider the threats to software.📖 Read
via "Dark Reading".
Dark Reading
Security Pros Push for More Pervasive Threat Modeling
With the release of the Threat Modeling Manifesto, a group of 16 security professionals hope to prompt more companies to consider the threats to software.
🦿 Study finds 31% of third-party vendors could cause significant damage to organizations if breached 🦿
📖 Read
via "Tech Republic".
Risk professionals relying on questionnaire-based assessments could be in for a rude awakening, according to Mastercard's RiskRecon and the Cyentia Institute.📖 Read
via "Tech Republic".
TechRepublic
Study finds 31% of third-party vendors could cause significant damage to organizations if breached
Risk professionals relying on questionnaire-based assessments could be in for a rude awakening, according to Mastercard's RiskRecon and the Cyentia Institute.
❌ VMware Fixes Critical Flaw in ESXi Hypervisor ❌
📖 Read
via "Threat Post".
The critical and important-severity flaws were found by a team at the China-based Tiunfu Cup hacking challenge.📖 Read
via "Threat Post".
Threat Post
VMware Fixes Critical Flaw in ESXi Hypervisor
The critical and important-severity flaws were found by a team at the China-based Tiunfu Cup hacking challenge.
❌ Good Heavens! 10M Impacted in Pray.com Data Exposure ❌
📖 Read
via "Threat Post".
The information exposed in a public cloud bucket included PII, church-donation information, photos and users' contact lists.📖 Read
via "Threat Post".
Threat Post
Good Heavens! 10M Impacted in Pray.com Data Exposure
The information exposed in a public cloud bucket included PII, church-donation information, photos and users' contact lists.
❌ Google Services Weaponized to Bypass Security in Phishing, BEC Campaigns ❌
📖 Read
via "Threat Post".
Attackers exploiting an array of Google Services, including Forms, Firebase, Docs and more to boost phishing and BEC campaigns.📖 Read
via "Threat Post".
Threat Post
Google Services Weaponized to Bypass Security in Phishing, BEC Campaigns
Attackers exploiting an array of Google Services, including Forms, Firebase, Docs and more to boost phishing and BEC campaigns.
‼ CVE-2020-4004 ‼
📖 Read
via "National Vulnerability Database".
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28845 ‼
📖 Read
via "National Vulnerability Database".
A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20739 ‼
📖 Read
via "National Vulnerability Database".
im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4005 ‼
📖 Read
via "National Vulnerability Database".
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004)📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20740 ‼
📖 Read
via "National Vulnerability Database".
PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().📖 Read
via "National Vulnerability Database".
‼ CVE-2020-5797 ‼
📖 Read
via "National Vulnerability Database".
UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25185 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitrary code on the IP150 (firmware versions 5.02.09).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25725 ‼
📖 Read
via "National Vulnerability Database".
In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font.📖 Read
via "National Vulnerability Database".
🕴 10 Undergraduate Security Degree Programs to Explore 🕴
📖 Read
via "Dark Reading".
Colleges and universities are ramping up cybersecurity education with a wider range of degree programs and more resources for students to build their infosec careers.📖 Read
via "Dark Reading".
Dark Reading
10 Undergraduate Security Degree Programs to Explore
Colleges and universities are ramping up cybersecurity education with a wider range of degree programs and more resources for students to build their infosec careers.
🕴 How Retailers Can Fight Fraud and Abuse This Holiday Season 🕴
📖 Read
via "Dark Reading".
Online shopping will be more popular than ever with consumers... and with malicious actors too.📖 Read
via "Dark Reading".
Dark Reading
How Retailers Can Fight Fraud and Abuse This Holiday Season
Online shopping will be more popular than ever with consumers... and with malicious actors too.
⚠ Facebook patches Messenger audio snooping bug – update now! ⚠
📖 Read
via "Naked Security".
Do you ever make, ahem, "pointed remarks" just before answering calls from people you would rather avoid?📖 Read
via "Naked Security".
Naked Security
Facebook patches Messenger audio snooping bug – update now!
Do you ever make, ahem, “pointed remarks” just before answering calls from people you would rather avoid?
⚠ Naked Security Live – Beat the Threat! ⚠
📖 Read
via "Naked Security".
Here's the latest Naked Security Live video - how to beat the crooks! Watch now...📖 Read
via "Naked Security".
Naked Security
Naked Security Live – Beat the Threat!
Here’s the latest Naked Security Live video – how to beat the crooks! Watch now…
🕴 3 Steps CISOs Can Take to Convey Strategy for Budget Presentations 🕴
📖 Read
via "Dark Reading".
Answering these questions will help CISOs define a plan and take the organization in a positive direction.📖 Read
via "Dark Reading".
Dark Reading
3 Steps CISOs Can Take to Convey Strategy for Budget Presentations
Answering these questions will help CISOs define a plan and take the organization in a positive direction.