‼ CVE-2020-17470 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks.📖 Read
via "National Vulnerability Database".
⚠ Subway sandwich scam mystifies loyalty card users ⚠
📖 Read
via "Naked Security".
Subway customers have been on the receiving end of a curiously complex phishing scam.📖 Read
via "Naked Security".
Naked Security
Subway sandwich scam mystifies loyalty card users
Subway customers have been on the receiving end of a curiously complex phishing scam. We investigate.
‼ CVE-2020-35199 ‼
📖 Read
via "National Vulnerability Database".
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35200 ‼
📖 Read
via "National Vulnerability Database".
Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35202 ‼
📖 Read
via "National Vulnerability Database".
Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35201 ‼
📖 Read
via "National Vulnerability Database".
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17511 ‼
📖 Read
via "National Vulnerability Database".
In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17513 ‼
📖 Read
via "National Vulnerability Database".
In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.📖 Read
via "National Vulnerability Database".
🦿 Cybersecurity experts hail new IoT law 🦿
📖 Read
via "Tech Republic".
The bill would increase protection for the billions of connected devices "owned or controlled by the government" in homes and businesses.📖 Read
via "Tech Republic".
TechRepublic
Cybersecurity experts hail new IoT law
The bill would increase protection for the billions of connected devices "owned or controlled by the government" in homes and businesses.
🕴 Startups Should Do Things That Don't Scale, but Security Isn't One of Them 🕴
📖 Read
via "Dark Reading".
Emerging businesses that don't embrace scalable security do so at their own peril.📖 Read
via "Dark Reading".
Dark Reading
Startups Should Do Things That Don't Scale, but Security Isn't One of Them
Emerging businesses that don't embrace scalable security do so at their own peril.
‼ CVE-2020-29227 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, to cause local file inclusion resulting in code execution.📖 Read
via "National Vulnerability Database".
🛠 Sifter 11-R3 🛠
📖 Read
via "Packet Storm Security".
Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Sifter 11-R3 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🛠 WhatWeb Scanner 0.5.4 🛠
📖 Read
via "Packet Storm Security".
WhatWeb is a next-generation web scanner. WhatWeb recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognize something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. WhatWeb supports an aggression level to control the trade off between speed and reliability.📖 Read
via "Packet Storm Security".
Packetstormsecurity
WhatWeb Scanner 0.5.4 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ New Windows Trojan Steals Browser Credentials, Outlook Files ❌
📖 Read
via "Threat Post".
The newly discovered Python-based malware family targets the Outlook processes, and browser credentials, of Microsoft Windows victims.📖 Read
via "Threat Post".
Threat Post
New Windows Trojan Steals Browser Credentials, Outlook Files
The newly discovered Python-based malware family targets the Outlook processes, and browser credentials, of Microsoft Windows victims.
🦿 US government agencies compromised by foreign nation-state 🦿
📖 Read
via "Tech Republic".
Stretching back for months, the breaches were pulled off by exploiting a vulnerability in network monitoring software from SolarWinds, according to security firm FireEye.📖 Read
via "Tech Republic".
TechRepublic
US government agencies compromised by foreign nation-state
Stretching back for months, the breaches were pulled off by exploiting a vulnerability in network monitoring software from SolarWinds, according to security firm FireEye.
‼ CVE-2020-35382 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14244 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the MIME message handling of the Domino server (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the server or inject code into the system which would execute with the privileges of the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35378 ‼
📖 Read
via "National Vulnerability Database".
SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-14268 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the client or inject code into the system which would execute with the privileges of the client.📖 Read
via "National Vulnerability Database".
🔏 SolarWinds Hacked, Used in Potentially Massive Supply Chain Attack 🔏
📖 Read
via "Digital Guardian".
A global intrusion campaign involving the company’s IT monitoring and management software could date back to March.📖 Read
via "Digital Guardian".
Digital Guardian
SolarWinds Hacked, Used in Potentially Massive Supply Chain Attack
A global intrusion campaign involving the company’s IT monitoring and management software could date back to March.
🕴 2021 Security Budgets: Top Priorities, New Realities 🕴
📖 Read
via "Dark Reading".
An unprecedented 2020 has shaken up security leaders' usual list of must-have technologies. What's on the horizon? They share with us their spending plans for 2021.📖 Read
via "Dark Reading".
Dark Reading
2021 Security Budgets: 6 Top Priorities, New Realities
An unprecedented 2020 has shaken up security leaders' usual list of must-have technologies. What's on the horizon? They share with us their spending plans for 2021.