🕴 Are You Listening to Your Kill Chain? 🕴
📖 Read
via "Dark Reading: ".
With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.📖 Read
via "Dark Reading: ".
Darkreading
Are You Listening to Your Kill Chain?
With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.
❌ U.S. Issues Multiple Charges For 2016 SEC Hack ❌
📖 Read
via "Threatpost | The first stop for security news".
The two were able to hack into the SEC's computer systems due to phishing attacks that stole credentials and spread malware.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
U.S. Issues Multiple Charges For 2016 SEC Hack
The two were able to hack into the SEC's computer systems due to phishing attacks that stole credentials and spread malware.
🔐 To stay competitive, MSSPs need to grow and evolve 🔐
📖 Read
via "Security on TechRepublic".
Managed Security Service Providers can alleviate many of the headaches suffered by in-house security, but they need to remain nimble and focused to retain their edge.📖 Read
via "Security on TechRepublic".
TechRepublic
To stay competitive, MSSPs need to grow and evolve
Managed Security Service Providers can alleviate many of the headaches suffered by in-house security, but they need to remain nimble and focused to retain their edge.
🕴 Fortnite Players at Risk Via Epic Games Vulnerability 🕴
📖 Read
via "Dark Reading: ".
Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.📖 Read
via "Dark Reading: ".
Darkreading
Fortnite Players Compromised Via Epic Games Vulnerability
Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.
ATENTION‼ New - CVE-2015-9280
📖 Read
via "National Vulnerability Database".
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-9279
📖 Read
via "National Vulnerability Database".
MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-9278
📖 Read
via "National Vulnerability Database".
MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-9277
📖 Read
via "National Vulnerability Database".
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-9276
📖 Read
via "National Vulnerability Database".
SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2016-10403 (chrome)
📖 Read
via "National Vulnerability Database".
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.📖 Read
via "National Vulnerability Database".
🕴 BEC Groups Ramp Up Payroll Diversion Attacks 🕴
📖 Read
via "Dark Reading: ".
Criminals are increasingly trying to defraud businesses by diverting payrolls of CEOs, other senior executives, Agari says.📖 Read
via "Dark Reading: ".
Darkreading
BEC Groups Ramp Up Payroll Diversion Attacks
Criminals are increasingly trying to defraud businesses by diverting payrolls of CEOs, other senior executives, Agari says.
🕴 How the US Chooses Which Zero-Day Vulnerabilities to Stockpile 🕴
📖 Read
via "Dark Reading: ".
When it comes to acceptable circumstances for government disclosure of zero-days, the new Vulnerabilities Equity Process might be the accountability practice security advocates have been waiting for.📖 Read
via "Dark Reading: ".
Darkreading
How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
When it comes to acceptable circumstances for government disclosure of zero-days, the new Vulnerabilities Equity Process might be the accountability practice security advocates have been waiting for.
❌ Millions of Oklahoma Gov Files Exposed by Wide-Open Server ❌
📖 Read
via "Threatpost | The first stop for security news".
The storage server was left open for about a week and exposed everything from sensitive FBI investigations to data related to patients with AIDS.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
Millions of Oklahoma Gov Files Exposed by Wide-Open Server
The storage server was left open for about a week and exposed everything from sensitive FBI investigations to data related to people with AIDS.
🕴 Fortnite Players at Risk Via Epic Games Vulnerability 🕴
📖 Read
via "Dark Reading: ".
Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.📖 Read
via "Dark Reading: ".
Darkreading
Fortnite Players Compromised Via Epic Games Vulnerability
Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.
ATENTION‼ New - CVE-2017-3137
📖 Read
via "National Vulnerability Database".
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-3136
📖 Read
via "National Vulnerability Database".
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-3135
📖 Read
via "National Vulnerability Database".
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-1002152 (bodhi)
📖 Read
via "National Vulnerability Database".
Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2016-9778
📖 Read
via "National Vulnerability Database".
An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the "nxdomain-redirect" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type "redirect" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.📖 Read
via "National Vulnerability Database".
🕴 Oklahoma Data Leak Compromises Years of FBI Data 🕴
📖 Read
via "Dark Reading: ".
The Oklahoma Securities Commission accidentally leaked 3 TB of information, including data on years of FBI investigations.📖 Read
via "Dark Reading: ".
Dark Reading
Oklahoma Data Leak Compromises Years of FBI Data
The Oklahoma Securities Commission accidentally leaked 3 TB of information, including data on years of FBI investigations.
❌ Threatpost Survey Says: 2FA is Just Fine, But Go Ahead and Kill SMS ❌
📖 Read
via "Threatpost | The first stop for security news".
Our reader poll showed overwhelming support for 2FA even in the wake of a bypass tool being released -- although lingering concerns remain.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
Threatpost Survey Says: 2FA is Just Fine, But Go Ahead and Kill SMS
Our reader poll showed overwhelming support for 2FA even in the wake of a bypass tool being released — although lingering concerns remain.