‼ CVE-2020-27199 ‼
📖 Read
via "National Vulnerability Database".
The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for correct password to gain access to the mobile application as that victim user.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25095 ‼
📖 Read
via "National Vulnerability Database".
LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (CSWH). If a logged-in PM user visits a malicious site in the same browser session, that site can perform a CSRF attack to create a WebSocket from the victim client to the vulnerable PM server. Once the socket is created, the malicious site can interact with the vulnerable web server in the context of the logged-in user. This can include WebSocket payloads that result in command execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29436 ‼
📖 Read
via "National Vulnerability Database".
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35195 ‼
📖 Read
via "National Vulnerability Database".
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25094 ‼
📖 Read
via "National Vulnerability Database".
LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25010 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R0002.P05 allows remote attackers to upload a malicious script file by constructing a POST type request and writing a payload in the request parameters as an instruction to write a file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35188 ‼
📖 Read
via "National Vulnerability Database".
The official chronograf docker images before 1.7.7-alpine (Alpine specific) contain a blank password for a root user. System using the chronograf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25096 ‼
📖 Read
via "National Vulnerability Database".
LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different roles and privileges, intended to limit what data and services they can interact with. However, no access control is enforced for WebSocket-based communication to the PM application server, which will forward requests to any configured back-end server, regardless of whether the user's access rights should permit this. As a result, even the most low-privileged user can interact with any back-end component that has a LogRhythm agent installed.📖 Read
via "National Vulnerability Database".
🦿 Phone scammers were able to get 270% more personal information in 2020 than in 2019 🦿
📖 Read
via "Tech Republic".
The COVID-19 crisis enabled scammers to take advantage of the guileless, as bad actors were able to extract personal information from targets, according to a new report from First Orion.📖 Read
via "Tech Republic".
TechRepublic
Phone scammers were able to get 270% more personal information in 2020 than in 2019
The COVID-19 crisis enabled scammers to take advantage of the guileless, as bad actors were able to extract personal information from targets, according to a new report from First Orion.
⚠ S3 Ep11: DIY phishes, sandwich scams and vaccine hacking [Podcast] ⚠
📖 Read
via "Naked Security".
Here's the latest podcast - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep11: DIY phishes, sandwich scams and vaccine hacking [Podcast]
Here’s the latest podcast – listen now!
🕴 VPNs, MFA & the Realities of Remote Work 🕴
📖 Read
via "Dark Reading".
The work-from-home-era is accelerating cloud-native service adoption.📖 Read
via "Dark Reading".
Dark Reading
VPNs, MFA & the Realities of Remote Work
The work-from-home-era is accelerating cloud-native service adoption.
⚠ When zombie malware leads to big-money ransomware attacks ⚠
📖 Read
via "Naked Security".
SophosLabs investigates SystemBC, a malware utility for launching fileless malware attacks, including big-money ransomware.📖 Read
via "Naked Security".
Naked Security
When zombie malware leads to big-money ransomware attacks
SophosLabs investigates SystemBC, a malware utility for launching fileless malware attacks, including big-money ransomware.
🦿 How to protect your organization following the SolarWinds compromise 🦿
📖 Read
via "Tech Republic".
Whether your organization uses the vulnerable SolarWinds software or you want to defend yourself against similar exploits, here are recommendations from four sources.📖 Read
via "Tech Republic".
TechRepublic
How to protect your organization following the SolarWinds compromise
Whether your organization uses the vulnerable SolarWinds software or you want to defend yourself against similar exploits, here are recommendations from four sources.
❌ 3M Users Targeted by Malicious Facebook, Insta Browser Add-Ons ❌
📖 Read
via "Threat Post".
Researchers identify malware existing in popular add-ons for Facebook, Vimeo, Instagram and others that are commonly used in browsers from Google and Microsoft.📖 Read
via "Threat Post".
Threat Post
3M Users Targeted by Malicious Facebook, Insta Browser Add-Ons
Researchers identify malware existing in popular add-ons for Facebook, Vimeo, Instagram and others that are commonly used in browsers from Google and Microsoft.
❌ Code42 Incydr Series: Bringing Shadow IT into the light with Code42 Incydr ❌
📖 Read
via "Threat Post".
The massive shift to remote work has turbocharged the shadow IT problem.📖 Read
via "Threat Post".
Threat Post
Code42 Incydr Series: Bringing Shadow IT into the light with Code42 Incydr
The massive shift to remote work has turbocharged the shadow IT problem.
❌ Cryptologists Crack Zodiac Killer’s 340 Cipher ❌
📖 Read
via "Threat Post".
The Zodiac’s serial killer’s 340 cipher, which couldn’t be solved for 50 years, has been cracked by a remote team of mathematicians.📖 Read
via "Threat Post".
Threat Post
Cryptologists Crack Zodiac Killer’s 340 Cipher
The Zodiac’s serial killer’s 340 cipher, which couldn’t be solved for 50 years, has been cracked by a remote team of mathematicians.
‼ CVE-2020-22083 ‼
📖 Read
via "National Vulnerability Database".
jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function.📖 Read
via "National Vulnerability Database".
🦿 The worst bugs in the top programming languages 🦿
📖 Read
via "Tech Republic".
A heatmap shows PHP has the most flaws followed by C++, then Java, .Net, JavaScript, and Python in Veracode's annual security report.📖 Read
via "Tech Republic".
TechRepublic
The worst bugs in the top programming languages
A heatmap shows PHP has the most flaws followed by C++, then Java, .Net, JavaScript, and Python in Veracode's annual security report.
🕴 51% of WFH Parents Say Children Have Accessed Work Accounts 🕴
📖 Read
via "Dark Reading".
In addition, 14% of surveyed parents who are working from home say their children have access to their work devices, new data shows.📖 Read
via "Dark Reading".
Dark Reading
51% of WFH Parents Say Children Have Accessed Work Accounts
In addition, 14% of surveyed parents who are working from home say their children have access to their work devices, new data shows.
🕴 Rising to the Challenge: Perspectives from Security Leaders on 2020 and Beyond 🕴
📖 Read
via "Dark Reading".
For those who work in the security industry 2020 has been a particularly challenging year. Chris Price talks to five industry leaders from different perspectives in the sector about how they coped with COVID and asks them to look forward to 2021.📖 Read
via "Dark Reading".
Dark Reading
Rising to the Challenge: Perspectives from Security Leaders on 2020 and Beyond
For those who work in the security industry 2020 has been a particularly challenging year. Chris Price talks to five industry leaders from different perspectives in the sector about how they coped with COVID and asks them to look forward to 2021.
🛠 Zed Attack Proxy 2.10.0 Cross Platform Package 🛠
📖 Read
via "Packet Storm Security".
The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually. This is the cross platform package.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Zed Attack Proxy 2.10.0 Cross Platform Package ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers