🦿 How to customize your sudo password prompt 🦿
📖 Read
via "Tech Republic".
If you're looking for a way to easily warn your admins to use caution when working with sudo, Jack Wallen has a sure-fire method.📖 Read
via "Tech Republic".
TechRepublic
How to customize your sudo password prompt
If you're looking for a way to easily warn your admins to use caution when working with sudo, Jack Wallen has a sure-fire method.
🦿 Customizing your sudo password prompt 🦿
📖 Read
via "Tech Republic".
If you're looking for a way to easily warn your admins to use caution when working with sudo, Jack Wallen has a sure-fire method.📖 Read
via "Tech Republic".
TechRepublic
How to customize your sudo password prompt
If you're looking for a way to easily warn your admins to use caution when working with sudo, Jack Wallen has a sure-fire method.
❌ NSA Urges SysAdmins to Replace Obsolete TLS Protocols ❌
📖 Read
via "Threat Post".
The NSA released new guidance providing system administrators with the tools to update outdated TLS protocols.📖 Read
via "Threat Post".
Threat Post
NSA Urges SysAdmins to Replace Obsolete TLS Protocols
The NSA released new guidance providing system administrators with the tools to update outdated TLS protocols.
🕴 Nissan Source Code Leaked via Misconfigured Git Server 🕴
📖 Read
via "Dark Reading".
Leaked information includes source code of Nissan mobile apps, diagnostics tool, and market research tools and data, among other assets.📖 Read
via "Dark Reading".
Dark Reading
Nissan Source Code Leaked via Misconfigured Git Server
Leaked information includes source code of Nissan mobile apps, diagnostics tool, and market research tools and data, among other assets.
🕴 Healthcare Organizations Bear the Brunt of Cyberattacks Amid Pandemic 🕴
📖 Read
via "Dark Reading".
In the past two months alone, attacks against the sector soared 45% - more than double the rate of other sectors, Check Point says.📖 Read
via "Dark Reading".
Dark Reading
Healthcare Organizations Bear the Brunt of Cyberattacks Amid Pandemic
In the past two months alone, attacks against the sector soared 45% - more than double the rate of other sectors, Check Point says.
‼ CVE-2020-8280 ‼
📖 Read
via "National Vulnerability Database".
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8264 ‼
📖 Read
via "National Vulnerability Database".
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8274 ‼
📖 Read
via "National Vulnerability Database".
Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29041 ‼
📖 Read
via "National Vulnerability Database".
A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension (code review). Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contain sources used to generate the bundle, configuration settings (e.g., API keys), and developers' comments.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35262 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8281 ‼
📖 Read
via "National Vulnerability Database".
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-36178 ‼
📖 Read
via "National Vulnerability Database".
oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25498 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8287 ‼
📖 Read
via "National Vulnerability Database".
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8275 ‼
📖 Read
via "National Vulnerability Database".
Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8265 ‼
📖 Read
via "National Vulnerability Database".
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.📖 Read
via "National Vulnerability Database".
❌ Facebook’s Mandatory Data-Sharing Rules for WhatsApp Spark Ire ❌
📖 Read
via "Threat Post".
The messaging platform will update its privacy platform on Feb. 8 to integrate further with its parent company, prompting users to cry foul over privacy issues.📖 Read
via "Threat Post".
Threat Post
Facebook’s Mandatory Data-Sharing Rules for WhatsApp Spark Ire
The messaging platform will update its privacy platform on Feb. 8 to integrate further with its parent company, prompting users to cry foul over privacy issues.
⚠ S3 Ep14: Money scams, HTTPS by default, and hardcoded passwords [Podcast] ⚠
📖 Read
via "Naked Security".
Listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep14: Money scams, HTTPS by default, and hardcoded passwords [Podcast]
Listen now!
🕴 The 3 Most Common Types of BEC Attacks (And What You Can Do About Them) 🕴
📖 Read
via "Dark Reading".
Always be skeptical and double check credentials.📖 Read
via "Dark Reading".
Dark Reading
The 3 Most Common Types of BEC Attacks (And What You Can Do About Them)
Always be skeptical and double check credentials.
‼ CVE-2020-35114 ‼
📖 Read
via "National Vulnerability Database".
Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24902 ‼
📖 Read
via "National Vulnerability Database".
Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.📖 Read
via "National Vulnerability Database".