‼ CVE-2020-4958 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM X-Force ID: 192209.📖 Read
via "National Vulnerability Database".
🛠 OATH Toolkit 2.6.6 🛠
📖 Read
via "Packet Storm Security".
OATH Toolkit attempts to collect several tools that are useful when deploying technologies related to OATH, such as HOTP one-time passwords. It is a fork of the earlier HOTP Toolkit.📖 Read
via "Packet Storm Security".
Packetstormsecurity
OATH Toolkit 2.6.6 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🕴 Hacker Pig Latin: A Base64 Primer for Security Analysts 🕴
📖 Read
via "Dark Reading".
The Base64 encoding scheme is often used to hide the plaintext elements in the early stages of an attack that can't be concealed under the veil of encryption. Here's how to see through its tricks.📖 Read
via "Dark Reading".
Dark Reading
Hacker Pig Latin: A Base64 Primer for Security Analysts
The Base64 encoding scheme is often used to hide the plaintext elements in the early stages of an attack that can't be concealed under the veil of encryption. Here's how to see through its tricks.
‼ CVE-2021-21238 ‼
📖 Read
via "National Vulnerability Database".
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21239 ‼
📖 Read
via "National Vulnerability Database".
PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21253 ‼
📖 Read
via "National Vulnerability Database".
OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables to crack passwords. This problem is fixed and published in version 1.1.2. A long randomly generated salt is added to the password hash function to better protect passwords stored in the voting system.📖 Read
via "National Vulnerability Database".
🕴 7 Steps to Secure a WordPress Site 🕴
📖 Read
via "Dark Reading".
Many companies operate under the assumption that their WordPress sites are secure -- and that couldn't be anything further from the truth.📖 Read
via "Dark Reading".
Dark Reading
7 Steps to Secure a WordPress Site
Many companies operate under the assumption that their WordPress sites are secure -- and that couldn't be anything further from the truth.
🦿 SSH keys: How to view in Linux, macOS, and Windows 🦿
📖 Read
via "Tech Republic".
If you're not sure how to view your SSH certificates, Jack Wallen walks you through the steps on Linux, macOS, and Windows.📖 Read
via "Tech Republic".
TechRepublic
How to view your SSH keys in Linux, macOS, and Windows
If you're not sure how to view your SSH certificates, Jack Wallen walks you through the steps on Linux, macOS, and Windows.
🕴 Cloud Jacking: The Bold New World of Enterprise Cybersecurity 🕴
📖 Read
via "Dark Reading".
Increased reliance on cloud computing puts more weight on robust authentication systems to protect data against hijackers.📖 Read
via "Dark Reading".
Dark Reading
Cloud Jacking: The Bold New World of Enterprise Cybersecurity
Increased reliance on cloud computing puts more weight on robust authentication systems to protect data against hijackers.
🦿 How to check for and stop DDoS attacks on Linux 🦿
📖 Read
via "Tech Republic".
Jack Wallen walks you through some of the steps you can take to check for and mitigate distributed denial of service attacks on a Linux server.📖 Read
via "Tech Republic".
TechRepublic
How to check for and stop DDoS attacks on Linux
Jack Wallen walks you through some of the steps you can take to check for and mitigate distributed denial of service attacks on a Linux server.
‼ CVE-2020-8567 ‼
📖 Read
via "National Vulnerability Database".
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8569 ‼
📖 Read
via "National Vulnerability Database".
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8554 ‼
📖 Read
via "National Vulnerability Database".
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8570 ‼
📖 Read
via "National Vulnerability Database".
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8568 ‼
📖 Read
via "National Vulnerability Database".
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.📖 Read
via "National Vulnerability Database".
❌ Einstein Healthcare Network Announces August Breach ❌
📖 Read
via "Threat Post".
Einstein is in violation of the the HHS 60-day breach notification rule, but unlikely to face penalty.📖 Read
via "Threat Post".
Threat Post
Einstein Healthcare Network Announces August Breach
Einstein is in violation of the the HHS 60-day breach notification rule, but unlikely to face penalty.
❌ SQL Server Malware Tied to Iranian Software Firm, Researchers Allege ❌
📖 Read
via "Threat Post".
Researchers have traced the origins of a campaign - infecting SQL servers to mine cryptocurrency - back to an Iranian software firm.📖 Read
via "Threat Post".
Threat Post
SQL Server Malware Tied to Iranian Software Firm, Researchers Allege
Researchers have traced the origins of a campaign - infecting SQL servers to mine cryptocurrency - back to an Iranian software firm.
🦿 2020 sees huge increase in records exposed in data breaches 🦿
📖 Read
via "Tech Republic".
The number of breaches may have fallen, but the number of exposed records hit a high not seen since 2005, says Risk Based Security.📖 Read
via "Tech Republic".
🔏 EDPB Issues Draft Guidelines for Data Breach Notifications 🔏
📖 Read
via "Digital Guardian".
The guidelines are supposed to help data controllers when it comes to deciding how to handle data breaches and what factors to consider during risk assessment.📖 Read
via "Digital Guardian".
Digital Guardian
EDPB Issues Draft Guidelines for Data Breach Notifications
The guidelines are supposed to help data controllers when it comes to deciding how to handle data breaches and what factors to consider during risk assessment.
🕴 Attackers Leave Stolen Credentials Searchable on Google 🕴
📖 Read
via "Dark Reading".
Operators behind a global phishing campaign inadvertently left thousands of stolen credentials accessible via Google Search.📖 Read
via "Dark Reading".
Dark Reading
Attackers Leave Stolen Credentials Searchable on Google
Operators behind a global phishing campaign inadvertently left thousands of stolen credentials accessible via Google Search.
🦿 Google: How and when to change your password 🦿
📖 Read
via "Tech Republic".
If you've ever been tempted to change your Google account password, but weren't sure how, don't let that confusion stop you. Jack Wallen walks you through the process.📖 Read
via "Tech Republic".
TechRepublic
How and when to change your Google password
If you've ever been tempted to change your Google account password, but weren't sure how, don't let that confusion stop you. Jack Wallen walks you through the process.