‼ CVE-2021-27931 ‼
📖 Read
via "National Vulnerability Database".
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21314 ‼
📖 Read
via "National Vulnerability Database".
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.📖 Read
via "National Vulnerability Database".
❌ Unpatched Bug in WiFi Mouse App Opens PCs to Attack ❌
📖 Read
via "Threat Post".
Wireless mouse-utility lacks proper authentication and opens Windows systems to attack.📖 Read
via "Threat Post".
Threat Post
Unpatched Bug in WiFi Mouse App Opens PCs to Attack
Wireless mouse-utility lacks proper authentication and opens Windows systems to attack.
🕴 CISA to Federal Agencies: Immediately Patch or 'Disconnect' Microsoft Exchange Servers 🕴
📖 Read
via "Dark Reading".
The US Department of Homeland Security agency's new emergency directive comes in the wake of major zero-day attacks on email servers revealed by Microsoft this week.📖 Read
via "Dark Reading".
Dark Reading
Cyber Risk recent news | Dark Reading
Explore the latest news and expert commentary on Cyber Risk, brought to you by the editors of Dark Reading
⚠ How (NOT?!) to jailbreak your iPhone ⚠
📖 Read
via "Naked Security".
We're sticking to our "patch early, peath often" mantra, although in this case it means you can't jailbreak.📖 Read
via "Naked Security".
Naked Security
How (NOT?!) to jailbreak your iPhone
We’re sticking to our “patch early, peath often” mantra, although in this case it means you can’t jailbreak.
🕴 Okta to Buy Rival Auth0 🕴
📖 Read
via "Dark Reading".
The deal, valued at $6.5 billion, will bring together competitors in the identity management space.📖 Read
via "Dark Reading".
Dark Reading
Okta to Buy Rival Auth0
The deal, valued at $6.5 billion, will bring together competitors in the identity management space.
🕴 Intel: Paid Research Caught More Than 90% of Our Vulnerabilities 🕴
📖 Read
via "Dark Reading".
Internal research and external bug-bounty programs combined to discover the vast majority of reported security issues in the company's software.📖 Read
via "Dark Reading".
Dark Reading
Intel: Paid Research Caught More Than 90% of Our Vulnerabilities
Internal research and external bug-bounty programs combined to discover the vast majority of reported security issues in the company's software.
🕴 More Details Emerge on the Microsoft Exchange Server Attacks 🕴
📖 Read
via "Dark Reading".
The attacks seem more widespread than initially reported, researchers say, and a look at why the Microsoft Exchange Server zero-days patched this week are so dangerous.📖 Read
via "Dark Reading".
Dark Reading
Vulnerabilities & Threats recent news | Dark Reading
Explore the latest news and expert commentary on Vulnerabilities & Threats, brought to you by the editors of Dark Reading
‼ CVE-2021-27940 ‼
📖 Read
via "National Vulnerability Database".
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21331 ‼
📖 Read
via "National Vulnerability Database".
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system. Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. This issue has been patched in version 1.0.0-beta.9. As a workaround one may specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.📖 Read
via "National Vulnerability Database".
⚠ Another Chrome zero-day exploit – so get that update done! ⚠
📖 Read
via "Naked Security".
It's déjà vu all over again! New month, new Chrome zero-day bug being exploited in the wild.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Using TikTok? Check out these six security tips ⚠
📖 Read
via "Naked Security".
Practical advice on how to maximize your security and privacy on TikTok.📖 Read
via "Naked Security".
Naked Security
Using TikTok? Check out these six security tips
Practical advice on how to maximize your security and privacy on TikTok.
‼ CVE-2019-18629 ‼
📖 Read
via "National Vulnerability Database".
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a compromised private key.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-18628 ‼
📖 Read
via "National Vulnerability Database".
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a user with administrative privileges to turn off data encryption on the device, thus leaving it open to potential cryptographic information disclosure.📖 Read
via "National Vulnerability Database".
🦿 How banks and banking customers can protect themselves against financial crimes 🦿
📖 Read
via "Tech Republic".
Account takeovers and online banking fraud are two types of attacks on the rise against financial institutions and their customers, says Feedzai.📖 Read
via "Tech Republic".
TechRepublic
How banks and banking customers can protect themselves against financial crimes
Account takeovers and online banking fraud are two types of attacks on the rise against financial institutions and their customers, says Feedzai.
🕴 Why We Need More Blue Team Voices at the Table 🕴
📖 Read
via "Dark Reading".
The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out.📖 Read
via "Dark Reading".
Dark Reading
Why We Need More Blue Team Voices at the Table
The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out.
‼ CVE-2020-24914 ‼
📖 Read
via "National Vulnerability Database".
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24912 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24913 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24036 ‼
📖 Read
via "National Vulnerability Database".
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.📖 Read
via "National Vulnerability Database".
🦿 Report: Quality, not quantity, is the hallmark of the latest waves of phishing attacks 🦿
📖 Read
via "Tech Republic".
Cybercriminals have changed tactics since COVID-19, with surgically precise social engineering attacks targeting business apps replacing batch-and-blast phishing.📖 Read
via "Tech Republic".
TechRepublic
Report: Quality, not quantity, is the hallmark of the latest waves of phishing attacks
Cybercriminals have changed tactics since COVID-19, with surgically precise social engineering attacks targeting business apps replacing batch-and-blast phishing.