⚠ How (NOT?!) to jailbreak your iPhone ⚠
📖 Read
via "Naked Security".
We're sticking to our "patch early, peath often" mantra, although in this case it means you can't jailbreak.📖 Read
via "Naked Security".
Naked Security
How (NOT?!) to jailbreak your iPhone
We’re sticking to our “patch early, peath often” mantra, although in this case it means you can’t jailbreak.
🕴 Okta to Buy Rival Auth0 🕴
📖 Read
via "Dark Reading".
The deal, valued at $6.5 billion, will bring together competitors in the identity management space.📖 Read
via "Dark Reading".
Dark Reading
Okta to Buy Rival Auth0
The deal, valued at $6.5 billion, will bring together competitors in the identity management space.
🕴 Intel: Paid Research Caught More Than 90% of Our Vulnerabilities 🕴
📖 Read
via "Dark Reading".
Internal research and external bug-bounty programs combined to discover the vast majority of reported security issues in the company's software.📖 Read
via "Dark Reading".
Dark Reading
Intel: Paid Research Caught More Than 90% of Our Vulnerabilities
Internal research and external bug-bounty programs combined to discover the vast majority of reported security issues in the company's software.
🕴 More Details Emerge on the Microsoft Exchange Server Attacks 🕴
📖 Read
via "Dark Reading".
The attacks seem more widespread than initially reported, researchers say, and a look at why the Microsoft Exchange Server zero-days patched this week are so dangerous.📖 Read
via "Dark Reading".
Dark Reading
Vulnerabilities & Threats recent news | Dark Reading
Explore the latest news and expert commentary on Vulnerabilities & Threats, brought to you by the editors of Dark Reading
‼ CVE-2021-27940 ‼
📖 Read
via "National Vulnerability Database".
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21331 ‼
📖 Read
via "National Vulnerability Database".
The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system. Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. This issue has been patched in version 1.0.0-beta.9. As a workaround one may specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.📖 Read
via "National Vulnerability Database".
⚠ Another Chrome zero-day exploit – so get that update done! ⚠
📖 Read
via "Naked Security".
It's déjà vu all over again! New month, new Chrome zero-day bug being exploited in the wild.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Using TikTok? Check out these six security tips ⚠
📖 Read
via "Naked Security".
Practical advice on how to maximize your security and privacy on TikTok.📖 Read
via "Naked Security".
Naked Security
Using TikTok? Check out these six security tips
Practical advice on how to maximize your security and privacy on TikTok.
‼ CVE-2019-18629 ‼
📖 Read
via "National Vulnerability Database".
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a compromised private key.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-18628 ‼
📖 Read
via "National Vulnerability Database".
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a user with administrative privileges to turn off data encryption on the device, thus leaving it open to potential cryptographic information disclosure.📖 Read
via "National Vulnerability Database".
🦿 How banks and banking customers can protect themselves against financial crimes 🦿
📖 Read
via "Tech Republic".
Account takeovers and online banking fraud are two types of attacks on the rise against financial institutions and their customers, says Feedzai.📖 Read
via "Tech Republic".
TechRepublic
How banks and banking customers can protect themselves against financial crimes
Account takeovers and online banking fraud are two types of attacks on the rise against financial institutions and their customers, says Feedzai.
🕴 Why We Need More Blue Team Voices at the Table 🕴
📖 Read
via "Dark Reading".
The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out.📖 Read
via "Dark Reading".
Dark Reading
Why We Need More Blue Team Voices at the Table
The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out.
‼ CVE-2020-24914 ‼
📖 Read
via "National Vulnerability Database".
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24912 ‼
📖 Read
via "National Vulnerability Database".
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24913 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24036 ‼
📖 Read
via "National Vulnerability Database".
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.📖 Read
via "National Vulnerability Database".
🦿 Report: Quality, not quantity, is the hallmark of the latest waves of phishing attacks 🦿
📖 Read
via "Tech Republic".
Cybercriminals have changed tactics since COVID-19, with surgically precise social engineering attacks targeting business apps replacing batch-and-blast phishing.📖 Read
via "Tech Republic".
TechRepublic
Report: Quality, not quantity, is the hallmark of the latest waves of phishing attacks
Cybercriminals have changed tactics since COVID-19, with surgically precise social engineering attacks targeting business apps replacing batch-and-blast phishing.
🛠 SQLMAP - Automatic SQL Injection Tool 1.5.3 🛠
📖 Read
via "Packet Storm Security".
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.📖 Read
via "Packet Storm Security".
Packetstormsecurity
SQLMAP - Automatic SQL Injection Tool 1.5.3 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ COVID-19 Vaccine Spear-Phishing Attacks Jump 26 Percent ❌
📖 Read
via "Threat Post".
Cybercriminals are using the COVID-19 vaccine to steal Microsoft credentials, infect systems with malware and bilk victims out of hundreds of dollars.📖 Read
via "Threat Post".
Threat Post
COVID-19 Vaccine Spear-Phishing Attacks Jump 26 Percent
Cybercriminals are using the COVID-19 vaccine to steal Microsoft credentials, infect systems with malware and bilk victims out of hundreds of dollars.
🕴 Qualys Is the Latest Victim of Accellion Data Breach 🕴
📖 Read
via "Dark Reading".
Security vendor confirms attackers exploited a previously disclosed vulnerability in the enterprise firewall technology to breach its network.📖 Read
via "Dark Reading".
Dark Reading
Qualys Is the Latest Victim of Accellion Data Breach
Security vendor confirms attackers exploited a previously disclosed vulnerability in the enterprise firewall technology to breach its network.
❌ CISA Orders Federal Agencies to Patch Exchange Servers ❌
📖 Read
via "Threat Post".
Espionage attacks exploiting the just-patched remote code-execution security bugs in Microsoft Exchange servers are quickly spreading.📖 Read
via "Threat Post".
Threat Post
CISA Orders Federal Agencies to Patch Exchange Servers
Espionage attacks exploiting the just-patched remote code-execution security bugs in Microsoft Exchange servers are quickly spreading.