🛠 Flawfinder 2.0.18 🛠
📖 Read
via "Packet Storm Security".
Flawfinder searches through source code for potential security flaws, listing potential security flaws sorted by risk, with the most potentially dangerous flaws shown first. This risk level depends not only on the function, but on the values of the parameters of the function.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Flawfinder 2.0.18 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🔏 Friday Five 6/25 🔏
📖 Read
via "".
Ransomware debates, spyware indictments, and CISA confirmations- catch up on all of the week's infosec news with the Friday Five!📖 Read
via "".
Digital Guardian
Friday Five 6/25
Ransomware debates, spyware indictments, and CISA confirmations- catch up on all of the week's infosec news with the Friday Five!
🕴 Data Privacy Is in 23andMe CSO's DNA 🕴
📖 Read
via "Dark Reading".
How serious is the company about safeguarding its customers and their genetic information? "We're hiding data even from ourselves," says the biotech and genetic testing company's head of security.📖 Read
via "Dark Reading".
Dark Reading
Data Privacy Is in 23andMe CSO's DNA
How serious is the company about safeguarding its customers and their genetic information? "We're hiding data even from ourselves," says the biotech and genetic testing company's head of security.
‼ CVE-2021-3314 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35501 ‼
📖 Read
via "National Vulnerability Database".
PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.📖 Read
via "National Vulnerability Database".
❌ FIN7 ‘Pen Tester’ Headed to Jail Amid $1B in Payment-Card Losses ❌
📖 Read
via "Threat Post".
One of the Carbanak cybergang's highest-level hackers is destined to serve seven years while making $2.5 million in restitution payments.📖 Read
via "Threat Post".
Threat Post
FIN7 ‘Pen Tester’ Headed to Jail Amid $1B in Payment-Card Losses
One of the Carbanak cybergang's highest-level hackers is destined to serve seven years while making $2.5 million in restitution payments.
🦿 Ransomware-as-a-service business model takes a hit in the aftermath of the Colonial Pipeline attack 🦿
📖 Read
via "Tech Republic".
Cybercrime gangs are finding it harder to recruit partners for the affiliate programs that power ransomware attacks.📖 Read
via "Tech Republic".
TechRepublic
Ransomware-as-a-service business model takes a hit in the aftermath of the Colonial Pipeline attack
Cybercrime gangs are finding it harder to recruit partners for the affiliate programs that power ransomware attacks.
‼ CVE-2021-33529 ‼
📖 Read
via "National Vulnerability Database".
In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33532 ‼
📖 Read
via "National Vulnerability Database".
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33542 ‼
📖 Read
via "National Vulnerability Database".
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.📖 Read
via "National Vulnerability Database".
🦿 Linux: How to find details about user logins 🦿
📖 Read
via "Tech Republic".
If you need to gather information on user logins for your Linux servers, Jack Wallen has just the tool for you.📖 Read
via "Tech Republic".
TechRepublic
How to find details about user logins on Linux
If you need to gather information on user logins for your Linux servers, Jack Wallen has just the tool for you.
❌ PS3 Players Ban: Latest Victims of Surging Attacks on Gaming Industry ❌
📖 Read
via "Threat Post".
Every Sony PlayStation 3 ID out there was compromised, provoking bans of legit players on the network.📖 Read
via "Threat Post".
Threat Post
PS3 Players Ban: Latest Victims of Surging Attacks on Gaming Industry
Every Sony PlayStation 3 ID out there was compromised, provoking bans of legit players on the network.
🕴 New CPU Baseline for Windows 11 Will Ensure Better Security, Microsoft Says 🕴
📖 Read
via "Dark Reading".
Redmond's latest OS will run only on systems with TPM 2.0 chips.📖 Read
via "Dark Reading".
Dark Reading
Dark Reading | Security | Protect The Business
Dark Reading: Connecting The Cybersecurity Community.
❌ Mercedes-Benz Customer Data Flies Out the Window ❌
📖 Read
via "Threat Post".
For over three years, a vendor was recklessly driving the cloud-stored data of luxury-car-owning customers and wannabe buyers.📖 Read
via "Threat Post".
Threat Post
Mercedes-Benz Customer Data Flies Out the Window
For over three years, a vendor was recklessly driving the cloud-stored data of luxury-car-owning customers and wannabe buyers.
‼ CVE-2021-35502 ‼
📖 Read
via "National Vulnerability Database".
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25654 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1073 ‼
📖 Read
via "National Vulnerability Database".
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability where, if a user clicks on a maliciously formatted link that opens the GeForce Experience login page in a new browser tab instead of the GeForce Experience application and enters their login information, the malicious site can get access to the token of the user login session. Such an attack may lead to these targeted users' data being accessed, altered, or lost.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35513 ‼
📖 Read
via "National Vulnerability Database".
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20751 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20745 ‼
📖 Read
via "National Vulnerability Database".
Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20749 ‼
📖 Read
via "National Vulnerability Database".
Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fudousan Plugin Pro Multi-User Type ver5.7.0 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.📖 Read
via "National Vulnerability Database".