❌ Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground ❌
📖 Read
via "Threat Post".
After 500 million LinkedIn enthusiasts were affected in a data-scraping incident in April, it's happened again - with big security ramifications.📖 Read
via "Threat Post".
Threat Post
Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground
After 500 million LinkedIn enthusiasts were affected in a data-scraping incident in April, it's happened again - with big security ramifications.
‼ CVE-2021-1134 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to an incomplete validation of the X.509 certificate used when establishing a connection between DNA Center and an ISE server. An attacker could exploit this vulnerability by supplying a crafted certificate and could then intercept communications between the ISE and DNA Center. A successful exploit could allow the attacker to view and alter sensitive information that the ISE maintains about clients that are connected to the network.📖 Read
via "National Vulnerability Database".
❌ Cobalt Strike Usage Explodes Among Cybercrooks ❌
📖 Read
via "Threat Post".
The legit security tool has shown up 161 percent more, year-over-year, in cyberattacks, having “gone fully mainstream in the crimeware world.”📖 Read
via "Threat Post".
Threat Post
Cobalt Strike Usage Explodes Among Cybercrooks
The legit security tool has shown up 161 percent more, year-over-year, in cyberattacks, having “gone fully mainstream in the crimeware world.”
❌ Details of RCE Bug in Adobe Experience Manager Revealed ❌
📖 Read
via "Threat Post".
Disclosure of a bug in Adobe’s content-management solution - used by Mastercard, LinkedIn and PlayStation – were released.📖 Read
via "Threat Post".
Threat Post
Details of RCE Bug in Adobe Experience Manager Revealed
Disclosure of a bug in Adobe’s content-management solution - used by Mastercard, LinkedIn and PlayStation – were released.
‼ CVE-2021-33503 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34548 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.📖 Read
via "National Vulnerability Database".
🦿 Americans lost $29.8 billion to phone scams in the past year, study finds 🦿
📖 Read
via "Tech Republic".
The number of spam calls, the number of people losing money to them and the total amount of money lost In the past year are all record setting.📖 Read
via "Tech Republic".
TechRepublic
Americans lost $29.8 billion to phone scams in the past year, study finds
The number of spam calls, the number of people losing money to them and the total amount of money lost In the past year are all record setting.
🕴 3 Ways Cybercriminals Are Undermining MFA 🕴
📖 Read
via "Dark Reading".
Using multifactor authentication is an excellent security step, but like everything else, it is not foolproof and will never be 100% effective.📖 Read
via "Dark Reading".
‼ CVE-2021-23400 ‼
📖 Read
via "National Vulnerability Database".
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7871 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of the parameter. This issue affects: Cnesty Helpcom 10.0 versions prior to.📖 Read
via "National Vulnerability Database".
🦿 Security and automation are top priorities for IT professionals 🦿
📖 Read
via "Tech Republic".
Data protection and lack of budgets and resources continue to present the biggest challenges as cyberattacks increase, according to a new Kaseya report.📖 Read
via "Tech Republic".
TechRepublic
Security and automation are top priorities for IT professionals
Data protection and lack of budgets and resources continue to present the biggest challenges as cyberattacks increase, according to a new Kaseya report.
🛠 Proxmark 4.13441 🛠
📖 Read
via "Packet Storm Security".
This is a custom firmware written for the Proxmark3 device. It extends the currently available firmware.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Proxmark 4.13441 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2020-7868 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32992 ‼
📖 Read
via "National Vulnerability Database".
FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may allow an attacker to execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31505 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The device can be booted into a special operation mode where hard-coded credentials are accepted for SSH authentication. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-12890.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7870 ‼
📖 Read
via "National Vulnerability Database".
A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validation of the parameter.📖 Read
via "National Vulnerability Database".
🦿 How to give users sudo privileges on Ubuntu and Red Hat-based Linux distributions in Linux 🦿
📖 Read
via "Tech Republic".
New Linux admins need to know how to give and take sudo privileges from users. Jack Wallen shows you how on both Ubuntu- and Red Hat-based Linux distributions.📖 Read
via "Tech Republic".
TechRepublic
How to give users sudo privileges on Ubuntu and Red Hat-based Linux distributions
New Linux admins need to know how to give and take sudo privileges from users. Jack Wallen shows you how on both Ubuntu- and Red Hat-based Linux distributions.
❌ Microsoft Translation Bugs Open Edge Browser to Trivial UXSS Attacks ❌
📖 Read
via "Threat Post".
The bug in Edge's auto-translate could have let remote attackers pull off RCE on any foreign-language website just by sending a message with an XSS payload.📖 Read
via "Threat Post".
Threat Post
Microsoft Translation Bugs Open Edge Browser to Trivial UXSS Attacks
The bug in Edge's auto-translate could have let remote attackers pull off RCE on any foreign-language website just by sending a message with an XSS payload.
🕴 Technology's Complexity and Opacity Threaten Critical Infrastructure Security 🕴
📖 Read
via "Dark Reading".
Addressing the complexity of modern distributed software development is one of the most important things we can do to decrease supply chain risk.📖 Read
via "Dark Reading".
‼ CVE-2021-20104 ‼
📖 Read
via "National Vulnerability Database".
Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uploaded with forms through upload.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20105 ‼
📖 Read
via "National Vulnerability Database".
Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.📖 Read
via "National Vulnerability Database".