‼ CVE-2020-26763 ‼
📖 Read
via "National Vulnerability Database".
The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.📖 Read
via "National Vulnerability Database".
🛠 SQLMAP - Automatic SQL Injection Tool 1.5.7 🛠
📖 Read
via "Packet Storm Security".
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.📖 Read
via "Packet Storm Security".
Packetstormsecurity
SQLMAP - Automatic SQL Injection Tool 1.5.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
⚠ Kaseya ransomware attackers say: “Pay $70 million and we’ll set everyone free” ⚠
📖 Read
via "Naked Security".
Are you feeling generous? Do you want to help others? These cybercriminals are hoping someone is and does...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ S3 Ep 39.5: A conversation with Eva Galperin [Podcast] ⚠
📖 Read
via "Naked Security".
Cryptography, privacy, stalkerware and how infosec professionals relax. Listen, enjoy and learn!📖 Read
via "Naked Security".
Naked Security
S3 Ep39.5: A conversation with Eva Galperin [Podcast]
Cryptography, privacy, stalkerware and how infosec professionals relax. Listen, enjoy and learn!
❌ Kaseya Attack Fallout: CISA, FBI Offer Guidance ❌
📖 Read
via "Threat Post".
Following a brazen ransomware attack by the REvil cybergang, CISA and FBI offer guidance to victims.📖 Read
via "Threat Post".
Threat Post
Kaseya Attack Fallout: CISA, FBI Offer Guidance
Following a brazen ransomware attack by the REvil cybergang, CISA and FBI offer guidance to victims.
‼ CVE-2021-36158 ‼
📖 Read
via "National Vulnerability Database".
In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificates and private keys are used.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32233 ‼
📖 Read
via "National Vulnerability Database".
SmarterTools SmarterMail before Build 7776 allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24389 ‼
📖 Read
via "National Vulnerability Database".
The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24386 ‼
📖 Read
via "National Vulnerability Database".
The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24407 ‼
📖 Read
via "National Vulnerability Database".
The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.📖 Read
via "National Vulnerability Database".
🦿 Critical flaws in Windows Print spooler service could allow for remote attacks 🦿
📖 Read
via "Tech Republic".
Administrators are urged to apply the latest patches from Microsoft and disable the Windows Print spooler service in domain controllers and systems not used for printing.📖 Read
via "Tech Republic".
TechRepublic
Critical flaws in Windows Print spooler service could allow for remote attacks
Administrators are urged to apply the latest patches from Microsoft and disable the Windows Print spooler service in domain controllers and systems not used for printing.
🕴 8 Ways to Preserve Legal Privilege After a Cybersecurity Incident 🕴
📖 Read
via "Dark Reading".
Knowing your legal distinctions can make defense easier should you end up in court after a breach, attack, or data loss.📖 Read
via "Dark Reading".
‼ CVE-2021-27930 ‼
📖 Read
via "National Vulnerability Database".
Multiple stored cross-site scripting (XSS) vulnerabilities in IRIS IrisNext 9.5.16 allow remote authenticated users to inject arbitrary web script or HTML via a document or folder name that is mishandled when rendering the contact form or search form.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32559 ‼
📖 Read
via "National Vulnerability Database".
An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.📖 Read
via "National Vulnerability Database".
🕴 Cyberattack on Kaseya Nets More Than 1,000 Victims, $70M Ransom Demand 🕴
📖 Read
via "Dark Reading".
The provider of remote monitoring and management services warns customers to not run its software until a patch is available and manually installed.📖 Read
via "Dark Reading".
Dark Reading
Cyberattacks & Data Breaches recent news | Dark Reading
Explore the latest news and expert commentary on Cyberattacks & Data Breaches, brought to you by the editors of Dark Reading
🦿 Kaseya supply chain attack impacts more than 1,000 companies 🦿
📖 Read
via "Tech Republic".
The REvil group is claiming that over 1 million devices have been infected and is demanding $70 million for a universal decryption key.📖 Read
via "Tech Republic".
TechRepublic
Kaseya supply chain attack impacts more than 1,000 companies
The REvil group is claiming that over 1 million devices have been infected and is demanding $70 million for a universal decryption key.
❌ Kaseya Patches Imminent After Zero-Day Exploits, 1,500 Impacted ❌
📖 Read
via "Threat Post".
REvil ransomware gang lowers price for universal decryptor after massive worldwide ransomware push against Kaseya security vulnerability CVE-2021-30116.📖 Read
via "Threat Post".
Threat Post
Kaseya Patches Imminent After Zero-Day Exploits, 1,500 Impacted
REvil ransomware gang lowers price for universal decryptor after massive worldwide ransomware push against Kaseya security vulnerability CVE-2021-30116.
🦿 The Audacity! How to wreck an open-source project and anger a community 🦿
📖 Read
via "Tech Republic".
Audacity software has been acquired, and the new verbiage added to the privacy policy has the open-source community up in arms.📖 Read
via "Tech Republic".
TechRepublic
The Audacity! How to wreck an open-source project and anger a community
Audacity software has been acquired, and the new verbiage added to the privacy policy has the open-source community up in arms.
‼ CVE-2021-31771 ‼
📖 Read
via "National Vulnerability Database".
Splinterware System Scheduler Professional version 5.30 is subject to insecure folders permissions issue impacting where the service 'WindowsScheduler' calls its executable. This allow a non-privileged user to execute arbitrary code with elevated privileges (system level privileges as "nt authority\system") since the service runs as Local System.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32740 ‼
📖 Read
via "National Vulnerability Database".
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.📖 Read
via "National Vulnerability Database".
🕴 It's High Time for a Security Scoring System for Applications and Open Source Libraries 🕴
📖 Read
via "Dark Reading".
A benchmarking system would help buyers choose more secure software products and, more importantly, light a fire underneath software producers to make products secure.📖 Read
via "Dark Reading".