βΌ CVE-2021-36382 βΌ
π Read
via "National Vulnerability Database".
Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext).π Read
via "National Vulnerability Database".
βΌ CVE-2020-18979 βΌ
π Read
via "National Vulnerability Database".
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via theX-forwarded-for Header parameter.π Read
via "National Vulnerability Database".
β Where do all those cybercrime payments go? β
π Read
via "Naked Security".
Yes, the headline is a rhetorical question. But sometimes we get literal answers, and they're well worth remembering.π Read
via "Naked Security".
Naked Security
Where do all those cybercrime payments go?
Yes, the headline is a rhetorical question. But sometimes we get literal answers, and theyβre well worth remembering.
π¦Ώ The most dangerous messaging apps on Android π¦Ώ
π Read
via "Tech Republic".
Messaging apps are becoming some of the most popular smartphone programs in the world, and that means more attempts to phish their users, Kaspersky finds.π Read
via "Tech Republic".
TechRepublic
The most dangerous messaging apps on Android
Messaging apps are becoming some of the most popular smartphone programs in the world, and that means more attempts to phish their users, Kaspersky finds.
β Donβt get tricked by this crashtastic iPhone Wi-Fi hack! β
π Read
via "Naked Security".
Learn how the trick works so that you can avoid it in case someone thinks it's a joke to catch you out.π Read
via "Naked Security".
Naked Security
Donβt get tricked by this crashtastic iPhone Wi-Fi hack!
Learn how the trick works so that you can avoid it in case someone thinks itβs a joke to catch you out.
β Critical RCE Vulnerability in ForgeRock OpenAM Under Active Attack β
π Read
via "Threat Post".
The attacks are enabled by an unpatched security vulnerability in ForgeRock's Access Management, a popular platform that front-ends web apps and remote-access setups.π Read
via "Threat Post".
Threat Post
Critical RCE Vulnerability in ForgeRock OpenAM Under Active Attack
The attacks are enabled by a (fixed) vulnerability in ForgeRock's Access Management, a popular platform that front-ends web apps and remote-access setups.
βΌ CVE-2021-32703 βΌ
π Read
via "National Vulnerability Database".
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.π Read
via "National Vulnerability Database".
βΌ CVE-2021-20414 βΌ
π Read
via "National Vulnerability Database".
IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM X-Force ID: 196216.π Read
via "National Vulnerability Database".
βΌ CVE-2021-36381 βΌ
π Read
via "National Vulnerability Database".
In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logon_error= on the login screen of the Web application.π Read
via "National Vulnerability Database".
βΌ CVE-2021-29803 βΌ
π Read
via "National Vulnerability Database".
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204164.π Read
via "National Vulnerability Database".
π΄ Microsoft Confirms Acquisition of RiskIQ π΄
π Read
via "Dark Reading".
RiskIQ's technology helps businesses assess their security across the Microsoft cloud, Amazon Web Services, other clouds, and on-premises.π Read
via "Dark Reading".
π European Authorities Bust Phishing Ring π
π Read
via "".
The group, which was based in Romania, reportedly conned online consumers out of $2 million.π Read
via "".
Digital Guardian
European Authorities Bust Phishing Ring
The group, which was based in Romania, reportedly conned online consumers out of $2 million.
βΌ CVE-2021-32707 βΌ
π Read
via "National Vulnerability Database".
Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist.π Read
via "National Vulnerability Database".
β WordPress File Management Plugin Riddled with Critical Bugs β
π Read
via "Threat Post".
The bugs allow a range of attacks on websites, including deleting blog pages and remote code execution.π Read
via "Threat Post".
Threat Post
WordPress File Management Plugin Riddled with Critical Bugs
The bugs allow a range of attacks on websites, including deleting blog pages and remote code execution.
π΄ SolarWinds Discloses Zero-Day Under Active Attack π΄
π Read
via "Dark Reading".
The company confirms this is a new vulnerability that is not related to the supply chain attack discovered in December 2020.π Read
via "Dark Reading".
βΌ CVE-2021-24426 βΌ
π Read
via "National Vulnerability Database".
The Backup by 10Web ΓΒ’Γ’β¬Òβ¬Ε Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issueπ Read
via "National Vulnerability Database".
βΌ CVE-2020-19907 βΌ
π Read
via "National Vulnerability Database".
A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service.π Read
via "National Vulnerability Database".
βΌ CVE-2021-24421 βΌ
π Read
via "National Vulnerability Database".
The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issueπ Read
via "National Vulnerability Database".
βΌ CVE-2021-32747 βΌ
π Read
via "National Vulnerability Database".
Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauthorized users exists between versions 2.0.0 and 2.8.2. Custom variables are user-defined keys and values on configuration objects in Icinga 2. These are commonly used to reference secrets in other configurations such as check commands to be able to authenticate with a service being checked. Icinga Web 2 displays these custom variables to logged in users with access to said hosts or services. In order to protect the secrets from being visible to anyone, it's possible to setup protection rules and blacklists in a user's role. Protection rules result in `***` being shown instead of the original value, the key will remain. Backlists will hide a custom variable entirely from the user. Besides using the UI, custom variables can also be accessed differently by using an undocumented URL parameter. By adding a parameter to the affected routes, Icinga Web 2 will show these columns additionally in the respective list. This parameter is also respected when exporting to JSON or CSV. Protection rules and blacklists however have no effect in this case. Custom variables are shown as-is in the result. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, one may set up a restriction to hide hosts and services with the custom variable in question.π Read
via "National Vulnerability Database".
βΌ CVE-2021-32741 βΌ
π Read
via "National Vulnerability Database".
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.π Read
via "National Vulnerability Database".
π¦Ώ Vulnerability in Schneider Electric PLCs allows for undetectable remote takeover π¦Ώ
π Read
via "Tech Republic".
Dubbed Modipwn, the vulnerability affects a wide variety of Modicon programmable logic controllers used in manufacturing, utilities, automation and other roles.π Read
via "Tech Republic".
TechRepublic
Vulnerability in Schneider Electric PLCs allows for undetectable remote takeover
Dubbed Modipwn, the vulnerability affects a wide variety of Modicon programmable logic controllers used in manufacturing, utilities, automation and other roles.