🕴 CISA Launches New Website to Aid Ransomware Defenders 🕴
📖 Read
via "Dark Reading".
StopRansomware.gov provides information to help organizations protect against, and respond to, ransomware attacks.📖 Read
via "Dark Reading".
Dark Reading
CISA Launches New Website to Aid Ransomware Defenders
StopRansomware.gov provides information to help organizations protect against, and respond to, ransomware attacks.
🕴 Microsoft: Israeli Firm's Tools Used to Target Activists, Dissidents 🕴
📖 Read
via "Dark Reading".
Candiru sold spyware that exploited Windows vulnerabilities and had been used in attacks against dissidents, activists, and journalists.📖 Read
via "Dark Reading".
Dark Reading
Microsoft: Israeli Firm's Tools Used to Target Activists, Dissidents
Candiru sold spyware that exploited Windows vulnerabilities and had been used in attacks against dissidents, activists, and journalists.
❌ Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases ❌
📖 Read
via "Threat Post".
The popular e-commerce platform for WordPress has started deploying emergency patches.📖 Read
via "Threat Post".
Threat Post
Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases
The popular e-commerce platform for WordPress has started deploying emergency patches.
🕴 State Dept. to Pay Up to $10M for Information on Foreign Cyberattacks 🕴
📖 Read
via "Dark Reading".
The Rewards for Justice program, a counterterrorism tool, is now aimed at collecting information on nation-states that use hackers to disrupt critical infrastructure.📖 Read
via "Dark Reading".
Dark Reading
Cyberattacks & Data Breaches recent news | Dark Reading
Explore the latest news and expert commentary on Cyberattacks & Data Breaches, brought to you by the editors of Dark Reading
‼ CVE-2021-32764 ‼
📖 Read
via "National Vulnerability Database".
Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0293 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Juniper Networks Junos OS caused by Missing Release of Memory after Effective Lifetime leads to a memory leak each time the CLI command 'show system connections extensive' is executed. The amount of memory leaked on each execution depends on the number of TCP connections from and to the system. Repeated execution will cause more memory to leak and eventually daemons that need to allocate additionally memory and ultimately the kernel to crash, which will result in traffic loss. Continued execution of this command will cause a sustained Denial of Service (DoS) condition. An administrator can use the following CLI command to monitor for increase in memory consumption of the netstat process, if it exists: user@junos> show system processes extensive | match "username|netstat" PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 21181 root 100 0 5458M 4913M CPU3 2 0:59 97.27% netstat The following log message might be observed if this issue happens: kernel: %KERN-3: pid 21181 (netstat), uid 0, was killed: out of swap space This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R2-S8, 18.2R3-S7. 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S7; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R2-S3, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2; This issue does not affect Juniper Networks Junos OS versions prior to 18.2R1.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0287 ‼
📖 Read
via "National Vulnerability Database".
In a Segment Routing ISIS (SR-ISIS)/MPLS environment, on Juniper Networks Junos OS and Junos OS Evolved devices, configured with ISIS Flexible Algorithm for Segment Routing and sensor-based statistics, a flap of a ISIS link in the network, can lead to a routing process daemon (RPD) crash and restart, causing a Denial of Service (DoS). Continued link flaps will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 19.4 versions prior to 19.4R1-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S1, 20.1R3; 20.2 versions prior to 20.2R2-S2, 20.2R3; 20.3 versions prior to 20.3R2; Juniper Networks Junos OS Evolved: 20.3-EVO versions prior to 20.3R2-EVO; 20.4-EVO versions prior to 20.4R2-EVO. This issue does not affect: Juniper Networks Junos OS releases prior to 19.4R1. Juniper Networks Junos OS Evolved releases prior to 19.4R1-EVO.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36753 ‼
📖 Read
via "National Vulnerability Database".
sharkdp BAT before 0.18.2 executes less.exe from the current working directory.📖 Read
via "National Vulnerability Database".
🕴 Attackers Exploited 4 Zero-Day Flaws in Chrome, Safari & IE 🕴
📖 Read
via "Dark Reading".
At least two government-backed actors -- including one Russian group -- used the now-patched flaws in separate campaigns, Google says.📖 Read
via "Dark Reading".
Dark Reading
Attackers Exploited 4 Zero-Day Flaws in Chrome, Safari & IE
At least two government-backed actors -- including one Russian group -- used the now-patched flaws in separate campaigns, Google says.
‼ CVE-2020-23707 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23705 ‼
📖 Read
via "National Vulnerability Database".
A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36758 ‼
📖 Read
via "National Vulnerability Database".
1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.📖 Read
via "National Vulnerability Database".
❌ Microsoft: New Unpatched Bug in Windows Print Spooler ❌
📖 Read
via "Threat Post".
Another vulnerability separate from PrintNightmare allows for local elevation of privilege and system takeover.📖 Read
via "Threat Post".
Threat Post
Microsoft: New Unpatched Bug in Windows Print Spooler
Another vulnerability separate from PrintNightmare allows for local elevation of privilege and system takeover.
‼ CVE-2021-21802 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21818 ‼
📖 Read
via "National Vulnerability Database".
A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of requests to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21820 ‼
📖 Read
via "National Vulnerability Database".
A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21801 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.📖 Read
via "National Vulnerability Database".
🕴 How to Attract More Computer Science Grads to the Cybersecurity Field 🕴
📖 Read
via "Dark Reading".
With 465,000 cybersecurity job openings in the United States, why is recruiting so difficult? A recent college graduate offers his take.📖 Read
via "Dark Reading".
Dark Reading
How to Attract More Computer Science Grads to the Cybersecurity Field
With 465,000 cybersecurity job openings in the United States, why is recruiting so difficult? A recent college graduate offers his take.
‼ CVE-2021-1422 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error in how the software cryptography module handles specific types of decryption errors. An attacker could exploit this vulnerability by sending malicious packets over an established IPsec connection. A successful exploit could cause the device to crash, forcing it to reload. Important: Successful exploitation of this vulnerability would not cause a compromise of any encrypted data. Note: This vulnerability affects only Cisco ASA Software Release 9.16.1 and Cisco FTD Software Release 7.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-28114 ‼
📖 Read
via "National Vulnerability Database".
Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.📖 Read
via "National Vulnerability Database".
🕴 4 Future Integrated Circuit Threats to Watch 🕴
📖 Read
via "Dark Reading".
Threats to the supply chains for ICs and other computer components are poised to wreak even more havoc on organizations.📖 Read
via "Dark Reading".
Dark Reading
4 Future Integrated Circuit Threats to Watch
Threats to the supply chains for ICs and other computer components are poised to wreak even more havoc on organizations.