‼ CVE-2020-5321 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input validation vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to spawn tasks with elevated privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29499 ‼
📖 Read
via "National Vulnerability Database".
Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26081 ‼
📖 Read
via "National Vulnerability Database".
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26082 ‼
📖 Read
via "National Vulnerability Database".
The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-25051 ‼
📖 Read
via "National Vulnerability Database".
objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36979 ‼
📖 Read
via "National Vulnerability Database".
Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26095 ‼
📖 Read
via "National Vulnerability Database".
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27021 ‼
📖 Read
via "National Vulnerability Database".
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.📖 Read
via "National Vulnerability Database".
❌ MosaicLoader Malware Delivers Facebook Stealers, RATs ❌
📖 Read
via "Threat Post".
The newly documented code is a full-service malware-delivery threat that's spreading indiscriminately globally through paid search ads.📖 Read
via "Threat Post".
Threat Post
MosaicLoader Malware Delivers Facebook Stealers, RATs
The newly documented code is a full-service malware-delivery threat that's spreading indiscriminately globally through paid search ads.
🦿 Companies are losing the war against phishing as attacks increase in number and sophistication 🦿
📖 Read
via "Tech Republic".
A new report finds that 74% of companies have been the victim of phishing in the last year. Staff shortages, a lack of security training and an increase in mobile device usage for work are factors.📖 Read
via "Tech Republic".
TechRepublic
Companies are losing the war against phishing as attacks increase in number and sophistication
A new report finds that 74% of companies have been the victim of phishing in the last year. Staff shortages, a lack of security training and an increase in mobile device usage for work are factors.
❌ A New Security Paradigm: External Attack Surface Management ❌
📖 Read
via "Threat Post".
Advanced EASM solutions are crucial to automating the discovery of the downstream third-party (or fourth-party, or fifth-party, etc.) IT infrastructures that your organization is exposed to, and may be vulnerable to attack, posing a critical risk for your organization.📖 Read
via "Threat Post".
Threat Post
A New Security Paradigm: External Attack Surface Management
Analysts like Gartner have identified EASM as an approach to securing IT assets. This article drills into the capacities of EASM solutions, and how companies can use them.
❌ 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines ❌
📖 Read
via "Threat Post".
The bug could allow cyberattackers to bypass security products, tamper with data and run code in kernel mode.📖 Read
via "Threat Post".
Threat Post
16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines
The bug could allow cyberattackers to bypass security products, tamper with data and run code in kernel mode.
❌ Why Your Business Needs a Long-Term Remote Security Strategy ❌
📖 Read
via "Threat Post".
Chris Hass, director of information security and research at Automox, discusses the future of work: A hybrid home/office model that will demand new security approaches.📖 Read
via "Threat Post".
Threat Post
Why Your Business Needs a Long-Term Remote Security Strategy
Chris Hass, director of information security and research at Automox, discusses the future of work: A hybrid home/office model that will demand new security approaches.
⚠ Apple iPhone patches are out – no news if recent Wi-Fi bug is fixed ⚠
📖 Read
via "Naked Security".
Remember that weird iPhone Wi-Fi bug from a week or so ago? Let's hope this update patches it!📖 Read
via "Naked Security".
Naked Security
Apple iPhone patches are out – no news if recent Wi-Fi bug is fixed
Remember that weird iPhone Wi-Fi bug from a week or so ago? Let’s hope this update patches it!
‼ CVE-2020-15660 ‼
📖 Read
via "National Vulnerability Database".
Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared request, lead to remote code execution.📖 Read
via "National Vulnerability Database".
🦿 Ransomware: International cooperation is needed to curb these cybersecurity threats, says expert 🦿
📖 Read
via "Tech Republic".
Ransomware knows no borders. An attorney with cybersecurity expertise suggests the only way to stop ransomware is for nations to create a global solution.📖 Read
via "Tech Republic".
TechRepublic
Ransomware: International cooperation is needed to curb these cybersecurity threats, says expert
Ransomware knows no borders. An attorney with cybersecurity expertise suggests the only way to stop ransomware is for nations to create a global solution.
‼ CVE-2021-32668 ‼
📖 Read
via "National Vulnerability Database".
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.📖 Read
via "National Vulnerability Database".
❌ Law Firm to the Fortune 500 Breached with Ransomware ❌
📖 Read
via "Threat Post".
Deep-pocketed clients' customers & suppliers could be in the attacker's net, with potential PII exposure from an A-list clientele such as Apple, Boeing and IBM.📖 Read
via "Threat Post".
Threat Post
Law Firm to the Fortune 500 Breached with Ransomware
Deep-pocketed clients' customers & suppliers could be in the attacker's net, with potential PII exposure from an A-list clientele such as Apple, Boeing and IBM.
‼ CVE-2021-32767 ‼
📖 Read
via "National Vulnerability Database".
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.📖 Read
via "National Vulnerability Database".
🦿 Your iPhone and the Pegasus spyware hack: What you need to know 🦿
📖 Read
via "Tech Republic".
iPhones have been compromised by the NSO Group's Pegasus spyware. Should you be worried? That depends on who you ask.📖 Read
via "Tech Republic".
TechRepublic
Your iPhone and the Pegasus spyware hack: What you need to know
iPhones have been compromised by the NSO Group's Pegasus spyware. Should you be worried? That depends on who you ask.
🦿 Top 5 things to know about supply chain attacks 🦿
📖 Read
via "Tech Republic".
Worried about supply chain attacks? Tom Merritt can help you understand your risk.📖 Read
via "Tech Republic".
TechRepublic
Top 5 things to know about supply chain attacks
Worried about supply chain attacks? Tom Merritt can help you understand your risk.