❌ Apple: CSAM Image-Detection Backdoor ‘Narrow’ in Scope ❌
📖 Read
via "Threat Post".
Computing giant tries to reassure users that the tool won’t be used for mass surveillance.📖 Read
via "Threat Post".
Threat Post
Apple: CSAM Image-Detection Backdoor ‘Narrow’ in Scope
Computing giant tries to reassure users that the tool won’t be used for mass surveillance.
❌ Terrorist Watchlist Exposed Online with Nearly 1.9M Records ❌
📖 Read
via "Threat Post".
A researcher discovered a data cache from the FBI’s Terrorist Screening Center left online without a password or authentication requirement.📖 Read
via "Threat Post".
Threat Post
Terrorist Watchlist Exposed Online with Nearly 1.9M Records
A researcher discovered a data cache from the FBI’s Terrorist Screening Center left online without a password or authentication requirement.
🛠 TOR Virtual Network Tunneling Tool 0.4.6.7 🛠
📖 Read
via "Packet Storm Security".
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
TOR Virtual Network Tunneling Tool 0.4.6.7 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🦿 Top 5 tech annoyances 🦿
📖 Read
via "Tech Republic".
Tom Merritt tells us his top five annoyances in tech and why they are frustrating.📖 Read
via "Tech Republic".
TechRepublic
Top 5 tech annoyances and why they are frustrating
Tom Merritt tells us his top five annoyances in tech and why they are frustrating.
🦿 The 5 most annoying things in technology 🦿
📖 Read
via "Tech Republic".
These five things are driving us crazy, says Tom Merritt. There's hope for some to get better.📖 Read
via "Tech Republic".
TechRepublic
The 5 most annoying things in technology
These five things are driving us crazy, says Tom Merritt. There's hope for some to get better.
‼ CVE-2020-4706 ‼
📖 Read
via "National Vulnerability Database".
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 187194.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25956 ‼
📖 Read
via "National Vulnerability Database".
In “Dolibarrâ€� application, v3.3.beta1_20121221 to v13.0.2 have “Modifyâ€� access for admin level users to change other user’s details but fails to validate already existing “Loginâ€� name, while renaming the user “Loginâ€�. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34407 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-30480. Reason: This candidate is a reservation duplicate of CVE-2021-30480. Notes: All CVE users should reference CVE-2021-30480 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25957 ‼
📖 Read
via "National Vulnerability Database".
In “Dolibarrâ€� application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4992 ‼
📖 Read
via "National Vulnerability Database".
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 192737.📖 Read
via "National Vulnerability Database".
❌ Bug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop ❌
📖 Read
via "Threat Post".
A remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek’s Kalay network, used in 83m devices.📖 Read
via "Threat Post".
Threat Post
Bug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop
A remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek’s Kalay network, used in 83m devices.
⚠ Copyright scammers turn to phone numbers instead of web links ⚠
📖 Read
via "Naked Security".
Forewarned is forearmed. Here's our advice on dealing with "copyright infringement" scammers.📖 Read
via "Naked Security".
Naked Security
Copyright scammers turn to phone numbers instead of web links
Forewarned is forearmed. Here’s our advice on dealing with “copyright infringement” scammers.
⚠ Video surveillance network hacked by researchers to hijack footage ⚠
📖 Read
via "Naked Security".
Home automation. Internet of Things. Cloud management. And a security bug that could let other people watch you online...📖 Read
via "Naked Security".
Naked Security
Video surveillance network hacked by researchers to hijack footage
Home automation. Internet of Things. Cloud management. And a security bug that could let other people watch you online…
❌ LockBit 2.0 Ransomware Proliferates Globally ❌
📖 Read
via "Threat Post".
Fresh attacks target companies' employees, promising millions of dollars in exchange for valid account credentials for initial access.📖 Read
via "Threat Post".
Threat Post
LockBit 2.0 Ransomware Proliferates Globally
Fresh attacks target companies' employees, promising millions of dollars in exchange for valid account credentials for initial access.
‼ CVE-2021-3459 ‼
📖 Read
via "National Vulnerability Database".
A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access and/or arbitrary privileged commands to be executed on the adapter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3633 ‼
📖 Read
via "National Vulnerability Database".
A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3615 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3616 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32829 ‼
📖 Read
via "National Vulnerability Database".
ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Execution (RCE) via bypass of the Groovy shell sandbox. The REST API exposes the GET zstack/v1/batch-queries?script endpoint which is backed up by the BatchQueryAction class. Messages are represented by the APIBatchQueryMsg, dispatched to the QueryFacadeImpl facade and handled by the BatchQuery class. The HTTP request parameter script is mapped to the APIBatchQueryMsg.script property and evaluated as a Groovy script in BatchQuery.query the evaluation of the user-controlled Groovy script is sandboxed by SandboxTransformer which will apply the restrictions defined in the registered (sandbox.register()) GroovyInterceptor. Even though the sandbox heavily restricts the receiver types to a small set of allowed types, the sandbox is non effective at controlling any code placed in Java annotations and therefore vulnerable to meta-programming escapes. This issue leads to post-authenticated remote code execution. For more details see the referenced GHSL-2021-065. This issue is patched in versions 3.8.21, 3.10.8, and 4.1.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3617 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28846 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account.📖 Read
via "National Vulnerability Database".