🗓️ VMware security warning: Multiple vulnerabilities in vCenter Server could allow remote network access 🗓️
📖 Read
via "The Daily Swig".
Several issues including one critical bug have been remedied in latest patch cycle📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
VMware security warning: Multiple vulnerabilities in vCenter Server could allow remote network access
Several issues including one critical bug have been remedied in latest patch cycle
‼ CVE-2021-3583 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36260 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39404 ‼
📖 Read
via "National Vulnerability Database".
MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database.📖 Read
via "National Vulnerability Database".
❌ Feds Sanctions SUEX Cryptocurrency Exchange for Laundering Ransomware Payouts ❌
📖 Read
via "Threat Post".
The action is the first of its kind in the U.S., as the government increases efforts to get a handle on cybercrime.📖 Read
via "Threat Post".
Threat Post
Feds Sanctions SUEX Cryptocurrency Exchange for Laundering Ransomware Payouts
The action is the first of its kind in the U.S., as the government increases efforts to get a handle on cybercrime.
❌ TikTok, GitHub, Facebook Join Open-Source Bug Bounty ❌
📖 Read
via "Threat Post".
The initiative, run by HackerOne, aims to uncover dangerous code repository bugs that end up going viral across the application supply-chain.📖 Read
via "Threat Post".
Threat Post
TikTok, GitHub, Facebook Join Open-Source Bug Bounty
The initiative, run by HackerOne, aims to uncover dangerous code repository bugs that end up going viral across the application supply-chain.
🗓️ Device ‘breakage’ concerns surface days before Let’s Encrypt root cert expiry 🗓️
📖 Read
via "The Daily Swig".
Many devices and systems may not be ready for the switchover📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Device ‘breakage’ concerns persist days before Let’s Encrypt root cert expiry
Many devices and systems may not be ready for the switchover
‼ CVE-2021-41011 ‼
📖 Read
via "National Vulnerability Database".
LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this information.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40875 ‼
📖 Read
via "National Vulnerability Database".
Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths. The corresponding file paths can be tested, and in some cases, result in the disclosure of hardcoded credentials, API keys, or other sensitive data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37927 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37925 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31836 ‼
📖 Read
via "National Vulnerability Database".
Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a low privileged user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31847 ‼
📖 Read
via "National Vulnerability Database".
Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31841 ‼
📖 Read
via "National Vulnerability Database".
A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL with a specific name and in a specific location. This would result in the user gaining elevated permissions and the ability to execute arbitrary code as the system user, through not checking the DLL signature.📖 Read
via "National Vulnerability Database".
❌ VMware Warns of Ransomware-Friendly Bug in vCenter Server ❌
📖 Read
via "Threat Post".
VMware urged immediate patching of the max-severity, arbitrary file upload flaw in Analytics service, which affects all appliances running default 6.5, 6.7 and 7.0 installs.📖 Read
via "Threat Post".
Threat Post
VMware Warns of Ransomware-Friendly Bug in vCenter Server
UPDATE: Malicious actors are already scanning honeypots, looking for servers vulnerable to the critical arbitrary file upload flaw in vCenter servers' Analytics service.
❌ How REvil May Have Ripped Off Its Own Affiliates ❌
📖 Read
via "Threat Post".
A newly discovered backdoor and double chats could have enabled REvil ransomware-as-a-service operators to hijack victim cases and snatch affiliates’ cuts of ransom payments.📖 Read
via "Threat Post".
Threat Post
How REvil May Have Ripped Off Its Own Affiliates
A newly discovered backdoor and double chats could have enabled REvil ransomware-as-a-service operators to hijack victim cases and snatch affiliates’ cuts of ransom payments.
❌ Unpatched Apple Zero-Day in macOS Finder Allows Code Execution ❌
📖 Read
via "Threat Post".
All a user needs to do is click on an email attachment, and boom -- the code is silently executed without the victim knowing. It affects Big Sur and prior versions of macOS.📖 Read
via "Threat Post".
Threat Post
Unpatched Apple Zero-Day in macOS Finder Allows Code Execution
All a user needs to do is click on an email attachment, and boom – the code is silently executed without the victim knowing. It affects Big Sur and prior versions of macOS.
‼ CVE-2021-40684 ‼
📖 Read
via "National Vulnerability Database".
Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37860 ‼
📖 Read
via "National Vulnerability Database".
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-6288 ‼
📖 Read
via "National Vulnerability Database".
Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.📖 Read
via "National Vulnerability Database".
🦿 Your IoT devices may be vulnerable to malware 🦿
📖 Read
via "Tech Republic".
NordPass: Only 33% of users surveyed had changed the default passwords on their IoT devices, leaving the rest vulnerable to attack.📖 Read
via "Tech Republic".
TechRepublic
Your IoT devices may be vulnerable to malware
NordPass: Only 33% of users surveyed had changed the default passwords on their IoT devices, leaving the rest vulnerable to attack.