🗓️ Latest web hacking tools – Q4 2021 🗓️
📖 Read
via "The Daily Swig".
We take a look at the latest additions to security researchers’ armoury📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Latest web hacking tools – Q4 2021
We take a look at the latest additions to security researchers’ armoury
❌ Apple Pay with Visa Hacked to Make Payments via Unlocked iPhones ❌
📖 Read
via "Threat Post".
Researchers have demonstrated that someone could use a stolen, unlocked iPhone to pay for thousands of dollars of goods or services, no authentication needed.📖 Read
via "Threat Post".
‼ CVE-2021-41720 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in Lodash in 4.17.21 allows attackers to arbitrary code execution via the template function. NOTE: this is a different parameter, method, and version than CVE-2021-23337.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41109 ‼
📖 Read
via "National Vulnerability Database".
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21089 ‼
📖 Read
via "National Vulnerability Database".
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to locally escalate privileges in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.📖 Read
via "National Vulnerability Database".
🗓️ Bug Bounty Radar // The latest bug bounty programs for October 2021 🗓️
📖 Read
via "The Daily Swig".
New web targets for the discerning hacker📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Bug Bounty Radar // The latest bug bounty programs for October 2021
New web targets for the discerning hacker
🕴 The New Security Basics: 10 Most Common Defensive Actions 🕴
📖 Read
via "Dark Reading".
Companies now commonly collect security metrics from their software development life cycle, implement basic security measures, and define their obligations to protect user data as part of a basic security strategy.📖 Read
via "Dark Reading".
Dark Reading
The New Security Basics: 10 Most Common Defensive Actions
Companies now commonly collect security metrics from their software development life cycle, implement basic security measures, and define their obligations to protect user data as part of a basic security strategy.
⚠ How to steal money via Apple Pay using the “Express Transit” feature ⚠
📖 Read
via "Naked Security".
Could a rogue vendor with a dodgy payment terminal rip you off via Apple Pay? Maybe. Here's what to do about it.📖 Read
via "Naked Security".
Naked Security
How to steal money via Apple Pay using the “Express Transit” feature
Could a rogue vendor with a dodgy payment terminal rip you off via Apple Pay? Maybe. Here’s what to do about it.
⚠ S3 Ep52: Let’s Encrypt, Outlook leak, and VMware exploit [Podcast] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep52: Let’s Encrypt, Outlook leak, and VMware exploit [Podcast]
Latest episode – listen now!
🛠 Haveged 1.9.15 🛠
📖 Read
via "Packet Storm Security".
haveged is a daemon that feeds the /dev/random pool on Linux using an adaptation of the HArdware Volatile Entropy Gathering and Expansion algorithm invented at IRISA. The algorithm is self-tuning on machines with cpuid support, and has been tested in both 32-bit and 64-bit environments. The tarball uses the GNU build mechanism, and includes self test targets and a spec file for those who want to build an RPM.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Haveged 1.9.15 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ Innovative Proxy Phantom ATO Fraud Ring Haunts eCommerce Accounts ❌
📖 Read
via "Threat Post".
The group uses millions of password combos at the rate of nearly 2,700 login attempts per minute with new techniques that push the ATO envelope.📖 Read
via "Threat Post".
Threat Post
Innovative Proxy Phantom ATO Fraud Ring Haunts eCommerce Accounts
The group uses millions of password combos at the rate of 2,700 login attempts per minute with new techniques that push the ATO envelope.
❌ Baby’s Death Alleged to Be Linked to Ransomware ❌
📖 Read
via "Threat Post".
Access to heart monitors disabled by the attack allegedly kept staff from spotting blood & oxygen deprivation that led to the baby's death.📖 Read
via "Threat Post".
Threat Post
Baby’s Death Alleged to Be Linked to Ransomware
Access to heart monitors disabled by the attack allegedly kept staff from spotting blood & oxygen deprivation that led to the baby's death.
🕴 You're Going to Be the Victim of a Ransomware Attack 🕴
📖 Read
via "Dark Reading".
That's not admitting defeat. It's preparing for success.📖 Read
via "Dark Reading".
Dark Reading
You're Going to Be the Victim of a Ransomware Attack
That's not admitting defeat. It's preparing for success.
❌ Tips & Tricks for Unmasking Ghoulish API Behavior ❌
📖 Read
via "Threat Post".
Jason Kent, hacker-in-residence at Cequence Security, discusses how to track user-agent connections to mobile and desktop APIs, to spot malicious activity.📖 Read
via "Threat Post".
Threat Post
Tips & Tricks for Unmasking Ghoulish API Behavior
Jason Kent, hacker-in-residence at Cequence Security, discusses how to track user-agent connections to mobile and desktop APIs, to spot malicious activity.
‼ CVE-2021-29894 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24016 ‼
📖 Read
via "National Vulnerability Database".
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24017 ‼
📖 Read
via "National Vulnerability Database".
An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20662 ‼
📖 Read
via "National Vulnerability Database".
libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20664 ‼
📖 Read
via "National Vulnerability Database".
libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-20663 ‼
📖 Read
via "National Vulnerability Database".
libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20578 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282.📖 Read
via "National Vulnerability Database".