🕴 SEO Poisoning Used to Distribute Ransomware 🕴
📖 Read
via "Dark Reading".
This tactic — used to distribute REvil ransomware and the SolarMarker backdoor — is part of a broader increase in such attacks in recent months, researchers say.📖 Read
via "Dark Reading".
Dark Reading
SEO Poisoning Used to Distribute Ransomware
This tactic — used to distribute REvil ransomware and the SolarMarker backdoor — is part of a broader increase in such attacks in recent months, researchers say.
❌ All Sectors Are Now Prey as Cyber Threats Expand Targeting ❌
📖 Read
via "Threat Post".
Aamir Lakhani, security researcher at Fortinet, says no sector is off limits these days: It's time for everyone to strengthen the kill chain.📖 Read
via "Threat Post".
Threat Post
All Sectors Are Now Prey as Cyber Threats Expand Targeting
Aamir Lakhani, security researcher at Fortinet, says no sector is off limits these days: It's time for everyone to strengthen the kill chain.
‼ CVE-2021-36547 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36551 ‼
📖 Read
via "National Vulnerability Database".
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36550 ‼
📖 Read
via "National Vulnerability Database".
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36548 ‼
📖 Read
via "National Vulnerability Database".
A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41194 ‼
📖 Read
via "National Vulnerability Database".
FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate the vulnerability. For those who cannot upgrade, there is no complete workaround, but a partial mitigation exists. One can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until a patch or upgrade occurs.📖 Read
via "National Vulnerability Database".
⚠ Microsoft Edge finally arrives on Linux – “Official” build lands in repos ⚠
📖 Read
via "Naked Security".
Microsoft Edge for Linux makes an Official landing.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 6 Ways to Rewrite the Impossible Job Description 🕴
📖 Read
via "Dark Reading".
It's hard enough to fill a cybersecurity position given the talent shortage. But you may be making it harder with a poor job description that turns off would-be candidates.📖 Read
via "Dark Reading".
Dark Reading
6 Ways to Rewrite the Impossible Job Description
It's hard enough to fill a cybersecurity position given the talent shortage. But you may be making it harder with a poor job description that turns off would-be candidates.
‼ CVE-2020-23549 ‼
📖 Read
via "National Vulnerability Database".
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted .cr2 file, related to a "Data from Faulting Address controls Branch Selection starting at FORMATS!GetPlugInInfo+0x00000000000047f6".📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23546 ‼
📖 Read
via "National Vulnerability Database".
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM file, related to a "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at FORMATS!ReadMosaic+0x0000000000000981.📖 Read
via "National Vulnerability Database".
🗓️ ‘Inaction isn’t an option’ – US lawmakers back mandatory standards for transport and logistics cybersecurity 🗓️
📖 Read
via "The Daily Swig".
House Committee on Homeland Security hearing pulls focus on securing ‘planes, trains, and pipelines’📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
‘Inaction isn’t an option’ – US lawmakers back mandatory standards for transport and logistics cybersecurity
House Committee on Homeland Security hearing pulls focus on securing ‘planes, trains, and pipelines’
‼ CVE-2021-31624 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the urls parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-22079 ‼
📖 Read
via "National Vulnerability Database".
Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31862 ‼
📖 Read
via "National Vulnerability Database".
SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31627 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the index parameter.📖 Read
via "National Vulnerability Database".
🗓️ Google, Salesforce, others team up to launch MVSP security baseline project 🗓️
📖 Read
via "The Daily Swig".
The collaboration is focused on creating a vendor-neutral security standard📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Google, Salesforce, others team up to launch MVSP security baseline project
The collaboration is focused on creating a vendor-neutral security standard
⚠ Microsoft documents “SHROOTLESS” hack patched in latest Apple updates ⚠
📖 Read
via "Naked Security".
We'd have called this bug "SHROOTMORE", but naming it wasn't our call.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🗓️ Trickbot arrest: Russian national extradited to US for alleged role in developing notorious banking trojan 🗓️
📖 Read
via "The Daily Swig".
Vladimir Dunaev made his first appearance in federal court this week📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Trickbot arrest: Russian national extradited to US for alleged role in developing notorious banking trojan
Vladimir Dunaev made his first appearance in federal court this week
🕴 Finding the Right Approach to Cloud Security Posture Management (CSPM) 🕴
📖 Read
via "Dark Reading".
Cloud security is maturing — it has to. New strategies are surfacing to respond to new problems. Dr. Mike Lloyd, RedSeal's CTO, reviews one of the latest: CSPM.📖 Read
via "Dark Reading".
Dark Reading
Finding the Right Approach to Cloud Security Posture Management (CSPM)
Cloud security is maturing — it has to. New strategies are surfacing to respond to new problems. Dr. Mike Lloyd, RedSeal's CTO, reviews one of the latest: CSPM.
‼ CVE-2021-3441 ‼
📖 Read
via "National Vulnerability Database".
A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS).📖 Read
via "National Vulnerability Database".