‼ CVE-2021-39412 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php, (b) server_side/scripts/jsonp.php, and (c) scripts/objects_jsonp.php, the (2) value parameter in examples_support/editable_ajax.php, and the (3) PHP_SELF parameter in captcha/index.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3927 ‼
📖 Read
via "National Vulnerability Database".
vim is vulnerable to Heap-based Buffer Overflow📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39411 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.📖 Read
via "National Vulnerability Database".
🛠 Faraday 3.18.1 🛠
📖 Read
via "Packet Storm Security".
Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Faraday 3.18.1 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
❌ Beyond the Basics: Tips for Building Advanced Ransomware Resiliency ❌
📖 Read
via "Threat Post".
Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, offers advice on least privilege, automation, application control and more.📖 Read
via "Threat Post".
Threat Post
Beyond the Basics: Tips for Building Advanced Ransomware Resiliency
Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, offers advice on least privilege, automation, application control and more.
❌ BrakTooth Bluetooth Bugs Bite: Exploit Code, PoC Released ❌
📖 Read
via "Threat Post".
CISA is urging vendors to patch, given the release of public exploit code & a proof of concept tool for bugs that open billions of devices – phones, PCs, toys, etc. – to DoS & code execution.📖 Read
via "Threat Post".
Threat Post
BrakTooth Bluetooth Bugs Bite: Exploit Code, PoC Released
CISA is urging vendors to patch, given the release of public exploit code & a proof of concept tool for bugs that open billions of devices – phones, PCs, toys, etc. – to DoS & code execution.
🔏 Friday Five 11/5 🔏
📖 Read
via "".
The U.S. blacklists four companies for malicious cyber activities, a ransomware group shuts down, and a new CMMC program gets revamped - catch up on the infosec news of the week with the Friday Five!📖 Read
via "".
Digital Guardian
Friday Five 11/5
$10 million for ransomware intel, four companies blacklisted for malicious cyber activities, and a new CMMC program gets revamped - catch up on the infosec news of the week with the Friday Five!
⚠ “Customer complaint” email scam preys on your fear of getting into trouble at work ⚠
📖 Read
via "Naked Security".
Stop. Think. Connect. Don't let the crooks trick you into acting in haste.📖 Read
via "Naked Security".
Naked Security
“Customer complaint” email scam preys on your fear of getting into trouble at work
Stop. Think. Connect. Don’t let the crooks trick you into acting in haste.
⚠ S3 Ep57: Europol v. Ransomware, Shrootless bug, and Linux browser flamewars [Podcast] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep57: Europol v. Ransomware, Shrootless bug, and Linux browser flamewars [Podcast]
Latest episode – listen now!
🕴 How InfoSec Should Use the Minimum Viable Secure Product Checklist 🕴
📖 Read
via "Dark Reading".
Google and Salesforce executives discuss the need for the newly released MVSP, how tech companies came together to work on it, and how organizations should use it.📖 Read
via "Dark Reading".
Dark Reading
How InfoSec Should Use the Minimum Viable Secure Product Checklist
Google and Salesforce executives discuss the need for the newly released MVSP, how tech companies came together to work on it, and how organizations should use it.
‼ CVE-2021-42699 ‼
📖 Read
via "National Vulnerability Database".
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23566 ‼
📖 Read
via "National Vulnerability Database".
Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42698 ‼
📖 Read
via "National Vulnerability Database".
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42701 ‼
📖 Read
via "National Vulnerability Database".
An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39416 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23567 ‼
📖 Read
via "National Vulnerability Database".
Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to "Integer Divide By Zero starting at JPEG2000!ShowPlugInSaveOptions_W+0x00000000000082ea"📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42543 ‼
📖 Read
via "National Vulnerability Database".
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39413 ‼
📖 Read
via "National Vulnerability Database".
Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, and (j) reports.php; the (2) from_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) reports.php; the (3) order_col parameter in (a) analytics.php, (b) review.php, (c) social_media.php, and (d) webmaster-tools.php; and the (4) pageno parameter in (a) alerts.php, (b) log.php, (c) keywords.php, (d) proxy.php, (e) searchengine.php, and (f) siteauditor.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23565 ‼
📖 Read
via "National Vulnerability Database".
Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a "Data from Faulting Address controls Branch Selection starting at JPEG2000!ShowPlugInSaveOptions_W+0x0000000000032850".📖 Read
via "National Vulnerability Database".
❌ Native Tribal Casinos Taking Millions in Ransomware Losses ❌
📖 Read
via "Threat Post".
An FBI notification is warning of an uptick in attacks against tribal casinos.📖 Read
via "Threat Post".
Threat Post
Native Tribal Casinos Taking Millions in Ransomware Losses
An FBI notification is warning of an uptick in attacks against tribal casinos.
‼ CVE-2021-43404 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.📖 Read
via "National Vulnerability Database".