β As drones fill the skies, cybercriminals wonβt be far behind β
π Read
via "Naked Security".
Putting these toys back in the box after a decade of hype isnβt going to be easy, but these researchers are exploring the options.π Read
via "Naked Security".
Naked Security
As drones fill the skies, cybercriminals wonβt be far behind
Putting these toys back in the box after a decade of hype isnβt going to be easy, but these researchers are exploring the options.
π 90% of large tech companies vulnerable to email spoofing π
π Read
via "Security on TechRepublic".
Most companies have not implemented standards for authenticating emails and preventing hackers from successful phishing attacks, according to Valimail.π Read
via "Security on TechRepublic".
TechRepublic
90% of large tech companies vulnerable to email spoofing
Most companies have not implemented standards for authenticating emails and preventing hackers from successful phishing attacks, according to Valimail.
β Critical Rockwell Automation Bug in Drive Component Puts IIoT Plants at Risk β
π Read
via "Threatpost".
A critical Rockwell Automation flaw could be exploited to manipulate an industrial driveβs physical process and or even stop it.π Read
via "Threatpost".
Threat Post
Critical Rockwell Automation Bug in Drive Component Puts IIoT Plants at Risk
A critical Rockwell Automation flaw could be exploited to manipulate an industrial driveβs physical process and or even stop it.
π΄ 20 Years of STRIDE: Looking Back, Looking Forward π΄
π Read
via "Dark Reading: ".
The invention of STRIDE was the key inflection point in the development of threat modeling from art to engineering practice.π Read
via "Dark Reading: ".
Dark Reading
20 Years of STRIDE: Looking Back, Looking Forward - Dark Reading
The invention of STRIDE was the key inflection point in the development of threat modeling from art to engineering practice.
β Zero-Day Bug Lays Open TP-Link Smart Home Router β
π Read
via "Threatpost".
However, an attacker would need to already be on the local network to be successful.π Read
via "Threatpost".
Threat Post
Zero-Day Bug Lays Open TP-Link Smart Home Router
An exploit would allow an attacker to establish a persistent backdoor for ongoing remote access.
ATENTIONβΌ New - CVE-2017-18110
π Read
via "National Vulnerability Database".
The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2017-18109
π Read
via "National Vulnerability Database".
The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2017-18108
π Read
via "National Vulnerability Database".
The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2017-18106
π Read
via "National Vulnerability Database".
The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2017-18105
π Read
via "National Vulnerability Database".
The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.π Read
via "National Vulnerability Database".
β Magento Patches Critical SQL Injection and RCE Vulnerabilities β
π Read
via "Threatpost".
Magento patched 37 flaws Thursday, including a stored cross-site scripting (XSS) vulnerability that could have let an attacker take over a site.π Read
via "Threatpost".
Threat Post
Magento Patches Critical SQL Injection and RCE Vulnerabilities
Magento patched 37 flaws Thursday, including a stored cross-site scripting (XSS) vulnerability that could have let an attacker take over a site.
π΄ 7 Malware Families Ready to Ruin Your IoT's Day π΄
π Read
via "Dark Reading: ".
This latest list of Internet of Things miscreants doesn't limit itself to botnets, like Mirai.π Read
via "Dark Reading: ".
Dark Reading
7 Malware Families Ready to Ruin Your IoT's Day
This latest list of Internet of Things miscreants doesn't limit itself to botnets, like Mirai.
π΄ Toyota Customer Information Exposed in Data Breach π΄
π Read
via "Dark Reading: ".
The attackers hit dealer sales systems in Japan, according to the automaker.π Read
via "Dark Reading: ".
Darkreading
Toyota Customer Information Exposed in Data Breach
The attackers hit dealer sales systems in Japan, according to the automaker.
π΄ NDSU Offers Nation's First Ph.D. in Cybersecurity Education π΄
π Read
via "Dark Reading: ".
The new program focuses on training university-level educators in cybersecurity.π Read
via "Dark Reading: ".
Dark Reading
NDSU Offers Nation's First Ph.D. in Cybersecurity Education
The new program focuses on training university-level educators in cybersecurity.
β Critical Bug in Cisco WebEx Browser Extensions Allows Remote Code-Execution β
π Read
via "Threatpost".
Users of the conferencing platform should update immediately.π Read
via "Threatpost".
Threat Post
Critical RCE Bug in Cisco WebEx Browser Extensions Faces βOngoing Exploitationβ
Users of the conferencing platform should update immediately.
β Undocumented Intel VISA Tech Can Be Abused, Researchers Allege β
π Read
via "Threatpost".
Researchers at Black Hat Asia said that Intel VISA, an undocumented testing tool, can be abused using previously-disclosed vulnerabilities.π Read
via "Threatpost".
Threat Post
Intel VISA Tech Can Be Abused, Researchers Allege
Researchers at Black Hat Asia said that Intel VISA, an undocumented testing tool, can be abused using previously-disclosed vulnerabilities.
π Use a password to secure access to an Excel workbook π
π Read
via "Security on TechRepublic".
At the file level, you can password protect an Excel workbook in two ways: You can determine who can get in and who can save changes.π Read
via "Security on TechRepublic".
TechRepublic
Use a password to secure access to an Excel workbook
At the file level, you can password protect an Excel workbook in two ways: You can determine who can get in and who can save changes.
β Medical Weed Dispensary Exposes Health Data for Thousands β
π Read
via "Threatpost".
As to how the breach happened, the company is so far keeping details tightly rolled up.π Read
via "Threatpost".
Threat Post
Medical Weed Dispensary Exposes Health Data for Thousands
As to how the breach happened, the company is so far keeping details tightly rolled up.
π Blockchain: Top 4 challenges CIOs face π
π Read
via "Security on TechRepublic".
With hype around blockchain fading, organizations are starting to seek out use cases for the technology, according to Gartner.π Read
via "Security on TechRepublic".
TechRepublic
Blockchain: Top 4 challenges CIOs face
With hype around blockchain fading, organizations are starting to seek out use cases for the technology, according to Gartner.
ATENTIONβΌ New - CVE-2014-7198
π Read
via "National Vulnerability Database".
OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection.π Read
via "National Vulnerability Database".
β Monday review β the hot 21 stories of the week β
π Read
via "Naked Security".
From the Android bloatware selling your data to the hoards of security keys on GitHub, and everything in between. It's the weekly roundup.π Read
via "Naked Security".
Naked Security
Monday review β the hot 21 stories of the week
From the Android bloatware selling your data to the hoards of security keys on GitHub, and everything in between. Itβs the weekly roundup.