‼ CVE-2021-4144 ‼
📖 Read
via "National Vulnerability Database".
TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.📖 Read
via "National Vulnerability Database".
👍1
🗓️ US clothing supplier Pro Wrestling Tees hit by data breach 🗓️
📖 Read
via "The Daily Swig".
Law enforcement alerted company to compromise of payment card info📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
US clothing supplier Pro Wrestling Tees hit by data breach
Law enforcement alerted company to compromise of payment card info
⚠ Plundered bitcoins recovered by FBI – all 3,879-and-one-sixth of them! ⚠
📖 Read
via "Naked Security".
Phew! An audacious crime... that didn't work out.📖 Read
via "Naked Security".
Naked Security
Plundered bitcoins recovered by FBI – all 3,879-and-one-sixth of them!
Phew! An audacious crime… that didn’t work out.
❌ ‘Spider-Man: No Way Home’ Download Installs Cryptominer ❌
📖 Read
via "Threat Post".
The origin of the Monero cryptominer file has been traced to a Russian torrent website, researchers report.📖 Read
via "Threat Post".
Threat Post
‘Spider-Man: No Way Home’ Download Installs Cryptominer
The origin of the Monero cryptominer file has been traced to a Russian torrent website, researchers report.
‼ CVE-2021-44600 ‼
📖 Read
via "National Vulnerability Database".
The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve all authentication and information about the users of this system.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44599 ‼
📖 Read
via "National Vulnerability Database".
The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.📖 Read
via "National Vulnerability Database".
🗓️ Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features for ‘inter-chip privilege escalation’ 🗓️
📖 Read
via "The Daily Swig".
Attackers can use connections between wireless chips to steal data or credentials, researchers find📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Wireless coexistence – New attack technique exploits Bluetooth, WiFi performance features for ‘inter-chip privilege escalation’
Attackers can use connections between wireless chips to steal data or credentials, researchers find
❌ Telegram Abused to Steal Crypto-Wallet Credentials ❌
📖 Read
via "Threat Post".
Attackers use the Telegram handle “Smokes Night” to spread the malicious Echelon infostealer, which steals credentials for cryptocurrency and other user accounts, researchers said.📖 Read
via "Threat Post".
Threat Post
Telegram Abused to Steal Crypto-Wallet Credentials
Attackers use the Telegram handle “Smokes Night” to spread the malicious Echelon infostealer, which steals credentials for cryptocurrency and other user accounts, researchers said.
🦿 How to deploy a Bitwarden server with Docker 🦿
📖 Read
via "Tech Republic".
Are you looking to deploy an in-house password manager server? Jack Wallen shows you how with Bitwarden and Docker.📖 Read
via "Tech Republic".
TechRepublic
How to deploy a Bitwarden server with Docker
Are you looking to deploy an in-house password manager server? Jack Wallen shows you how with Bitwarden and Docker.
🗓️ Popular WordPress platform Flywheel vulnerable to subdomain takeover 🗓️
📖 Read
via "The Daily Swig".
Malicious actors could wreak havoc by impersonating legitimate websites📖 Read
via "The Daily Swig".
‼ CVE-2021-44526 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23175 ‼
📖 Read
via "National Vulnerability Database".
NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial of service, affecting other resources beyond the intended security authority of GameStream.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3892 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-18198. Reason: This candidate is a reservation duplicate of CVE-2019-18198. Notes: All CVE users should reference CVE-2019-18198 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.📖 Read
via "National Vulnerability Database".
⚠ The cool retro phone with a REAL DIAL… plus plenty of IoT problems ⚠
📖 Read
via "Naked Security".
You know you want one, because this retro phone is NOT A TOY... except when it comes to cybersecurity.📖 Read
via "Naked Security".
Naked Security
The cool retro phone with a REAL DIAL… plus plenty of IoT problems
You know you want one, because this retro phone is NOT A TOY… except when it comes to cybersecurity.
❌ 4-Year-Old Microsoft Azure Zero-Day Exposes Web App Source Code ❌
📖 Read
via "Threat Post".
The security vulnerability could expose passwords and access tokens, along with blueprints for internal infrastructure and finding software vulnerabilities.📖 Read
via "Threat Post".
Threat Post
4-Year-Old Microsoft Azure Zero-Day Exposes Web App Source Code
The security vulnerability could expose passwords and access tokens, along with blueprints for internal infrastructure and finding software vulnerabilities.
‼ CVE-2021-43854 ‼
📖 Read
via "National Vulnerability Database".
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our recommendation is to implement such a limit.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4118 ‼
📖 Read
via "National Vulnerability Database".
pytorch-lightning is vulnerable to Deserialization of Untrusted Data📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43849 ‼
📖 Read
via "National Vulnerability Database".
cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.📖 Read
via "National Vulnerability Database".
🦿 Grinch bots hijack all kinds of holiday shopping, from gift cards to hype drop sales 🦿
📖 Read
via "Tech Republic".
Kasada research finds that all-in-one bots are fooling cyberdefenses and automating the checkout process to snap up in-demand goods.📖 Read
via "Tech Republic".
TechRepublic
Grinch bots hijack all kinds of holiday shopping, from gift cards to hype drop sales
Kasada research finds that all-in-one bots are fooling cyberdefenses and automating the checkout process to snap up in-demand goods.
‼ CVE-2021-4024 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44543 ‼
📖 Read
via "National Vulnerability Database".
An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-manual itself.📖 Read
via "National Vulnerability Database".