‼ CVE-2021-3852 ‼
📖 Read
via "National Vulnerability Database".
growi is vulnerable to Authorization Bypass Through User-Controlled Key📖 Read
via "National Vulnerability Database".
❌ Phishers Rip Off High-Profile EA Gamers ❌
📖 Read
via "Threat Post".
Electronic Arts blamed “human error” after attackers compromised customer support and took over and drained some of the top FIFA Ultimate Team player accounts.📖 Read
via "Threat Post".
Threat Post
FIFA Ultimate Team Account Takeovers Plague EA Gamers
Electronic Arts blamed “human error” after attackers compromised customer support and took over and drained some of the top FIFA Ultimate Team player accounts.
🦿 Cisco Talos discovers a new malware campaign using the public cloud to hide its tracks 🦿
📖 Read
via "Tech Republic".
The campaign was first detected in October and is using services like AWS and Azure to hide its tracks and evade detection.📖 Read
via "Tech Republic".
TechRepublic
Cisco Talos discovers a new malware campaign using the public cloud to hide its tracks
The campaign was first detected in October and is using services like AWS and Azure to hide its tracks and evade detection.
🗓️ Firefox fixes fullscreen notification bypass bug that could have led to convincing phishing campaigns 🗓️
📖 Read
via "The Daily Swig".
Flurry of issues patched in web browser’s latest advisory📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Firefox fixes fullscreen notification bypass bug that could have led to convincing phishing campaigns
Flurry of issues patched in web browser’s latest advisory
‼ CVE-2021-4080 ‼
📖 Read
via "National Vulnerability Database".
crater is vulnerable to Unrestricted Upload of File with Dangerous Type📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44648 ‼
📖 Read
via "National Vulnerability Database".
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44649 ‼
📖 Read
via "National Vulnerability Database".
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44650 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components.📖 Read
via "National Vulnerability Database".
⚠ Home routers with NetUSB support could have critical kernel hole ⚠
📖 Read
via "Naked Security".
Got a router that supports USB access across the network? You might need a kernel update...📖 Read
via "Naked Security".
Naked Security
Home routers with NetUSB support could have critical kernel hole
Got a router that supports USB access across the network? You might need a kernel update…
⚠ JavaScript developer destroys own projects in supply chain “lesson” ⚠
📖 Read
via "Naked Security".
Two popular open source JavaScript packages recently got "hacked" in a symbolic gesture by the original project creator.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 Patch Management Today: A Risk-Based Strategy to Defeat Cybercriminals 🕴
📖 Read
via "Dark Reading".
By combining risk-based vulnerability prioritization and automated patch intelligence, organizations can apply patches based on threat level. Part 2 of 3.📖 Read
via "Dark Reading".
Dark Reading
Patch Management Today: A Risk-Based Strategy to Defeat Cybercriminals
By combining risk-based vulnerability prioritization and automated patch intelligence, organizations can apply patches based on threat level. Part 2 of 3.
🗓️ Patch Tuesday: Web security issues in the spotlight in Microsoft’s bumper January update 🗓️
📖 Read
via "The Daily Swig".
‘Wormable’ flaw in HTTP Protocol Stack causes concern📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Patch Tuesday: Web security issues in the spotlight in Microsoft’s bumper January update
‘Wormable’ flaw in HTTP Protocol Stack causes concern
🛠 Proxmark3 4.14831 🛠
📖 Read
via "Packet Storm Security".
This is a custom firmware written for the Proxmark3 device. It extends the currently available firmware. This release is nicknamed Frostbit.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Proxmark3 4.14831 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🗓️ Cybersecurity conferences 2022: A rundown of online, in person, and ‘hybrid’ events 🗓️
📖 Read
via "The Daily Swig".
With many events choosing to retain virtual elements forced on them by the pandemic, there’s now an abundance of online content to choose from📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Cybersecurity conferences 2022: A rundown of online, in person, and ‘hybrid’ events
With many events choosing to retain virtual elements forced on them by the pandemic, there’s still an abundance of online content to choose from
⚠ Wormable Windows HTTP hole – what you need to know ⚠
📖 Read
via "Naked Security".
One bug in the January 2022 Patch Tuesday list is getting lots of attention: "HTTP Protocol Stack Remote Code Execution Vulnerability".📖 Read
via "Naked Security".
Naked Security
Wormable Windows HTTP hole – what you need to know
One bug in the January 2022 Patch Tuesday list is getting lots of attention: “HTTP Protocol Stack Remote Code Execution Vulnerability”.
‼ CVE-2021-44651 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44652 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component.📖 Read
via "National Vulnerability Database".
🦿 US government urges organizations to prepare for Russian-sponsored cyber threats 🦿
📖 Read
via "Tech Republic".
Though the feds don't cite any specific threat, a joint advisory from CISA, the FBI and the NSA offers advice on how to detect and mitigate cyberattacks sponsored by Russia.📖 Read
via "Tech Republic".
TechRepublic
US government urges organizations to prepare for Russian-sponsored cyber threats
Though the feds don't cite any specific threat, a joint advisory from CISA, the FBI and the NSA offers advice on how to detect and mitigate cyberattacks sponsored by Russia.
🕴 Critical Infrastructure Security and a Case for Optimism in 2022 🕴
📖 Read
via "Dark Reading".
The new US infrastructure law will fund new action to improve cybersecurity across rail, public transportation, the electric grid, and manufacturing.📖 Read
via "Dark Reading".
Dark Reading
Critical Infrastructure Security and a Case for Optimism in 2022
The new US infrastructure law will fund new action to improve cybersecurity across rail, public transportation, the electric grid, and manufacturing.
❌ New York AG Warns 17 Firms of Credential Attacks ❌
📖 Read
via "Threat Post".
Sponsored: Password security is highlighted in attorney general warning to New York state businesses.📖 Read
via "Threat Post".
Threat Post
New York AG Warns 17 Firms of Credential Attacks
Sponsored: Password security is highlighted in attorney general warning to New York state businesses.
‼ CVE-2022-0015 ‼
📖 Read
via "National Vulnerability Database".
A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9.📖 Read
via "National Vulnerability Database".