⚠ Alleged carder gang mastermind and three acolytes under arrest in Russia ⚠
📖 Read
via "Naked Security".
The motto of the gang was "In Fraud We Trust", and they went by a dizzying range of online nicknames.📖 Read
via "Naked Security".
Naked Security
Alleged carder gang mastermind and three acolytes under arrest in Russia
The motto of the gang was “In Fraud We Trust”, and they went by a dizzying range of online nicknames.
‼ CVE-2021-3850 ‼
📖 Read
via "National Vulnerability Database".
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43863 ‼
📖 Read
via "National Vulnerability Database".
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34867 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13672.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46034 ‼
📖 Read
via "National Vulnerability Database".
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34866 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34870 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13325.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34869 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13797.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46085 ‼
📖 Read
via "National Vulnerability Database".
OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46084 ‼
📖 Read
via "National Vulnerability Database".
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46083 ‼
📖 Read
via "National Vulnerability Database".
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46087 ‼
📖 Read
via "National Vulnerability Database".
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34865 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-13313.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46086 ‼
📖 Read
via "National Vulnerability Database".
xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46089 ‼
📖 Read
via "National Vulnerability Database".
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34868 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13712.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46033 ‼
📖 Read
via "National Vulnerability Database".
In ForestBlog, as of 2021-12-28, File upload can bypass verification.📖 Read
via "National Vulnerability Database".
⚠ Tax scam emails are alive and well as US tax season starts ⚠
📖 Read
via "Naked Security".
If in doubt, don't give it out! (And don't forget that no reply is often a good reply.)📖 Read
via "Naked Security".
Naked Security
Tax scam emails are alive and well as US tax season starts
If in doubt, don’t give it out! (And don’t forget that no reply is often a good reply.)
🕴 Striking a Balance Between Cybersecurity Awareness and Anxiety 🕴
📖 Read
via "Dark Reading".
Employees don't have to be paralyzed by fear to keep the company safe. They just have to understand what threats look like and how to stop them.📖 Read
via "Dark Reading".
Dark Reading
Striking a Balance Between Cybersecurity Awareness and Anxiety
Employees don't have to be paralyzed by fear to keep the company safe. They just have to understand what threats look like and how to stop them.
🕴 8 Security Startups to Watch in 2022 🕴
📖 Read
via "Dark Reading".
Cloud security, API security, and incident response are among the issues up-and-coming security companies are working on.📖 Read
via "Dark Reading".
Dark Reading
8 Security Startups to Watch in 2022
Cloud security, API security, and incident response are among the issues up-and-coming security companies are working on.
❌ New MacOS Malware ‘DazzleSpy’ Used in Watering-Hole Attacks ❌
📖 Read
via "Threat Post".
A pro-democracy Hong Kong site was used to launch watering-hole attacks that planted a new macOS backdoor that researchers dubbed DazzleSpy.📖 Read
via "Threat Post".
Threat Post
MacOS Malware ‘DazzleSpy’ Used in Watering-Hole Attacks
A pro-democracy Hong Kong site was used to launch watering-hole attacks that planted a powerful macOS backdoor that researchers dubbed DazzleSpy.