⚠ S3 Ep67: Tax scams, carder busts and crypto capers [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep67: Tax scams, carder busts and crypto capers [Podcast + Transcript]
Latest episode – listen now!
❌ Conti, DeadBolt Target Delta, QNAP ❌
📖 Read
via "Threat Post".
QNAP had to push out an unexpected (and not entirely welcome) NAS device update, and Delta Electronics' network has been crippled.📖 Read
via "Threat Post".
Threat Post
Conti, DeadBolt Ransomwares Target Delta, QNAP
QNAP had to push out an unexpected (and not entirely welcome) NAS device update, and Delta Electronics’ network has been crippled.
❌ Shlayer and Bundlore MacOS Malware Strains – How Uptycs EDR Detection Can Help ❌
📖 Read
via "Threat Post".
MacOS malware Shlayer and Bundlore may have variations, but the behavior of their attacks have not changed – attacking older macOS versions and poorly-protected websites.📖 Read
via "Threat Post".
Threat Post
Shlayer and Bundlore MacOS Malware Strains – How Uptycs EDR Detection Can Help
Ashwin Vamshi Adware strains Shlayer and Bundlore are the most common malware in macOS – although they have slight variations, they have long invaded and bypassed Xprotect, Notarization, Gatekeeper, and File Quarantine, all security features pre-built into…
‼ CVE-2021-42791 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.📖 Read
via "National Vulnerability Database".
🗓️ US government’s ‘zero trust’ roadmap calls time on perimeter-based paradigm 🗓️
📖 Read
via "The Daily Swig".
Federal agencies have a little over two years to fundamentally remodel cyber defenses📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
US government’s ‘zero trust’ roadmap calls time on perimeter-based paradigm
Federal agencies have a little over two years to fundamentally remodel cyber defenses
⚠ Happy Data Privacy Day – and we really do mean “happy” :-) ⚠
📖 Read
via "Naked Security".
We give you some simple digital lifesytle tips that cost nothing.📖 Read
via "Naked Security".
Naked Security
Happy Data Privacy Day – and we really do mean “happy” :-)
We give you some simple digital lifesytle tips that cost nothing.
❌ Zerodium Spikes Payout for Zero-Click Outlook Zero-Days ❌
📖 Read
via "Threat Post".
The sweetened deal came on the same day that Trustwave SpiderLabs published a new way to bypass Outlook security to deliver malicious links to victims.📖 Read
via "Threat Post".
Threat Post
Zerodium Spikes Payout for Zero-Click Outlook Zero-Days
The sweetened deal came on the same day that Trustwave SpiderLabs published a new way to bypass Outlook security to deliver malicious links to victims.
‼ CVE-2022-23098 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44249 ‼
📖 Read
via "National Vulnerability Database".
Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23863 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23097 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45435 ‼
📖 Read
via "National Vulnerability Database".
An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in login.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25905 ‼
📖 Read
via "National Vulnerability Database".
An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) LoginAsAdmin.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23096 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.📖 Read
via "National Vulnerability Database".
🦿 Kaspersky stopped more than 30,000 attempts to use the Log4Shell exploit in January 🦿
📖 Read
via "Tech Republic".
The critical remote code execution vulnerability in Apache's Log4j utility continues to be a popular tactic for cybercriminals. Consider this yet another plea to patch your systems.📖 Read
via "Tech Republic".
TechRepublic
Kaspersky stopped more than 30,000 attempts to use the Log4Shell exploit in January
The critical remote code execution vulnerability in Apache's Log4j utility continues to be a popular tactic for cybercriminals. Consider this yet another plea to patch your systems.
🕴 The Looming CISO Mental Health Crisis — and What to Do About It, Part 1 🕴
📖 Read
via "Dark Reading".
The next big threat to corporate security may not be a new strain of malware or innovative attacker tactics, techniques, and processes. It may be our own mental health.📖 Read
via "Dark Reading".
Dark Reading
The Looming CISO Mental Health Crisis — and What to Do About It, Part 1
The next big threat to corporate security may not be a new strain of malware or innovative attacker tactics, techniques, and processes. It may be our own mental health.
‼ CVE-2021-34073 ‼
📖 Read
via "National Vulnerability Database".
A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22294 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45898 ‼
📖 Read
via "National Vulnerability Database".
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45897 ‼
📖 Read
via "National Vulnerability Database".
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40395 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.📖 Read
via "National Vulnerability Database".