♟️ Russian Govt. Continues Carding Shop Crackdown ♟️
📖 Read
via "Krebs on Security".
Russian authorities have arrested six men accused of operating some of the most active online bazaars for selling stolen payment card data. The crackdown -- the second closure of major card fraud shops by Russian authorities in as many weeks -- comes closely behind Russia's arrest of 14 alleged affiliates of the REvil ransomware gang, and has many in the cybercrime underground asking who might be next.📖 Read
via "Krebs on Security".
Krebs on Security
Russian Govt. Continues Carding Shop Crackdown
Russian authorities have arrested six men accused of operating some of the most active online bazaars for selling stolen payment card data. The crackdown -- the second closure of major card fraud shops by Russian authorities in as many weeks…
❌ PHP Everywhere Bugs Put 30K+ WordPress Sites at Risk of RCE ❌
📖 Read
via "Threat Post".
The plug-in’s default settings spawned flaws that could allow for full site takeover but have since been fixed in an update that users should immediately install, Wordfence researchers said.📖 Read
via "Threat Post".
Threat Post
PHP Everywhere Bugs Put 30K+ WordPress Sites at Risk of RCE
The plug-in’s default settings spawned flaws that could allow for full site takeover but have since been fixed in an update that users should immediately install, Wordfence researchers said.
‼ CVE-2021-45901 ‼
📖 Read
via "National Vulnerability Database".
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.📖 Read
via "National Vulnerability Database".
🕴 Bot Marketplaces as a Source of Future Data Breaches 🕴
📖 Read
via "Dark Reading".
Of the four bot marketplaces Cognyte analyzed, the Russian Market is the most dominant, but the others are all active, updated daily, and well-known, too.📖 Read
via "Dark Reading".
Dark Reading
Bot Marketplaces as a Source of Future Data Breaches
Of the four bot marketplaces Cognyte analyzed, the Russian Market is the most dominant, but the others are all active, updated daily, and well-known, too.
🕴 Data Transparency Hasn't Made Us Safer Yet. Can It Uncover Breach Causality? 🕴
📖 Read
via "Dark Reading".
Advanced machine learning models within an XDR framework could uncover what actually causes breaches, but first we need better data transparency.📖 Read
via "Dark Reading".
Dark Reading
Data Transparency Hasn't Made Us Safer Yet. Can It Uncover Breach Causality?
Advanced machine learning models within an XDR framework could uncover what actually causes breaches, but first we need better data transparency.
❌ SAP to Give Threat Briefing on Uber-Severe ‘ICMAD’ Bugs ❌
📖 Read
via "Threat Post".
SAP’s Patch Tuesday brought fixes for a trio of flaws in the ubiquitous ICM component in internet-exposed apps. One of them, with a risk score of 10, could allow attackers to hijack identities, steal data and more.📖 Read
via "Threat Post".
Threat Post
SAP to Give Threat Briefing on Uber-Severe ‘ICMAD’ Bugs
SAP’s Patch Tuesday brought fixes for a trio of flaws in the ubiquitous ICM component in internet-exposed apps. One of them, with a risk score of 10, could allow attackers to hijack identities, steal data and more.
🛠 nfstream 6.4.1 🛠
📖 Read
via "Packet Storm Security".
nfstream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments.📖 Read
via "Packet Storm Security".
Packetstormsecurity
nfstream 6.4.1 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2022-24111 ‼
📖 Read
via "National Vulnerability Database".
In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels can be viewed without requiring a login if the URL to these portfolios is known.📖 Read
via "National Vulnerability Database".
🗓️ Ransomware surge prompts joint NCSC, CISA warning to safeguard systems 🗓️
📖 Read
via "The Daily Swig".
Weekend attacks and assaults on the software supply chain mark evolving TTPs📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Ransomware surge prompts joint NCSC, CISA warning to safeguard systems
Weekend attacks and assaults on the software supply chain mark evolving TTPs
🕴 Titaniam Secures $6 Million in Seed Funding 🕴
📖 Read
via "Dark Reading".
Funding round led by Refinery Ventures, with participation from Fusion Fund and Shasta Ventures.📖 Read
via "Dark Reading".
Dark Reading
Titaniam Secures $6 Million in Seed Funding
Funding round led by Refinery Ventures, with participation from Fusion Fund and Shasta Ventures.
🕴 Allure Security Raises $6.8 Million Seed Funding Round 🕴
📖 Read
via "Dark Reading".
Funding led by Gutbrain Ventures.📖 Read
via "Dark Reading".
Dark Reading
Allure Security Raises $6.8 Million Seed Funding Round
Funding led by Gutbrain Ventures.
‼ CVE-2022-20701 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0017 ‼
📖 Read
via "National Vulnerability Database".
An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows. GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.5 on Windows. This issue does not affect GlobalProtect app on other platforms.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0019 ‼
📖 Read
via "National Vulnerability Database".
An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of GlobalProtect users that saved their password during previous GlobalProtect app sessions to other local users on the system. The exposed credentials enable a local attacker to authenticate to the GlobalProtect portal or gateway as the target user without knowing of the target user’s plaintext password. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Linux. GlobalProtect app 5.2 versions earlier than and including GlobalProtect app 5.2.7 on Linux. GlobalProtect app 5.3 versions earlier than GlobalProtect app 5.3.2 on Linux. This issue does not affect the GlobalProtect app on other platforms.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-20707 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3398 ‼
📖 Read
via "National Vulnerability Database".
Stormshield Network Security (SNS) 3.x has an Integer Overflow in the high-availability component.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20709 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20708 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20699 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0021 ‼
📖 Read
via "National Vulnerability Database".
An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows. This issue does not affect the GlobalProtect app on other platforms.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0020 ‼
📖 Read
via "National Vulnerability Database".
A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.📖 Read
via "National Vulnerability Database".