‼ CVE-2022-0305 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25050 ‼
📖 Read
via "National Vulnerability Database".
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0569 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in Packagist snipe/snipe-it prior to v5.3.9.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24110 ‼
📖 Read
via "National Vulnerability Database".
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.📖 Read
via "National Vulnerability Database".
🗓️ New Zealand government mandates bug reporting process for federal agencies 🗓️
📖 Read
via "The Daily Swig".
Researchers can report vulnerabilities on a ‘no blame’ basis📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
New Zealand government mandates bug reporting process for federal agencies
Researchers can report vulnerabilities on a ‘no blame’ basis
🕴 Ransomware Threat Intel: You're Soaking In It! 🕴
📖 Read
via "Dark Reading".
Organizations need to improve their ability to detect and prevent emerging ransomware attacks.📖 Read
via "Dark Reading".
Dark Reading
Ransomware Threat Intel: You're Soaking In It!
Organizations need to improve their ability to detect and prevent emerging ransomware attacks.
⚠ Power company pays out $3 trillion compensation to astonished customer ⚠
📖 Read
via "Naked Security".
More money than the UK's economy produces in a year!📖 Read
via "Naked Security".
Naked Security
Power company pays out $3 trillion compensation to astonished customer
More money than the UK’s economy produces in a year!
🕴 Could Biology Hold the Clue to Better Cybersecurity? 🕴
📖 Read
via "Dark Reading".
Sophisticated malware attacks underscore the need for a more dynamic security framework, inspired by biological concepts.📖 Read
via "Dark Reading".
Dark Reading
Could Biology Hold the Clue to Better Cybersecurity?
Sophisticated malware attacks underscore the need for a more dynamic security framework, inspired by biological concepts.
‼ CVE-2021-45420 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45421 ‼
📖 Read
via "National Vulnerability Database".
** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24686 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6📖 Read
via "National Vulnerability Database".
🕴 (ISC)² to Pilot Online Proctored Exams for CISSP in U.S., U.K. and Singapore 🕴
📖 Read
via "Dark Reading".
Second pilot program will assess feasibility and security of offering online exams to increase global accessibility for certification candidates.📖 Read
via "Dark Reading".
Dark Reading
(ISC)² to Pilot Online Proctored Exams for CISSP in U.S., U.K. and Singapore
Second pilot program will assess feasibility and security of offering online exams to increase global accessibility for certification candidates.
🕴 LogRhythm Unveils New Brand Identity 🕴
📖 Read
via "Dark Reading".
Announcement comes in advance of new technology offerings in 2022.📖 Read
via "Dark Reading".
Dark Reading
LogRhythm Unveils New Brand Identity
Announcement comes in advance of new technology offerings in 2022.
🕴 One Identity Enhances Unified Identity Security Platform with CIEM, Application Governance and Teams Modules 🕴
📖 Read
via "Dark Reading".
Plans to further advance vision for end-to-end identity security.📖 Read
via "Dark Reading".
Dark Reading
One Identity Enhances Unified Identity Security Platform with CIEM, Application Governance and Teams Modules
Plans to further advance vision for end-to-end identity security.
🗓️ Missouri prosecutor declines to file charges over ‘hacker’ allegation against reporter 🗓️
📖 Read
via "The Daily Swig".
Relief as controversial charges dropped tempered by fears about chilling effect📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Missouri prosecutor declines to file charges over ‘hacker’ allegation against reporter
Relief as controversial charges dropped tempered by fears about chilling effect
❌ Adobe: Zero-Day Magento 2 RCE Bug Under Active Attack ❌
📖 Read
via "Threat Post".
The vendor issued an emergency fix on Sunday, and eCommerce websites should update ASAP to avoid Magecart card-skimming attacks and other problems.📖 Read
via "Threat Post".
Threat Post
Adobe: Zero-Day Magento 2 RCE Bug Under Active Attack
The vendor issued an emergency fix on Sunday, and eCommerce websites should update ASAP to avoid Magecart card-skimming attacks and other problems.
‼ CVE-2021-46371 ‼
📖 Read
via "National Vulnerability Database".
antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensitive information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0512 ‼
📖 Read
via "National Vulnerability Database".
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.📖 Read
via "National Vulnerability Database".
❌ ‘Cities: Skylines’ Gaming Modder Banned Over Hidden Malware ❌
📖 Read
via "Threat Post".
35K+ players were exposed to an auto-updater that planted a trojan that choked performance for fellow modders and Colossal Order employees.📖 Read
via "Threat Post".
Threat Post
‘Cities: Skylines’ Gaming Modder Banned Over Hidden Malware
35K+ players were exposed to an auto-updater that planted a trojan that choked performance for fellow modders and Colossal Order employees.
♟️ Wazawaka Goes Waka Waka ♟️
📖 Read
via "Krebs on Security".
In January, KrebsOnSecurity examined clues left behind by "Wazawaka," the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since "lost his mind" according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance, and publishing bizarre selfie videos taunting security researchers and journalists. In last month's story, we explored clues that led from Wazawaka's multitude of monikers, email addresses, and passwords to a 30-something father in Abakan, Russia named Mikhail Pavlovich Matveev. This post concerns itself with the other half of Wazawaka's identities not mentioned in the first story, such as how Wazawaka also ran the Babuk ransomware affiliate program, and later became "Orange," the founder of the ransomware-focused Dark Web forum known as "RAMP."📖 Read
via "Krebs on Security".
Krebs on Security
Wazawaka Goes Waka Waka
In January, KrebsOnSecurity examined clues left behind by "Wazawaka," the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since "lost his mind" according to his erstwhile colleagues, creating a Twitter…
‼ CVE-2022-22854 ‼
📖 Read
via "National Vulnerability Database".
An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing and editing the user list.📖 Read
via "National Vulnerability Database".