🗓️ ‘Fox guarding the henhouse’ – Founder of cyber-fraud prevention company pleads guilty to defrauding investors 🗓️
📖 Read
via "The Daily Swig".
Adam Rogas has been charged with using fraudulent financial data to secure more than $100m in funding📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
‘Fox guarding the henhouse’ – Founder of cyber-fraud prevention company pleads guilty to defrauding investors
Adam Rogas has been charged with using fraudulent financial data to secure more than $100m in funding
📢 Germany advises against using Kaspersky software due to hacking risk 📢
📖 Read
via "ITPro".
The Moscow-headquartered cyber security company has a history of being targeted for its alleged links to the Russian state📖 Read
via "ITPro".
IT PRO
Germany advises against using Kaspersky software due to hacking risk | IT PRO
The Moscow-headquartered cyber security company has a history of being targeted for its alleged links to the Russian state
📢 NortonLifeLock and Avast merger could reduce competition, CMA warns 📢
📖 Read
via "ITPro".
The watchdog will launch a phase two investigation into the merger unless NortonLifeLock and Avast address its concerns within five days📖 Read
via "ITPro".
IT PRO
NortonLifeLock and Avast merger could reduce competition, CMA warns | IT PRO
The watchdog will launch a phase two investigation into the merger unless NortonLifeLock and Avast address its concerns within five days
📢 NSW ditches e-voting system for 2023 election 📢
📖 Read
via "ITPro".
The electoral commissioner has suggested there should be a review of internet voting following the problems with the system found last December📖 Read
via "ITPro".
IT PRO
NSW ditches e-voting system for 2023 election | IT PRO
The electoral commissioner has suggested there should be a review of internet voting following the problems with the system found last December
⚠ CISA warning: “Russian actors bypassed 2FA” – what happened and how to avoid it ⚠
📖 Read
via "Naked Security".
Don't leave old accounts lying around where someone sketchy could reactivate them.📖 Read
via "Naked Security".
Naked Security
CISA warning: “Russian actors bypassed 2FA” – what happened and how to avoid it
Don’t leave old accounts lying around where someone sketchy could reactivate them.
⚠ Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system ⚠
📖 Read
via "Naked Security".
"Install this moneymaking app" - this one is so special that it isn't available on Google Play or the App Store!📖 Read
via "Naked Security".
Naked Security
Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system
“Install this moneymaking app” – this one is so special that it isn’t available on Google Play or the App Store!
⚠ S3 Ep74: Cybercrime busts, Apple patches, Pi Day, and disconnect effects [Podcast] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep74: Cybercrime busts, Apple patches, Pi Day, and disconnect effects [Podcast]
Latest episode – listen now!
🕴 Cut Down on Alert Overload and Leverage Layered Security Measures 🕴
📖 Read
via "Dark Reading".
Feeling overwhelmed by the number of alerts? It doesn't have to be that way.📖 Read
via "Dark Reading".
Dark Reading
Cut Down on Alert Overload and Leverage Layered Security Measures
Feeling overwhelmed by the number of alerts? It doesn't have to be that way.
‼ CVE-2022-24761 ‼
📖 Read
via "National Vulnerability Database".
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits; and Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters. This vulnerability has been patched in Waitress 2.1.1. A workaround is available. When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgrade to the latest version of waitress instead.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23632 ‼
📖 Read
via "National Vulnerability Database".
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2021-44260 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44908 ‼
📖 Read
via "National Vulnerability Database".
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44261 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes firmware version information for the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44262 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information for the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25352 ‼
📖 Read
via "National Vulnerability Database".
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21221 ‼
📖 Read
via "National Vulnerability Database".
The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25760 ‼
📖 Read
via "National Vulnerability Database".
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25296 ‼
📖 Read
via "National Vulnerability Database".
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45793 ‼
📖 Read
via "National Vulnerability Database".
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0748 ‼
📖 Read
via "National Vulnerability Database".
The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44259 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When an unauthorized user accesses this page directly, it connects to this device as a friend of the device owner.📖 Read
via "National Vulnerability Database".