📢 REvil ransomware group's infrastructure comes back online hinting at fresh campaign 📢
📖 Read
via "ITPro".
The ransomware gang's old deep web infrastructure is now redirecting to a new website with new victims📖 Read
via "ITPro".
IT PRO
REvil ransomware group's infrastructure comes back online hinting at fresh campaign | IT PRO
The ransomware gang's old deep web infrastructure is now redirecting to a new website with new victims
📢 The Total Economic Impact™ of Mimecast 📢
📖 Read
via "ITPro".
Cost savings and business benefits enabled by using Mimecast with Microsoft 365📖 Read
via "ITPro".
ITPro
The Total Economic Impact™ of Mimecast
Cost savings and business benefits enabled by using Mimecast with Microsoft 365
📢 FBI warns Rust-based ransomware has breached over 60 organisations 📢
📖 Read
via "ITPro".
The agency has issued an alert warning that the new ransomware has impacted at least 60 global organisations since last November📖 Read
via "ITPro".
IT PRO
FBI warns Rust-based ransomware has breached over 60 organisations | IT PRO
The agency has issued an alert warning that the new ransomware has impacted at least 60 global organisations since last November
📢 BT and Toshiba address QKD concerns with new trial 📢
📖 Read
via "ITPro".
The National Cyber Security Centre (NCSC) previously raised concerns of potential attacks📖 Read
via "ITPro".
IT PRO
BT and Toshiba address QKD concerns with new trial | IT PRO
The National Cyber Security Centre (NCSC) previously raised concerns of potential attacks
📢 Qualcomm and Mediatek flaws left millions of Android users at risk 📢
📖 Read
via "ITPro".
An open source audio codec used by chipset firms is believed to have put two-thirds of Android users' private calls and files at risk📖 Read
via "ITPro".
IT PRO
Qualcomm and Mediatek flaws left millions of Android users at risk | IT PRO
An open source audio codec used by chipset firms is believed to have put two-thirds of Android users' private calls and files at risk
📢 What is the LAPSUS$ group and who is behind the criminal operation? 📢
📖 Read
via "ITPro".
The most prolific cyber criminals of 2022 have largely evaded identification for months despite being anything but secretive in the way they work📖 Read
via "ITPro".
IT PRO
What is the LAPSUS$ group and who is behind the criminal operation? | IT PRO
The most prolific cyber criminals of 2022 have largely evaded identification for months despite being anything but secretive in the way they work
⚠ GitHub issues final report on supply-chain source code intrusions ⚠
📖 Read
via "Naked Security".
Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.📖 Read
via "Naked Security".
Naked Security
GitHub issues final report on supply-chain source code intrusions
Learn how to find out which apps you’ve given access rights to, and how to revoke those rights immediately in an emergency.
‼ CVE-2021-41948 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24900 ‼
📖 Read
via "National Vulnerability Database".
Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28452 ‼
📖 Read
via "National Vulnerability Database".
Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.📖 Read
via "National Vulnerability Database".
🔏 Friday Five 4/29 🔏
📖 Read
via "".
Russia gets a taste of its own medicine, K-12 schools feeling the brunt of cyberattacks, and much more—catch up on these stories and more in this week’s Friday Five!📖 Read
via "".
👍1
‼ CVE-2022-29935 ‼
📖 Read
via "National Vulnerability Database".
USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43937 ‼
📖 Read
via "National Vulnerability Database".
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29937 ‼
📖 Read
via "National Vulnerability Database".
USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28994 ‼
📖 Read
via "National Vulnerability Database".
Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-1249 ‼
📖 Read
via "National Vulnerability Database".
A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29451 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-1195 ‼
📖 Read
via "National Vulnerability Database".
A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-4207 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0984 ‼
📖 Read
via "National Vulnerability Database".
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29856 ‼
📖 Read
via "National Vulnerability Database".
A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.📖 Read
via "National Vulnerability Database".