‼ CVE-2022-29248 ‼
📖 Read
via "National Vulnerability Database".
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.📖 Read
via "National Vulnerability Database".
🔏 Insider Threats Responsible for 68% of UK Legal Sector Data Breaches 🔏
📖 Read
via "".
Data analyzed this week highlights the percentage of data breaches carried out by insiders at law firms in the U.K.📖 Read
via "".
🕴 Is Your Data Security Living on the Edge? 🕴
📖 Read
via "Dark Reading".
Gartner's security service edge fundamentally changes how companies should be delivering data protection in a cloud and mobile first world.📖 Read
via "Dark Reading".
Dark Reading
Is Your Data Security Living on the Edge?
Gartner's security service edge fundamentally changes how companies should be delivering data protection in a cloud and mobile first world.
🕴 Forescout Launches Forescout Frontline to Help Organizations Tackle Ransomware and Real Time Threats 🕴
📖 Read
via "Dark Reading".
New threat hunting and risk identification service provides organizations with an enterprise-wide baseline of their threat landscape and risk exposure.📖 Read
via "Dark Reading".
Dark Reading
Forescout Launches Forescout Frontline to Help Organizations Tackle Ransomware and Real Time Threats
New threat hunting and risk identification service provides organizations with an enterprise-wide baseline of their threat landscape and risk exposure.
‼ CVE-2022-29256 ‼
📖 Read
via "National Vulnerability Database".
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` environment variable in a build environment then they might be able to use this to inject an arbitrary command at `npm install` time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31651 ‼
📖 Read
via "National Vulnerability Database".
In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-31650 ‼
📖 Read
via "National Vulnerability Database".
In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.📖 Read
via "National Vulnerability Database".
📢 Open source packages with millions of installs hacked to harvest AWS credentials 📢
📖 Read
via "ITPro".
Two popular open source packages used by Python and PHP developers have been quietly compromised with successful attacks already being reported📖 Read
via "ITPro".
IT PRO
Open source packages with millions of installs hacked to harvest AWS credentials | IT PRO
Two popular open source packages used by Python and PHP developers have been quietly compromised with successful attacks already being reported
📢 DOE funds development of Qunnect's Quantum Repeater 📢
📖 Read
via "ITPro".
The $1.85 million grant will eventually pave the way for quantum internet📖 Read
via "ITPro".
IT PRO
DOE funds development of Qunnect's Quantum Repeater | IT PRO
The $1.85 million grant will eventually pave the way for quantum internet
❌ Cybergang Claims REvil is Back, Executes DDoS Attacks ❌
📖 Read
via "Threat Post".
Actors claiming to be the defunct ransomware group are targeting one of Akami’s customers with a Layer 7 attack, demanding an extortion payment in Bitcoin.📖 Read
via "Threat Post".
Threat Post
Cybergang Claims REvil is Back, Executes DDoS Attacks
Actors claiming to be the defunct ransomware group are targeting one of Akami’s customers with a Layer 7 attack, demanding an extortion payment in Bitcoin.
⚠ Poisoned Python and PHP packages purloin passwords for AWS access ⚠
📖 Read
via "Naked Security".
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
‼ CVE-2021-42692 ‼
📖 Read
via "National Vulnerability Database".
There is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS.📖 Read
via "National Vulnerability Database".
🕴 Most Common Threats in DBIR 🕴
📖 Read
via "Dark Reading".
Supply chain and ransomware attacks increased dramatically this year, which explains why so many data breaches in this year's DBIR were grouped as system intrusion.📖 Read
via "Dark Reading".
Dark Reading
Most Common Threats in DBIR
Supply chain and ransomware attacks increased dramatically in 2021, which explains why so many data breaches in Verizon's "2022 Data Breach Investigations Report" were grouped as system intrusion.
⚠ Who’s watching your webcam? The Screencastify Chrome extension story… ⚠
📖 Read
via "Naked Security".
When you really need to make exceptions in cybersecurity, specify them as explicitly as you can.📖 Read
via "Naked Security".
Naked Security
Who’s watching your webcam? The Screencastify Chrome extension story…
When you really need to make exceptions in cybersecurity, specify them as explicitly as you can.
‼ CVE-2022-29720 ‼
📖 Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40317 ‼
📖 Read
via "National Vulnerability Database".
Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42859 ‼
📖 Read
via "National Vulnerability Database".
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-29721 ‼
📖 Read
via "National Vulnerability Database".
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42860 ‼
📖 Read
via "National Vulnerability Database".
A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611.📖 Read
via "National Vulnerability Database".
🗓️ Canadian healthcare provider issues data breach warning after server hack 🗓️
📖 Read
via "The Daily Swig".
SHN plays down concerns over medical records breach📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Canadian healthcare provider issues data breach warning after server hack
SHN plays down concerns over medical records breach
🕴 Big Cyber Hits on GM, Chicago Public Schools, & Zola Showcase the Password Problem 🕴
📖 Read
via "Dark Reading".
Credential-stuffing attacks against online accounts are still popular, and they work thanks to continuing password reuse.📖 Read
via "Dark Reading".
Dark Reading
Big Cyber Hits on GM, Chicago Public Schools, & Zola Showcase the Password Problem
Credential-stuffing attacks against online accounts are still popular, and they work thanks to continuing password reuse.