⚠ What’s the best approach to patching vulnerabilities? ⚠
📖 Read
via "Naked Security".
Researchers ask: with only 1 in 20 vulnerabilities exploited, what's the best approach to patching?📖 Read
via "Naked Security".
Naked Security
What’s the best approach to patching vulnerabilities?
Researchers ask: with only 1 in 20 vulnerabilities exploited, what’s the best approach to patching?
⚠ Action required! Exim mail servers need urgent patching ⚠
📖 Read
via "Naked Security".
Researchers have discovered another dangerous security hole hiding in recent, unpatched versions of the internet’s most popular mail server, Exim.📖 Read
via "Naked Security".
Naked Security
Action required! Exim mail servers need urgent patching
Researchers have discovered another dangerous security hole hiding in recent, unpatched versions of the internet’s most popular mail server, Exim.
🔏 Friday Five: 6/7 Edition 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
The latest trade secret case, a more strict privacy bill for New York State, and the European Data Protection Supervisor's warning - catch up on the week's news with this recap!📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
Friday Five: 6/7 Edition
The latest trade secret case, a more strict privacy bill for New York State, and the European Data Protection Supervisor's warning - catch up on the week's news with this recap!
🕴 Learn the Latest Hacking Techniques at Black Hat Trainings Virginia 🕴
📖 Read
via "Dark Reading: ".
At Black Hat's upcoming Trainings-only October event you'll have opportunities to get up to speed on the newest hacking tricks for operating systems and cloud providers.📖 Read
via "Dark Reading: ".
Dark Reading
Learn the Latest Hacking Techniques at Black Hat Trainings Virginia
At Black Hat's upcoming Trainings-only October event you'll have opportunities to get up to speed on the newest hacking tricks for operating systems and cloud providers.
❌ Troy Hunt: ‘Messy’ Password Problem Isn’t Getting Better ❌
📖 Read
via "Threatpost".
Poor password hygiene continues to plague the security industry, Troy Hunt said during Infosecurity Europe.📖 Read
via "Threatpost".
Threat Post
Troy Hunt: ‘Messy’ Password Problem Isn’t Getting Better
Poor password hygiene continues to plague the security industry, Troy Hunt said during Infosecurity Europe.
❌ Threatlist: Targeted Espionage-as-a-Service Takes Hold on the Dark Web ❌
📖 Read
via "Threatpost".
One in four underground merchants offer advanced hacking services, once reserved for APTs and well-funded organized crime gangs.📖 Read
via "Threatpost".
Threat Post
Threatlist: Targeted Espionage-as-a-Service Takes Hold on the Dark Web
One in four underground merchants offer advanced hacking services, once reserved for APTs and well-funded organized crime gangs.
🕴 End User Lockdown: Dark Reading Caption Contest Winners 🕴
📖 Read
via "Dark Reading: ".
Phishing, cybersecurity training, biometrics and casual Fridays. And the winners are ...📖 Read
via "Dark Reading: ".
Dark Reading
End User Lockdown: Dark Reading Caption Contest Winners
Phishing, cybersecurity training, biometrics and casual Fridays. And the winners are ...
❌ News Wrap: Infosecurity Europe Highlights and BlueKeep Anxiety ❌
📖 Read
via "Threatpost".
The Threatpost editors discuss the highlights from Infosecurity Europe, which took place in London this week.📖 Read
via "Threatpost".
Threat Post
News Wrap: Infosecurity Europe Highlights and BlueKeep Anxiety
The Threatpost editors discuss the highlights from Infosecurity Europe, which took place in London this week.
🔐 Autonomous versus automated: What each means and why it matters 🔐
📖 Read
via "Security on TechRepublic".
The terms autonomous and automated often get mixed up. When designing security strategies, knowing the distinctions between the two has its perks.📖 Read
via "Security on TechRepublic".
TechRepublic
Autonomous versus automated: What each means and why it matters
The terms autonomous and automated often get mixed up. When designing security strategies, knowing the distinctions between the two has its perks.
❌ SandboxEscaper Debuts ByeBear Windows Patch Bypass ❌
📖 Read
via "Threatpost".
SandboxEscaper is back, with a second bypass for the recent CVE-2019-0841 Windows patch.📖 Read
via "Threatpost".
Threat Post
SandboxEscaper Debuts ByeBear Windows Patch Bypass
SandboxEscaper is back, with a second bypass for the recent CVE-2019-0841 Windows patch.
❌ Forget BlueKeep: Beware the GoldBrute ❌
📖 Read
via "Threatpost".
A botnet has appeared that has attempted to brute-force 1.5 million RDP connections to Windows systems in the last few days — and counting.📖 Read
via "Threatpost".
Threat Post
Forget BlueKeep: Beware the GoldBrute
A botnet has appeared that has attempted to brute-force 1.5 million RDP connections to Windows systems in the last few days — and counting.
ATENTION‼ New - CVE-2018-6185
📖 Read
via "National Vulnerability Database".
In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of an encryption zone key and network access to the Key Trustee KMS to make those calls against known encryption zone keys. This can result in the recovery of a previously deleted, but not purged, key (undelete) or the deletion of a key in active use (purge) resulting in loss of access to encrypted HDFS data.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-5798
📖 Read
via "National Vulnerability Database".
This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-5265
📖 Read
via "National Vulnerability Database".
Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-20135
📖 Read
via "National Vulnerability Database".
Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a man-in-the-middle attack. An attacker may trick Galaxy Apps into using an arbitrary hostname for which the attacker can provide a valid SSL certificate, and emulate the API of the app store to modify existing apps at installation time. The specific flaw involves an HTTP method to obtain the load-balanced hostname that enforces SSL only after obtaining a hostname from the load balancer, and a missing app signature validation in the application XML. An attacker can exploit this vulnerability to achieve Remote Code Execution on the device. The Samsung ID is SVE-2018-12071.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-20091
📖 Read
via "National Vulnerability Database".
An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords (in the case of local authentication), API keys, and stored Kerberos keytabs.📖 Read
via "National Vulnerability Database".
🕴 Massive Changes to Tech and Platforms, But Cybercrime? Not So Much 🕴
📖 Read
via "Dark Reading: ".
The still-relevant recommendation is to invest more in law enforcement, concludes an economic study of cybercrime.📖 Read
via "Dark Reading: ".
Darkreading
Massive Changes to Tech and Platforms, But Cybercrime? Not So Much
The still-relevant recommendation is to invest more in law enforcement, concludes an economic study of cybercrime.
ATENTION‼ New - CVE-2018-20014
📖 Read
via "National Vulnerability Database".
In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFileHashAndMetadata NULL pointer dereference, leading to shutting down the client application.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-19999
📖 Read
via "National Vulnerability Database".
The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-19860
📖 Read
via "National Vulnerability Database".
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-19802
📖 Read
via "National Vulnerability Database".
aubio v0.4.0 to v0.4.8 has a Buffer Overflow (issue 2 of 3).📖 Read
via "National Vulnerability Database".