❌ Critical Flaws in Amcrest HDSeries Camera Allow Complete Takeover ❌
📖 Read
via "Threatpost".
Time's up on public disclosure of six serious bugs impacting the vendor’s IPM-721S model security camera.📖 Read
via "Threatpost".
Threat Post
Critical Flaws in Amcrest HDSeries Camera Allow Complete Takeover
Time's up on public disclosure of six serious bugs impacting the vendor’s IPM-721S model security camera.
🕴 Dark Web Becomes a Haven for Targeted Hits 🕴
📖 Read
via "Dark Reading: ".
Malware on the Dark Web is increasingly being customized to target specific organizations and executives.📖 Read
via "Dark Reading: ".
Darkreading
Dark Web Becomes a Haven for Targeted Hits
Malware on the Dark Web is increasingly being customized to target specific organizations and executives.
ATENTION‼ New - CVE-2018-10703
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10702
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10701
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10700
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10699
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_privatePass" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10698
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10697
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10696
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her knowledge, as demonstrated by the forms/iw_webSetParameters and forms/webSetMainRestart URIs.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10695
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However, the same functionality allows an attacker to execute commands on the device. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10694
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10693
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10692
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10691
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2018-10690
📖 Read
via "National Vulnerability Database".
An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials.📖 Read
via "National Vulnerability Database".
🔐 Seriously, stop using qwerty as a password--enlist these password strategies instead 🔐
📖 Read
via "Security on TechRepublic".
Users understand that their passwords or security protocols are weak, but they may not understand the consequences until it's too late.📖 Read
via "Security on TechRepublic".
TechRepublic
Seriously, stop using qwerty as a password--enlist these password strategies instead
Users understand that their passwords or security protocols are weak, but they may not understand the consequences until it's too late.
⚠ Monday review – the hot 21 stories of the week ⚠
📖 Read
via "Naked Security".
From the vulnerable Windows RDS 'feature' to the privacy of US visa applicants - and everything in between. It's weekly roundup time.📖 Read
via "Naked Security".
Naked Security
Monday review – the hot 21 stories of the week
From the vulnerable Windows RDS ‘feature’ to the privacy of US visa applicants – and everything in between. It’s weekly roundup time.
⚠ Online shops fear 2FA at checkout will increase abandoned carts ⚠
📖 Read
via "Naked Security".
A report says the EU will lose $64b per year once new 2FA rules go into effect, but we support Strong Customer Authentication (SCA) wholeheartedly.📖 Read
via "Naked Security".
Naked Security
Online shops fear 2FA at checkout will increase abandoned carts
A report says the EU will lose $64b per year once new 2FA rules go into effect, but we support Strong Customer Authentication (SCA) wholeheartedly.
⚠ Laptops used in 2016 NC poll to be examined by Feds – after 2.5 years ⚠
📖 Read
via "Naked Security".
The e-voting vendor in North Carolina was spearphished days before the election but still went ahead and used remote access software.📖 Read
via "Naked Security".
Naked Security
Laptops used in 2016 NC poll to be examined by feds – after 2.5 years
The e-voting vendor in North Carolina was spearphished days before the election but still went ahead and used remote access software.
⚠ Cryptocurrency attack thwarted by npm team ⚠
📖 Read
via "Naked Security".
Cryptocurrency users narrowly escaped losing all their funds last week after an attacker poisoned a digital wallet with malicious code that stole their blockchain access details.📖 Read
via "Naked Security".
Naked Security
Cryptocurrency attack thwarted by npm team
Cryptocurrency users narrowly escaped losing all their funds last week after an attacker poisoned a digital wallet with malicious code that stole their blockchain access details.