🗓️ Legitimate hacking activities under UK law proposed by ‘expert consensus’ 🗓️
📖 Read
via "The Daily Swig".
Contentious edge case activities are no excuse for further delaying of ‘much overdue’ reform, say campaigners📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Legitimate hacking activities under UK law proposed by ‘expert consensus’
Contentious edge case activities are no excuse for further delaying of ‘much overdue’ reform, say campaigners
🕴 With Plunge in Value, Cryptocurrency Crimes Decline in 2022 🕴
📖 Read
via "Dark Reading".
Cybercrime has been funded with cryptocurrency, but the valuation of various digital currencies has dropped by more than two-thirds and cybercriminals are feeling the pinch.📖 Read
via "Dark Reading".
Dark Reading
With Plunge in Value, Cryptocurrency Crimes Decline in 2022
Cybercrime has been funded with cryptocurrency, but the valuation of various digital currencies has dropped by more than two-thirds and cybercriminals are feeling the pinch.
👏1
‼ CVE-2022-38362 ‼
📖 Read
via "National Vulnerability Database".
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.📖 Read
via "National Vulnerability Database".
⚠ Zoom for Mac patches get-root bug – update now! ⚠
📖 Read
via "Naked Security".
There's many a slip 'twixt the cup and the lip. Or at least between the TOC and the TOU...📖 Read
via "Naked Security".
Naked Security
Zoom for Mac patches critical bug – update now!
There’s many a slip ‘twixt the cup and the lip. Or at least between the TOC and the TOU…
⚠ US offers reward “up to $10 million” for information about the Conti gang ⚠
📖 Read
via "Naked Security".
Wanted - Reward Offered - Five unknown individuals (plus a man with a weird hat)📖 Read
via "Naked Security".
Naked Security
US offers reward “up to $10 million” for information about the Conti gang
Wanted – Reward Offered – Five unknown individuals (plus a man with a weird hat)
♟️ When Efforts to Contain a Data Breach Backfire ♟️
📖 Read
via "Krebs on Security".
Earlier this month, the administrator of the cybercrime forum Breached received a cease-and-desist letter from a cybersecurity firm. The missive alleged that an auction on the site for data stolen from 10 million customers of Mexico’s second-largest bank was fake news and harming the bank’s reputation. The administrator responded to this empty threat by purchasing the stolen banking data and leaking it on the forum for everyone to download.📖 Read
via "Krebs on Security".
Krebs on Security
When Efforts to Contain a Data Breach Backfire
Earlier this month, the administrator of the cybercrime forum Breached received a cease-and-desist letter from a cybersecurity firm. The missive alleged that an auction on the site for data stolen from 10 million customers of Mexico’s second-largest bank…
🕴 Name That Toon: Vicious Circle 🕴
📖 Read
via "Dark Reading".
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.📖 Read
via "Dark Reading".
Dark Reading
Name That Toon: Vicious Circle
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.
‼ CVE-2022-38192 ‼
📖 Read
via "National Vulnerability Database".
A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38193 ‼
📖 Read
via "National Vulnerability Database".
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution in a victims browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38194 ‼
📖 Read
via "National Vulnerability Database".
In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.📖 Read
via "National Vulnerability Database".
🕴 Clop Ransomware Gang Breaches Water Utility, Just Not the Right One 🕴
📖 Read
via "Dark Reading".
South Staffordshire in the UK has acknowledged it was targeted in a cyberattack, but Clop ransomware appears to be shaking down the wrong water company.📖 Read
via "Dark Reading".
Dark Reading
Clop Ransomware Gang Breaches Water Utility, Just Not the Right One
South Staffordshire in the UK has acknowledged it was targeted in a cyberattack, but Clop ransomware appears to be shaking down the wrong water company.
🕴 Microsoft Disrupts Russian Group's Multiyear Cyber-Espionage Campaign 🕴
📖 Read
via "Dark Reading".
"Seaborgium" is a highly persistent threat actor that has been targeting organizations and individuals of likely interest to the Russian government since at least 2017, company says.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Disrupts Russian Group's Multiyear Cyber-Espionage Campaign
"Seaborgium" is a highly persistent threat actor that has been targeting organizations and individuals of likely interest to the Russian government since at least 2017, company says.
‼ CVE-2022-2844 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39085 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39086 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 215889.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2846 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic was found in Calendar Event Multi View Plugin. This vulnerability affects unknown code of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The identifier of this vulnerability is VDB-206488.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38189 ‼
📖 Read
via "National Vulnerability Database".
A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39087 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to obtain sensitive information due to improper permission controls. IBM X-Force ID: 216109.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39035 ‼
📖 Read
via "National Vulnerability Database".
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213965.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38184 ‼
📖 Read
via "National Vulnerability Database".
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2843 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument post_title with the input <img src=x onerror=alert`2`> leads to cross site scripting. The attack may be launched remotely. VDB-206486 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".