ATENTION‼ New - CVE-2017-18378
📖 Read
via "National Vulnerability Database".
In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_dir, leading to upgrade_handle.php?cmd=writeuploaddir remote command execution.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-18377
📖 Read
via "National Vulnerability Database".
An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a set_ftp.cgi?svr=192.168.1.1&port=21&user=ftp URI.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2016-10760
📖 Read
via "National Vulnerability Database".
On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2013-7471
📖 Read
via "National Vulnerability Database".
An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2010-5330
📖 Read
via "National Vulnerability Database".
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2009-5157
📖 Read
via "National Vulnerability Database".
On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2009-5156
📖 Read
via "National Vulnerability Database".
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string.📖 Read
via "National Vulnerability Database".
🕴 Cross-Site Scripting Errors Continue to Be Most Common Web App Flaw 🕴
📖 Read
via "Dark Reading: ".
In vulnerability disclosure programs, organizations are paying more in total for XSS issues than any other vulnerability type, HackerOne says.📖 Read
via "Dark Reading: ".
Dark Reading
Cross-Site Scripting Errors Continue to Be Most Common Web App Flaw
In vulnerability disclosure programs, organizations are paying more in total for XSS issues than any other vulnerability type, HackerOne says.
🕴 Suppliers Spotlighted After Breach of Border Agency Subcontractor 🕴
📖 Read
via "Dark Reading: ".
Attackers increasingly use third-party service providers to bypass organizations' security. The theft of images from US Customs and Border Protection underscores the weakness suppliers can create.📖 Read
via "Dark Reading: ".
Dark Reading
Cyberattacks & Data Breaches recent news | Dark Reading
Explore the latest news and expert commentary on Cyberattacks & Data Breaches, brought to you by the editors of Dark Reading
⚠ Hackers stole photos of travelers and license plates from subcontractor ⚠
📖 Read
via "Naked Security".
Critics say if the US can't protect such data - which was improperly stored by a subcontractor - it shouldn't collect it.📖 Read
via "Naked Security".
Naked Security
Hackers stole photos of travelers and license plates from subcontractor
Critics say if the US can’t protect such data – which was improperly stored by a subcontractor – it shouldn’t collect it.
⚠ Radiohead releases ‘OK Computer’ sessions that hacker tried to ransom ⚠
📖 Read
via "Naked Security".
The band shrugged off the threat and released the files on Bandcamp. They're long and not very interesting, they said.📖 Read
via "Naked Security".
Naked Security
Radiohead releases ‘OK Computer’ sessions that hacker tried to ransom
The band shrugged off the threat and released the files on Bandcamp. They’re long and not very interesting, they said.
⚠ FBI warns users to be wary of phishing sites abusing HTTPS ⚠
📖 Read
via "Naked Security".
Why you shouldn't trust a website simply because it's secured using HTTPS and backed by the green padlock symbol.📖 Read
via "Naked Security".
Naked Security
FBI warns users to be wary of phishing sites abusing HTTPS
Why you shouldn’t trust a website simply because it’s secured using HTTPS and backed by the green padlock symbol.
❌ Full Insight into the Internal Environment with Cynet Free Visibility ❌
📖 Read
via "Threatpost".
The Cynet 360 platform Free Visibility Offering is focused on IT and security professionals who know a lack of visibility is a main challenge in their daily responsibilities as end-users and service providers. 📖 Read
via "Threatpost".
Threat Post
Full Insight into the Internal Environment with Cynet Free Visibility
The Cynet 360 platform Free Visibility Offering is focused on IT and security professionals who know a lack of visibility is a main challenge in their daily responsibilities as end-users and service providers.
❌ Full Insight into the Internal Environment with Cynet Free Visibility ❌
📖 Read
via "Threatpost".
The Cynet 360 platform Free Visibility Offering is focused on IT and security professionals who know a lack of visibility is a main challenge in their daily responsibilities as end-users and service providers. 📖 Read
via "Threatpost".
Threat Post
Full Insight into the Internal Environment with Cynet Free Visibility
The Cynet 360 platform Free Visibility Offering is focused on IT and security professionals who know a lack of visibility is a main challenge in their daily responsibilities as end-users and service providers.
❌ New FormBook Dropper Harbors Obfuscation, Persistence ❌
📖 Read
via "Threatpost".
Never-before-seen dropper found in FormBook samples that has increased persistence and obfuscation capabilities.📖 Read
via "Threatpost".
Threat Post
New FormBook Dropper Harbors Obfuscation, Persistence
Never-before-seen dropper found in FormBook samples that has increased persistence and obfuscation capabilities.
🔐 84% of US employees have never heard of GDPR 🔐
📖 Read
via "Security on TechRepublic".
A survey of corporate employees by insider threat management company ObserveIT reveals a greater understanding of privacy laws in the UK than in the US.📖 Read
via "Security on TechRepublic".
TechRepublic
84% of US employees have never heard of GDPR
A survey of corporate employees by insider threat management company ObserveIT reveals a greater understanding of privacy laws in the UK than in the US.
🔐 Evernote Chrome extension vulnerability allowed attackers to steal 4.7M users' data 🔐
📖 Read
via "Security on TechRepublic".
A cross-site scripting vulnerability was discovered popular note-taking application Evernote, though the company patched it in under a week.📖 Read
via "Security on TechRepublic".
TechRepublic
Evernote Chrome extension vulnerability allowed attackers to steal 4.6M users' data
A cross-site scripting vulnerability was discovered popular note-taking application Evernote, though the company patched it in under a week.
❌ Intel NUC Firmware Open to Privilege Escalation, DoS and Information Disclosure ❌
📖 Read
via "Threatpost".
Intel has patched seven high-severity vulnerabilities in its mini PC NUC kit firmware.📖 Read
via "Threatpost".
Threat Post
Intel NUC Firmware Open to Privilege Escalation, DoS and Information Disclosure
Intel has patched seven high-severity vulnerabilities in its mini PC NUC kit firmware.
🕴 Predicting Vulnerability Weaponization 🕴
📖 Read
via "Dark Reading: ".
Advances in data science are making it possible to shift vulnerability management from a reactive to a proactive discipline.📖 Read
via "Dark Reading: ".
Darkreading
Predicting Vulnerability Weaponization
Advances in data science are making it possible to shift vulnerability management from a reactive to a proactive discipline.
⚠ Critical Adobe Flash player bug and more in June’s Patch Tuesday ⚠
📖 Read
via "Naked Security".
June patch Tuesday features fixes from Adobe and Microsoft for critical flaws including a remote code vulnerability in Adobe Flash Player.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🔐 How to secure your LinkedIn profile 🔐
📖 Read
via "Security on TechRepublic".
LinkedIn offers many privacy and security options that professionals may not be aware of. Here's what you need to know to stay safe on the networking platform.📖 Read
via "Security on TechRepublic".
TechRepublic
How to secure your LinkedIn profile
LinkedIn offers many privacy and security options that professionals may not be aware of. Here's what you need to know to stay safe on the networking platform.