⚠ S3 Ep102: How to avoid a data breach [Audio + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now! Tell fact from fiction in hyped-up cybersecurity news...📖 Read
via "Naked Security".
Naked Security
S3 Ep102: How to avoid a data breach [Audio + Transcript]
Latest episode – listen now! Tell fact from fiction in hyped-up cybersecurity news…
🕴 Onyxia Raises $5M to Help Companies Proactively Manage Cybersecurity Risks Using AI 🕴
📖 Read
via "Dark Reading".
Onyxia, an AI-powered cybersecurity strategy and performance platform providing a centralized way for security teams to monitor and manage cybersecurity efforts in real time, has raised $5 million in seed fundraising led by World Trade Ventures with participation by Silvertech Ventures and angel investors.📖 Read
via "Dark Reading".
Darkreading
Onyxia Raises $5M to Help Companies Proactively Manage Cybersecurity Risks Using AI
Onyxia, an AI-powered cybersecurity strategy and performance platform providing a centralized way for security teams to monitor and manage cybersecurity efforts in real time, has raised $5 million in seed fundraising led by World Trade Ventures with participation…
⚠ URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different” ⚠
📖 Read
via "Naked Security".
Double-play 0-day in Exchange - what you need to know, and what you can do📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🔥1
🕴 With the Software Supply Chain, You Can't Secure What You Don't Measure 🕴
📖 Read
via "Dark Reading".
Reports to the National Vulnerability Database jumped in 2022, but we should pay just as much attention to the flaws that are not being reported to NVD, including those affecting the software supply chain.📖 Read
via "Dark Reading".
Darkreading
With the Software Supply Chain, You Can't Secure What You Don't Measure
Reports to the National Vulnerability Database jumped in 2022, but we should pay just as much attention to the flaws that are not being reported to NVD, including those affecting the software supply chain.
🕴 SolarMarker Attack Leverages Weak WordPress Sites, Fake Chrome Browser Updates 🕴
📖 Read
via "Dark Reading".
The SolarMarker group is exploiting a vulnerable WordPress-run website to encourage victims to download fake Chrome browser updates, part of a new tactic in its watering-hole attacks.📖 Read
via "Dark Reading".
Dark Reading
SolarMarker Attack Leverages Weak WordPress Sites, Fake Chrome Browser Updates
The SolarMarker group is exploiting a vulnerable WordPress-run website to encourage victims to download fake Chrome browser updates, part of a new tactic in its watering-hole attacks.
🗓️ Bug Bounty Radar // The latest bug bounty programs for October 2022 🗓️
📖 Read
via "The Daily Swig".
New web targets for the discerning hacker📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Bug Bounty Radar // The latest bug bounty programs for October 2022
New web targets for the discerning hacker
‼ CVE-2022-41437 ‼
📖 Read
via "National Vulnerability Database".
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2022-23726 ‼
📖 Read
via "National Vulnerability Database".
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3371 ‼
📖 Read
via "National Vulnerability Database".
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41440 ‼
📖 Read
via "National Vulnerability Database".
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41439 ‼
📖 Read
via "National Vulnerability Database".
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-37461 ‼
📖 Read
via "National Vulnerability Database".
Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.📖 Read
via "National Vulnerability Database".
🕴 Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet 🕴
📖 Read
via "Dark Reading".
The "ProxyNotShell" security vulnerabilities can be chained for remote code execution and total takeover of corporate email platforms.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet
The "ProxyNotShell" security vulnerabilities can be chained for remote code execution and total takeover of corporate email platforms.
♟️ Microsoft: Two New 0-Day Flaws in Exchange Server ♟️
📖 Read
via "Krebs on Security".
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.📖 Read
via "Krebs on Security".
Krebs on Security
Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to…
🕴 Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack 🕴
📖 Read
via "Dark Reading".
Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.📖 Read
via "Dark Reading".
Darkreading
Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack
Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.
👍1
‼ CVE-2022-40274 ‼
📖 Read
via "National Vulnerability Database".
Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-28851 ‼
📖 Read
via "National Vulnerability Database".
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36830 ‼
📖 Read
via "National Vulnerability Database".
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36961 ‼
📖 Read
via "National Vulnerability Database".
A verb used in Orion was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-40313 ‼
📖 Read
via "National Vulnerability Database".
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32540 ‼
📖 Read
via "National Vulnerability Database".
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.📖 Read
via "National Vulnerability Database".