🗓️ Microsoft confirms zero-day exploits against Exchange Server in ‘limited’ attacks 🗓️
📖 Read
via "The Daily Swig".
‘ProxyNotShell’ abuse less severe than 2021 attack wave due to authentication requirement📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Microsoft confirms zero-day exploits against Exchange Server in ‘limited’ attacks
‘ProxyNotShell’ abuse less severe than 2021 attack wave due to authentication requirement
‼ CVE-2022-40123 ‼
📖 Read
via "National Vulnerability Database".
mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authenticated attackers to read arbitrary files in the system.📖 Read
via "National Vulnerability Database".
👍2
‼ CVE-2022-40922 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-38817 ‼
📖 Read
via "National Vulnerability Database".
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36551 ‼
📖 Read
via "National Vulnerability Database".
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-32173 ‼
📖 Read
via "National Vulnerability Database".
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.📖 Read
via "National Vulnerability Database".
🕴 Name That Edge Toon: Mumbo Dumbo 🕴
📖 Read
via "Dark Reading".
Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.📖 Read
via "Dark Reading".
Darkreading
Name That Edge Toon: Mumbo Dumbo
Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.
‼ CVE-2022-33882 ‼
📖 Read
via "National Vulnerability Database".
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-41443 ‼
📖 Read
via "National Vulnerability Database".
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-42247 ‼
📖 Read
via "National Vulnerability Database".
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.📖 Read
via "National Vulnerability Database".
🕴 Bumblebee Malware Loader's Payloads Significantly Vary by Victim System 🕴
📖 Read
via "Dark Reading".
On some systems the malware drops infostealers and banking Trojans; on others it installs sophisticated post-compromise tools, new analysis shows.📖 Read
via "Dark Reading".
Dark Reading
Bumblebee Malware Loader's Payloads Significantly Vary by Victim System
On some systems the malware drops infostealers and banking Trojans; on others it installs sophisticated post-compromise tools, new analysis shows.
🕴 Vice Society Publishes LA Public School Student Data, Psych Evals 🕴
📖 Read
via "Dark Reading".
After a flat refusal to pay the ransom, Los Angeles Unified School District's stolen data has been dumped on the Dark Web by a ransomware gang.📖 Read
via "Dark Reading".
Dark Reading
Vice Society Publishes LA Public School Student Data, Psych Evals
After a flat refusal to pay the ransom, Los Angeles Unified School District's stolen data has been dumped on the Dark Web by a ransomware gang.
👍1
🕴 First 72 Hours of Incident Response Critical to Taming Cyberattack Chaos 🕴
📖 Read
via "Dark Reading".
Responding to cyberattacks is extraordinarily stressful, but better planning, frequent practice, and the availability of mental health services can help IR professionals, a survey finds.📖 Read
via "Dark Reading".
Dark Reading
First 72 Hours of Incident Response Critical to Taming Cyberattack Chaos
Responding to cyberattacks is extraordinarily stressful, but better planning, frequent practice, and the availability of mental health services can help IR professionals, a survey finds.
👍2
⚠ Scammers and rogue callers – can anything ever stop them? ⚠
📖 Read
via "Naked Security".
Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?📖 Read
via "Naked Security".
Naked Security
Scammers and rogue callers – can anything ever stop them?
Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?
👍2
🗓️ Researchers net $46k for Akamai misconfiguration vulnerability 🗓️
📖 Read
via "The Daily Swig".
A lesson in how to achieve maximum value for your discoveries📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Researchers net $46k for Akamai misconfiguration vulnerability
A lesson in how to achieve maximum value for your discoveries
🗓️ JavaScript sandbox vm2 remediates remote code execution risk 🗓️
📖 Read
via "The Daily Swig".
Affected firms alerted to bug whose potential impact is heightened by vm2’s use in production environments📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
JavaScript sandbox vm2 remediates remote code execution risk
Affected firms alerted to bug whose potential impact is heightened by vm2’s use in production environments
👍1
🕴 Aryaka Delivers Zero-Trust WAN Based on Unified SASE Architecture 🕴
📖 Read
via "Dark Reading".
The new offering integrates firewall-as-a-service and secure web gateway into cloud-managed networking and security services.📖 Read
via "Dark Reading".
Dark Reading
Aryaka Delivers Zero-Trust WAN Based on Unified SASE Architecture
The new offering integrates firewall-as-a-service and secure web gateway into cloud-managed networking and security services.
🕴 Tidal Cyber Closes $4M Funding Round To Expand Threat-Informed Defense Tech 🕴
📖 Read
via "Dark Reading".
.📖 Read
via "Dark Reading".
Dark Reading
Tidal Cyber Closes $4M Funding Round To Expand Threat-Informed Defense Tech
.
🕴 Ransomware 3.0: The Next Frontier 🕴
📖 Read
via "Dark Reading".
Attackers are already circling back to reselling stolen data instead of — and in addition to — extortion.📖 Read
via "Dark Reading".
Darkreading
Ransomware 3.0: The Next Frontier
Attackers are already circling back to reselling stolen data instead of — and in addition to — extortion.
👍1
🕴 Eclypsium Raises Series B to Protect Digital Supply Chain As Attacks Grow 🕴
📖 Read
via "Dark Reading".
The new round highlights market demand to protect global businesses from soaring breaches through supply chains of critical hardware, devices, firmware, and software.📖 Read
via "Dark Reading".
Darkreading
Eclypsium Raises Series B to Protect Digital Supply Chain As Attacks Grow
The new round highlights market demand to protect global businesses from soaring breaches through supply chains of critical hardware, devices, firmware, and software.
🕴 More Than 30% of All Malicious Attacks Target Shadow APIs 🕴
📖 Read
via "Dark Reading".
New research spotlights how attackers are capitalizing on API-driven innovation.📖 Read
via "Dark Reading".
Dark Reading
More Than 30% of All Malicious Attacks Target Shadow APIs
New research spotlights how attackers are capitalizing on API-driven innovation.