🕴 Cyberwar and Cybercrime Go Hand in Hand 🕴
📖 Read
via "Dark Reading".
The line between criminal and political aims has become blurred, but motivations matter less than the effects of a breach.📖 Read
via "Dark Reading".
Dark Reading
Cyberwar and Cybercrime Go Hand in Hand
The line between criminal and political aims has become blurred, but motivations matter less than the effects of a breach.
👏3
🗓️ CSRF in Plesk API enabled privilege escalation 🗓️
📖 Read
via "The Daily Swig".
Bugs in programming interfaces of web hosting admin tool patched📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
CSRF in Plesk API enabled server takeover
Bugs in programming interfaces of web hosting admin tool patched
⚠ Emergency code execution patch from Apple – but not an 0-day ⚠
📖 Read
via "Naked Security".
Not a zero-day, but important enough for a quick-fire patch to one system library...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
👍1
⚠ S3 Ep108: You hid THREE BILLION dollars in a popcorn tin? ⚠
📖 Read
via "Naked Security".
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep108: You hid THREE BILLION dollars in a popcorn tin?
Patches, busts, leaks and why even low-likelihood exploits can be high-severity risks – listen now!
🛠 TOR Virtual Network Tunneling Tool 0.4.7.11 🛠
📖 Read
via "Packet Storm Security".
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
TOR Virtual Network Tunneling Tool 0.4.7.11 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
😱1
🕴 Okta Launches New Workforce Identity Cloud 🕴
📖 Read
via "Dark Reading".
Okta Worforce Identity Cloud has all three identity functions – identity access management, identity governance, and privilege access management – under the hood.📖 Read
via "Dark Reading".
Dark Reading
Okta Launches New Workforce Identity Cloud
Okta Worforce Identity Cloud has all three identity functions – identity access management, identity governance, and privilege access management – under the hood.
🕴 Why CVE Management as a Primary Strategy Doesn't Work 🕴
📖 Read
via "Dark Reading".
With only about 15% of vulnerabilities actually exploitable, patching every vulnerability is not an effective use of time.📖 Read
via "Dark Reading".
Dark Reading
Why CVE Management as a Primary Strategy Doesn't Work
With only about 15% of vulnerabilities actually exploitable, patching every vulnerability is not an effective use of time.
🗓️ Prototype pollution project yields another Parse Server RCE 🗓️
📖 Read
via "The Daily Swig".
Bug emerges from ambition to find ‘end-to-end exploits beyond DoS’📖 Read
via "The Daily Swig".
portswigger.net
Web Application Security, Testing, & Scanning - PortSwigger
PortSwigger offers tools for web application security, testing, & scanning. Choose from a range of security tools, & identify the very latest vulnerabilities.
⚠ Dangerous SIM-swap lockscreen bypass – update Android now! ⚠
📖 Read
via "Naked Security".
A bit like leaving the front door keys under the doormat...📖 Read
via "Naked Security".
Naked Security
Dangerous SIM-swap lockscreen bypass – update Android now!
A bit like leaving the front door keys under the doormat…
👍1
🕴 Knock, Knock: Aiphone Bug Allows Cyberattackers to Literally Open (Physical) Doors 🕴
📖 Read
via "Dark Reading".
The bug affects several Aiphone GT models using NFC technology and allows malicious actors to potentially gain access to sensitive facilities.📖 Read
via "Dark Reading".
Dark Reading
Knock, Knock: Aiphone Bug Allows Cyberattackers to Literally Open (Physical) Doors
The bug affects several Aiphone GT models using NFC technology and allows malicious actors to potentially gain access to sensitive facilities.
🕴 Uyghurs Targeted With Spyware, Courtesy of PRC 🕴
📖 Read
via "Dark Reading".
Chinese government employs spyware to detect so-called "pre-crimes" including using a VPN, religious apps, or WhatsApp, new analysis reveals.📖 Read
via "Dark Reading".
Dark Reading
Uyghurs Targeted With Spyware, Courtesy of PRC
Chinese government employs spyware to detect so-called "pre-crimes" including using a VPN, religious apps, or WhatsApp, new analysis reveals.
🕴 Cybersecurity 'Nutrition' Labels Still a Work in Progress 🕴
📖 Read
via "Dark Reading".
Pretty much every aspect of the effort to create easy-to-understand labels for Internet-of-Things (IoT) products is up in the air, according to participants in the process.📖 Read
via "Dark Reading".
Dark Reading
Cybersecurity 'Nutrition' Labels Still a Work in Progress
Pretty much every aspect of the effort to create easy-to-understand labels for Internet of Things (IoT) products is up in the air, according to participants in the process.
‼ CVE-2022-36380 ‼
📖 Read
via "National Vulnerability Database".
Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-27187 ‼
📖 Read
via "National Vulnerability Database".
Uncontrolled search path element in the Intel(R) Quartus Prime Standard edition software before version 21.1 Patch 0.02std may allow an authenticated user to potentially enable escalation of privilege via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3945 ‼
📖 Read
via "National Vulnerability Database".
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26341 ‼
📖 Read
via "National Vulnerability Database".
Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2.3.2 may allow an authenticated user to potentially enable escalation of privilege via network access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-43074 ‼
📖 Read
via "National Vulnerability Database".
AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-36776 ‼
📖 Read
via "National Vulnerability Database".
IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35740 ‼
📖 Read
via "National Vulnerability Database".
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-35276 ‼
📖 Read
via "National Vulnerability Database".
Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-3940 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulation of the argument file_name leads to path traversal. The associated identifier of this vulnerability is VDB-213447.📖 Read
via "National Vulnerability Database".