🕴 Researchers Report First Instance of Automated SaaS Ransomware Extortion 🕴
📖 Read
via "Dark Reading".
The attack highlights growing interest among threat actors to target data from software-as-a-service providers.📖 Read
via "Dark Reading".
Dark Reading
Researchers Report First Instance of Automated SaaS Ransomware Extortion
The attack highlights growing interest among threat actors to target data from software-as-a-service providers.
‼ CVE-2023-26297 ‼
📖 Read
via "National Vulnerability Database".
Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26298 ‼
📖 Read
via "National Vulnerability Database".
Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-2277 ‼
📖 Read
via "National Vulnerability Database".
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-33991 ‼
📖 Read
via "National Vulnerability Database".
SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2023-33124 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain a memory corruption vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33919 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2022-41327 ‼
📖 Read
via "National Vulnerability Database".
A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-30766 ‼
📖 Read
via "National Vulnerability Database".
Hidden functionality issue exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-29167 ‼
📖 Read
via "National Vulnerability Database".
Out-of-bound reads vulnerability exists in FRENIC RHC Loader v1.1.0.3. If a user opens a specially crafted FNE file, sensitive information on the system where the affected product is installed may be disclosed or arbitrary code may be executed.📖 Read
via "National Vulnerability Database".
📢 Capita handed £50m London police contract weeks after losing pension data 📢
📖 Read
via "ITPro".
The outsourcer will provide digital fraud reporting services after its cyber incident disclosure drew criticism 📖 Read
via "ITPro".
ITPro
Capita handed £50m London police contract weeks after losing pension data
The outsourcer will provide digital fraud reporting services after its cyber incident disclosure drew criticism
👍2
‼ CVE-2023-3050 ‼
📖 Read
via "National Vulnerability Database".
Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypass.This issue affects Lockcell: before 15.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3049 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15.📖 Read
via "National Vulnerability Database".
🕴 Why Critical Infrastructure Remains a Ransomware Target 🕴
📖 Read
via "Dark Reading".
While protecting critical infrastructure seems daunting, here are some critical steps the industry can take now to become more cyber resilient and mitigate risks.📖 Read
via "Dark Reading".
Dark Reading
Why Critical Infrastructure Remains a Ransomware Target
While protecting critical infrastructure seems daunting, here are some critical steps the industry can take now to become more cyber resilient and mitigate risks.
‼ CVE-2023-33568 ‼
📖 Read
via "National Vulnerability Database".
An issue in Dolibarr v16.0.0 to v16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-35064 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering.This issue affects Satos Mobile: before 20230607.📖 Read
via "National Vulnerability Database".
⚠ History revisited: US DOJ unseals Mt. Gox cybercrime charges ⚠
📖 Read
via "Naked Security".
Though the mills of the Law grind slowly/Yet they grind exceeding small/Though with patience they stand waiting/With exactness grind they all...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ Gozi banking malware “IT chief” finally jailed after more than 10 years ⚠
📖 Read
via "Naked Security".
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end...📖 Read
via "Naked Security".
Naked Security
Gozi banking malware “IT chief” finally jailed after more than 10 years
Gozi threesome from way back in the late 2000s and early 2010s now all charged, convicted and sentenced. The DOJ got there in the end…
🕴 How Security Leaders Should Approach Cybersecurity Startups 🕴
📖 Read
via "Dark Reading".
Vendors and buyers both have the power to make the industry a better place. What's needed is more collaboration, mutual support, and respect.📖 Read
via "Dark Reading".
Dark Reading
How Security Leaders Should Approach Cybersecurity Startups
Vendors and buyers both have the power to make the industry a better place. What's needed is more collaboration, mutual support, and respect.
👍1
‼ CVE-2022-31635 ‼
📖 Read
via "National Vulnerability Database".
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-33620 ‼
📖 Read
via "National Vulnerability Database".
GL.iNET GL-AR750S-Ext firmware v3.215 uses an insecure protocol in its communications which allows attackers to eavesdrop via a man-in-the-middle attack.📖 Read
via "National Vulnerability Database".