🕴 Prelude Security Tackles Continuous Security Testing in Containers 🕴
📖 Read
via "Dark Reading".
Probes are tiny processes which run inside containers and scan applications for vulnerabilities.📖 Read
via "Dark Reading".
Dark Reading
Prelude Security Tackles Continuous Security Testing in Containers
Probes are tiny processes that run inside containers and scan applications for vulnerabilities.
‼ CVE-2023-40573 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki. If the attack is successful, an error log entry with "Job content executed" will be produced. This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32559 ‼
📖 Read
via "National Vulnerability Database".
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-40572 ‼
📖 Read
via "National Vulnerability Database".
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable. This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.📖 Read
via "National Vulnerability Database".
📢 Salt Security lifts lid on new STEP partner program 📢
📖 Read
via "ITPro".
Initiative's inaugural partners include Bright Security, Invicti, StackHawk, and Contrast Security 📖 Read
via "ITPro".
channelpro
Salt Security lifts lid on new STEP partner program
Initiative's inaugural partners include Bright Security, Invicti, StackHawk, and Contrast Security
🕴 eSentire Labs Open Sources Project to Monitor LLMs 🕴
📖 Read
via "Dark Reading".
The eSentire LLM Gateway provides monitoring and governance of ChatGPT and other Large Language Models being used in the organization.📖 Read
via "Dark Reading".
Dark Reading
eSentire Labs Open Sources Project to Monitor LLMs
The eSentire LLM Gateway provides monitoring and governance of ChatGPT and other large language models being used in the organization.
🕴 North Korea's Lazarus Group Used GUI Framework to Build Stealthy RAT 🕴
📖 Read
via "Dark Reading".
The world's most notorious threat actor is using an unprecedented tactic for sneaking spyware into the IT networks of important companies.📖 Read
via "Dark Reading".
Dark Reading
North Korea's Lazarus APT Uses GUI Framework to Build Stealthy RAT
The world's most notorious threat actor is using an unprecedented tactic for sneaking spyware into the IT networks of important companies.
📢 ‘Worst case scenario’ ransomware attack cripples Danish cloud provider 📢
📖 Read
via "ITPro".
Hundreds of customers in the Nordics have been impacted by the breach 📖 Read
via "ITPro".
Cloud Pro
‘Worst case scenario’ ransomware attack cripples Danish cloud provider
Hundreds of customers in the Nordics have been impacted by the breach
🦿 Critical Insight Reports Fewer Cybersecurity Breaches in Health Care, Yet Victim Numbers Are Up in 2023 🦿
📖 Read
via "Tech Republic".
A new study by Critical Insight shows that cybersecurity attacks in the health care sector are hitting more individuals and finding vulnerabilities in third-party partners.📖 Read
via "Tech Republic".
TechRepublic
Critical Insight Reports Fewer Cybersecurity Breaches in Health Care, Yet Victim Numbers Are Up in 2023
Cybersecurity attacks in the health care sector are hitting more individuals and finding vulnerabilities in third-party partners.
🕴 5 Best Practices for Implementing Risk-First Cybersecurity 🕴
📖 Read
via "Dark Reading".
Embracing a risk-first mindset empowers organizations to make informed decisions, strengthen security, safeguard valuable assets, and reduce financial impact.📖 Read
via "Dark Reading".
Dark Reading
5 Best Practices for Implementing Risk-First Cybersecurity
Embracing a risk-first mindset empowers organizations to make informed decisions, strengthen security, safeguard valuable assets, and reduce financial impact.
‼ CVE-2023-34040 ‼
📖 Read
via "National Vulnerability Database".
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.Specifically, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topicBy default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32516 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GloriaFood Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.3.6 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32511 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin plugin <=Â 1.1.8 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-32510 ‼
📖 Read
via "National Vulnerability Database".
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rolf van Gelder Order Your Posts Manually plugin <=Â 2.2.5 versions.📖 Read
via "National Vulnerability Database".
🛠 Wireshark Analyzer 4.0.8 🛠
📖 Read
via "Packet Storm Security".
Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. This is the source code release.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Wireshark Analyzer 4.0.8 ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🦿 How to Remove a Lost Device From Your Google Account 🦿
📖 Read
via "Tech Republic".
Follow this guide to learn how to easily remove any device from your Google account and keep your account secure.📖 Read
via "Tech Republic".
TechRepublic
How to Remove a Lost Device From Your Google Account
Follow this guide to learn how to easily remove any device from your Google account and keep your account secure.
🦿 Google AI in Workspace Adds New Zero-Trust and Digital Sovereignty Controls 🦿
📖 Read
via "Tech Republic".
Google announced security enhancements to Google Workspace focused on enhancing threat defense controls with Google AI.📖 Read
via "Tech Republic".
TechRepublic
Google AI in Google Workspace Adds New Zero-Trust and Digital Sovereignty Controls
Google announced security enhancements to Google Workspace focused on enhancing threat defense controls with Google AI.
🕴 eBay Users Beware Russian 'Telekopye' Telegram Phishing Bot 🕴
📖 Read
via "Dark Reading".
Thanks to a simple Telegram bot that democratizes phishing, ordinary Russians can conduct full-fledged phishing attacks with zero technical knowhow.📖 Read
via "Dark Reading".
Dark Reading
eBay Users Beware Russian 'Telekopye' Telegram Phishing Bot
Thanks to a simple Telegram bot that democratizes phishing, ordinary Russians can conduct full-fledged phishing attacks with zero technical know-how.
‼ CVE-2023-34973 ‼
📖 Read
via "National Vulnerability Database".
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQuTS hero h5.1.0.2424 build 20230609 and later📖 Read
via "National Vulnerability Database".
‼ CVE-2023-34971 ‼
📖 Read
via "National Vulnerability Database".
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors.We have already fixed the vulnerability in the following versions:QTS 5.0.1.2425 build 20230609 and laterQTS 5.1.0.2444 build 20230629 and laterQTS 4.5.4.2467 build 20230718 and laterQuTS hero h5.1.0.2424 build 20230609 and laterQuTS hero h4.5.4.2476 build 20230728 and later📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46884 ‼
📖 Read
via "National Vulnerability Database".
A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have lead to memory corruption or a potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106.📖 Read
via "National Vulnerability Database".