🕴 Why Multifactor Authentication Is Now a Hacker Target 🕴
📖 Read
via "Dark Reading: ".
SIM swaps, insecure web design, phishing, and channel-jacking are four ways attackers are circumventing MFA technology, according to the FBI.📖 Read
via "Dark Reading: ".
Darkreading
Why Multifactor Authentication Is Now a Hacker Target
SIM swaps, insecure web design, phishing, and channel-jacking are four ways attackers are circumventing MFA technology, according to the FBI.
ATENTION‼ New - CVE-2010-4657 (debian_linux, enterprise_linux, php)
📖 Read
via "National Vulnerability Database".
PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.📖 Read
via "National Vulnerability Database".
🔐 Want to attain and retain customers? Adopt data privacy policies 🔐
📖 Read
via "Security on TechRepublic".
Customers won't buy services or products from companies if they don't trust how their data will be used, Cisco found.📖 Read
via "Security on TechRepublic".
TechRepublic
Want to attain and retain customers? Adopt data privacy policies
Customers won't buy services or products from companies if they don't trust how their data will be used, Cisco found.
❌ ThreatList: Admin Rights for Third Parties is the Norm ❌
📖 Read
via "Threatpost".
The majority give outside partners, contractors and suppliers administrative access -- without strong security policies in place.📖 Read
via "Threatpost".
Threat Post
ThreatList: Admin Rights for Third Parties is the Norm
The majority give outside partners, contractors and suppliers administrative access — without strong security policies in place.
❌ High-Severity Windows UAC Flaw Enables Privilege Escalation ❌
📖 Read
via "Threatpost".
Further details of the flaw, which has recently been patched by Microsoft, were disclosed Tuesday by researchers.📖 Read
via "Threatpost".
Threat Post
High-Severity Windows UAC Flaw Enables Privilege Escalation
Further details of the flaw, which has recently been patched by Microsoft, were disclosed Tuesday by researchers.
ATENTION‼ New - CVE-2011-1028
📖 Read
via "National Vulnerability Database".
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2011-0529
📖 Read
via "National Vulnerability Database".
Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2010-4660
📖 Read
via "National Vulnerability Database".
Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..📖 Read
via "National Vulnerability Database".
🕴 Black Hat Europe Q&A: Exposing the Weaknesses in Contactless Payments 🕴
📖 Read
via "Dark Reading: ".
Researchers Leigh-Anne Galloway and Tim Yunusov chat about their work testing Visa's contactless payments security system vulnerabilities.📖 Read
via "Dark Reading: ".
Dark Reading
Black Hat Europe Q&A: Exposing the Weaknesses in Contactless Payments
Researchers Leigh-Anne Galloway and Tim Yunusov chat about their work testing Visa's contactless payments security system vulnerabilities.
🕴 Former White House CIO Shares Enduring Security Strategies 🕴
📖 Read
via "Dark Reading: ".
Theresa Payton explains the strategies organizations should consider as they integrate layers of new technology.📖 Read
via "Dark Reading: ".
Dark Reading
Vulnerabilities & Threats recent news | Dark Reading
Explore the latest news and expert commentary on Vulnerabilities & Threats, brought to you by the editors of Dark Reading
🕴 Employee Privacy in a Mobile Workplace 🕴
📖 Read
via "Dark Reading: ".
Why businesses need guidelines for managing their employees' personal information -- without compromising on security.📖 Read
via "Dark Reading: ".
Dark Reading
Employee Privacy in a Mobile Workplace
Why businesses need guidelines for managing their employees' personal information -- without compromising on security.
ATENTION‼ New - CVE-2011-1490 (debian_linux, opensuse, rsyslog)
📖 Read
via "National Vulnerability Database".
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2011-1489 (debian_linux, opensuse, rsyslog)
📖 Read
via "National Vulnerability Database".
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2010-4659
📖 Read
via "National Vulnerability Database".
Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.📖 Read
via "National Vulnerability Database".
❌ Apache Solr Bug Gets Bumped Up to High Severity ❌
📖 Read
via "Threatpost".
Linux users running the enterprise-search platform Solr are potentially vulnerable to remote code execution attack.📖 Read
via "Threatpost".
Threat Post
Apache Solr Bug Gets Bumped Up to High Severity
Linux users running the enterprise-search platform Solr are potentially vulnerable to remote code execution attack.
🔏 NSA Reiterates Risks of Transport Layer Security Inspection 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
In an advisory published this week, the NSA outlined the risks of Transport Layer Security Inspection (TLSI) and provided security mitigations for organizations.📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
NSA Reiterates Risks of Transport Layer Security Inspection
In an advisory published this week, the NSA outlined the risks of Transport Layer Security Inspection (TLSI) and provided security mitigations for organizations.
❌ Mozilla Bug Bounty Program Doubles Payouts, Adds Firefox Monitor ❌
📖 Read
via "Threatpost".
In scope RCE Mozilla bug bounty payouts have also tripled to reach $15,000.📖 Read
via "Threatpost".
Threat Post
Mozilla Bug Bounty Program Doubles Payouts, Adds Firefox Monitor
In scope RCE Mozilla bug bounty payouts have also tripled to reach $15,000.
🕴 Google Cloud Update Gives Users Greater Data Control 🕴
📖 Read
via "Dark Reading: ".
External Key Manager and Key Access Justification are intended to give organizations greater visibility into requests for data access.📖 Read
via "Dark Reading: ".
Dark Reading
Google Cloud Update Gives Users Greater Data Control
External Key Manager and Key Access Justification are intended to give organizations greater visibility into requests for data access.
🕴 Patch 'Easily Exploitable' Oracle EBS Flaws ASAP: Onapsis 🕴
📖 Read
via "Dark Reading: ".
Organizations that have not yet applied a pair of months-old critical patches from Oracle for E-Business Suite are at risk of attacks on their financial systems, the application security firm says.📖 Read
via "Dark Reading: ".
Dark Reading
Patch 'Easily Exploitable' Oracle EBS Flaws ASAP: Onapsis
Organizations that have not yet applied a pair of months-old critical patches from Oracle for E-Business Suite are at risk of attacks on their financial systems, the application security firm says.
❌ Security Firms, Nonprofits Team to Fight Stalkerware ❌
📖 Read
via "Threatpost".
The Coalition Against Stalkerware launched this week, with the aim of offering a centralized location for helping victims of stalkerware, as well as defining what stalkerware is in the first place.📖 Read
via "Threatpost".
Threat Post
Security Firms, Nonprofits Team to Fight Stalkerware
The Coalition Against Stalkerware launched this week, with the aim of offering a centralized location for helping victims of stalkerware, as well as defining what stalkerware is in the first place.
⚠ Tories change Twitter name to ‘factcheckUK’ during live TV debate ⚠
📖 Read
via "Naked Security".
Twitter wagged its finger at the UK's Conservative party for renaming its press account "factcheckUK" during a live TV debate.📖 Read
via "Naked Security".
Naked Security
Tories change Twitter name to ‘factcheckUK’ during live TV debate
Twitter wagged its finger at the UK’s Conservative party for renaming its press account “factcheckUK” during a live TV debate.