Security update for google-compute-engine (important)

openSUSE Security Update: Security update for google-compute-engine Announcement ID: openSUSE-SU-2020:0996-1 Rating: important References: 1169978 1173258 Cross-References: CVE-2020-8903 CVE-2020-8907 CVE-2020-8933 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilities i...

CISO Stressbusters Post #3: 3 ways to share accountability for security risk management

Jim Eckart, former Chief Information Security Officer CISO of The Coca-Cola Company and current Chief Security Advisor at Microsoft shares his advice for relieving stress in today’s CISO Stressbuster post. If you are a CISO, it can feel like the responsibility for keeping the company secure rests...

Ask the Howlers: Latest Threats and Security Challenges Part 1

This is part of our ongoing bi-weekly webinar series called Ask the Howlers, where cybersecurity experts discuss the latest news, security challenges, and answer your questions. There is no doubt that remote work has become the new norm. Many organizations around the world are adapting to this ne...

How bad bots are targeting the healthcare sector

Credential cracking, or password spraying, is one of the most effective ways for cybercriminals to get access to user accounts. It refers to the brute-force automated cracking, or pairing of usernames and passwords by using sophisticated high-speed bots. According to a National Cyber Awareness...

Hackers Using Google Analytics to Bypass Web Security and Steal Credit Cards

Researchers reported on Monday that hackers are now exploiting Google's Analytics service to stealthily pilfer credit card information from infected e-commerce sites. According to several independent reports from PerimeterX, Kaspersky, and Sansec, threat actors are now injecting data-stealing cod...

CVE-2020-8907

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and...

CVE-2020-13275

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

CVE-2020-13275

CVE-2020-13275 affects GitLab EE versions 12.2–13.0.1. The vulnerability is an authorization issue where a user with an unverified email address could request access to domain‑restricted groups. The connected documents corroborate the affected versions and the access impact; no remediation detail...

CVE-2020-13275

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1...

PT-2020-13416 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.2 through 13.0.1 Description: A user with an unverified email address could request access to domain-restricted groups. Recommendations: For GitLab EE versions 12.2 through 13.0.1, update to a version that contains a fix...

CVE-2020-6752

In OMERO before 5.6.1, group owners can access members' data in other groups...

Attacker-Group-Predictor - Tool To Predict Attacker Groups From The Techniques And Software Used

The tool predicts attacker groups from techniques and softwares used. It searches based on the MITRE ATT&CK framework How it works? 1- Collect data from https://attack.mitre.org/ about attacker groups 2- Get data from user about attack 3- Compare data and create result Installation git clone...

A Bug in Facebook Messenger for Windows Could've Helped Malware Gain Persistence

Cybersecurity researchers at Reason Labs, the threat research arm of security solutions provider Reason Labs, today disclosed details of a vulnerability they recently discovered in the Facebook Messenger application for Windows. The vulnerability, which resides in Messenger version 460.16, could...

Dark Basin Hack-For-Hire Group Targeted Thousands Over 7 Years

A hack-for-hire group, called Dark Basin, has been outed after targeting thousands of individuals and organizations worldwide – including advocacy groups and journalists, elected and senior government officials, and hedge funds — over the course of seven years. Dark Basin conducted commercial...

8x8: IDOR: Adding Contacts to Other User Groups

The request to add a new contact performed insufficient validation on the specified group number. Altering the target group resulted in incrementing license count and disclosure of the name of the group, however access was not granted...

Tecnick.com TCExam Cross-Site Scripting Vulnerability (CNVD-2020-32375)

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is mainly used for online exams and more. A cross-site scripting vulnerability exists in Tecnick.com TCExam version 14.2.2, which can be exploited by remote attackers to inject malicious JavaScript code b...

libvirt security update

5.7.0-13.el7 - domain groups: Fix multiple Domain Group vCPU administration flaws Wim ten Have Orabug: 31145304 - qemu: fix missing if definedENABLEEXADATA Menno Lageman - build: Fix qemu-submodule-init syntax-check issue Wim ten Have - libvirt: Fix various introduced Fedora/RHEL build violations...

tcpdump security update

14:4.9.2-6 - Resolves: 1715423 - tcpdump pre creates user and groups unconditionally - Resolves: 1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:printprefix via crafted pcap...

CVE-2020-5881

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disrupting the communicatio...

CVE-2020-5881

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disrupting the communicatio...