1159 matches found
Exploit for CVE-2021-36934
This is a PoC exploit for CVE-2021-36934, a vulnerability in the...
Introducing Bounty Awards for Teams Mobile Applications Security Research
We are pleased to announce the addition of Microsoft Teams mobile applications to the Microsoft Applications Bounty Program. Through the expanded program we welcome researchers from across the globe to seek out and disclose any high impact security vulnerabilities they may find in Teams mobile...
Introducing Bounty Awards for Teams Mobile Applications Security Research
We are pleased to announce the addition of Microsoft Teams mobile applications to the Microsoft Applications Bounty Program. Through the expanded program we welcome researchers from across the globe to seek out and disclose any high impact security vulnerabilities they may find in Teams mobile...
Announcing the Top MSRC 2021 Q2 Security Researchers - Congratulations!
We’re excited to announce the top contributing researchers for the 2021 Second Quarter Q2! Congratulations to all the researchers recognized in this quarter’s leaderboard and thank you to everyone who continues to help secure our customers and the...
Kaseya Ransomware Attack: Guidance and Resources
CISA has created a webpage to provide information and guidance for the recent ransomware attack against Kaseya customers that include managed service providers MSPs and customers of those MSPs. CISA encourages affected organizations to review Kaseya Ransomware Attack: Guidance for Affected MSPs a...
Kaseya Patches Zero-Days Used in REvil Attacks
Kaseya made good on its promise to issue patches by July 11. On Saturday, the company behind the Virtual System/Server Administrator VSA platform that got walloped by the REvil ransomware-as-a-service RaaS gang in a massive supply-chain attack released urgent updates to address critical zero-day...
Microsoft Bug Bounty Programs Year in Review: $13.6M in Rewards
Partnering with the security research community is an important part of Microsoft’s holistic approach to defending against security threats. Bug bounty programs are one part of this partnership. By discovering and reporting vulnerabilities to Microsoft through Coordinated Vulnerability Disclosure...
Windows Print Spooler の脆弱性情報 (CVE-2021-34527) に関するお客様向けガイダンス
2021 年 7 月 7 日 日本時間 に、マイクロソフトは Windows Print Spooler の脆弱性情報 CVE-2021-34527 を公開し、7 月 7 日と 8 日 日本時間...
[Security Nation] Jonathan Cran on demystifying startup funding for security companies
!\Security Nation\ Jonathan Cran on demystifying startup funding for security companieshttps://blog.rapid7.com/content/images/2021/07/securitynationlogo.jpg In this episode of Security Nation, we’re joined by Jonathan Cran. We wade into uncharted territory with Jonathan, as he claims the title of...
Kaseya Patches Imminent After Zero-Day Exploits
UPDATE 3 The worldwide July 2 attacks on the Kaseya Virtual System/Server Administrator VSA platform by the REvil ransomware gang turn out to be the result of exploits for at least one zero-day security vulnerability, and the company is swinging into full mitigation mode, with patches for the...
SolarWinds Hackers Continue Assault With New Microsoft Breach
The company says the Nobelium hacking group compromised a support agent's computer and levied brute-force attacks against some of its customers...
Hotfix XS82E029 - For Citrix Hypervisor 8.2
Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. Information About this Hotfix Component| Details ---|--- Prerequisite| None Post-update tasks| None Content live patchable| No Baselines for Live Patch| N/A Revision History| Published on Jun 28, 2021...
Arbitrary File Read Vulnerability in DSKMS
DSKMS is a professional content payment system tailored for enterprise customers by Changsha Deshaun Network Technology Co. DSKMS suffers from an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...
IKEA Fined $1.2M for Elaborate ‘Spying System’
IKEA’s French subsidiary was just hit with a $1.2 million fine after it was found guilty of a creepy systematic snooping scheme targeting customers, employees and even prospective hires. Prosecutors said in all, the company illegally surveilled about 400 people in total, according to the BBC. IKE...
Imperva delivers mile high performance and protection with new PoPs in Denver and Dublin
We are very pleased to announce that we are extending our global coverage with the addition of two new PoPs points of presence in Denver in the US and Dublin, Ireland. The new PoPs will enhance Imperva’s existing network to provide enhanced protection against distributed denial of service DDoS...
IT threat evolution Q1 2021
Targeted attacks Putting the A into APT In December, SolarWinds, a well-known IT managed services provider, fell victim to a sophisticated supply-chain attack. The companys Orion IT, a solution for monitoring and managing customers IT infrastructure, was compromised by threat actors. This resulte...
CVE-2021-33561
A stored cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when informati...
PT-2021-24420
Name of the Vulnerable Software and Affected Versions: moov-io/customers affected versions not specified Description: The issue is related to the hashing of account numbers without using a salt, making it susceptible to rainbow table attacks. The expected behavior is to include a salt, such as a...
PT-2021-20204
Name of the Vulnerable Software and Affected Versions Shopizer versions prior to 2.17.0 Description A stored cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the customer name variable in various forms of store administration. The injected code is...