3155 matches found
CVE-2020-14312
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not...
CVE-2020-14312
CVE-2020-14312 affects dnsmasq in Fedora versions prior to 31 and all Red Hat Enterprise Linux versions. The issue is a default configuration flaw where dnsmasq listens on any interface and does not enable the local-service option, effectively making it an open resolver accessible from arbitrary ...
API Security Checks in the Post-Pandemic World
The digital transformation journeys of many enterprises have been accelerated by the COVID-19 pandemic. For 2020, IT resources shifted to support WFH policies with mobile and remote productivity solutions, while simultaneously managing multiple datacenter migration projects to the cloud for scale...
CVE-2020-14312: Improper Access Control
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option local-service is not...
Android Devices Prone to New Botnet’s DDoS Onslaught
Researchers are warning a new botnet is recycling the Mirai malware framework and is now targeting Android devices in order to launch distributed denial-of-service DDoS attacks. The botnet is dubbed Matryosh after a Matryoshka Russian nesting doll due to many of its functions being “nested” in...
Watch out as new Matryosh DDoS botnet hits Android devices
By Deeba Ahmed According to Netlab researchers, Matryosh DDoS botnet reuses the Mirai botnet framework. Here's how the malware works. This is a post from HackRead.com Read the original post: Watch out as new Matryosh DDoS botnet hits Android devices...
Beware: New Matryosh DDoS Botnet Targeting Android-Based Devices
A nascent malware campaign has been spotted co-opting Android devices into a botnet with the primary purpose of carrying out distributed denial-of-service DDoS attacks. Called "Matryosh" by Qihoo 360's Netlab researchers, the latest threat has been found reusing the Mirai botnet framework and...
Nextcloud Server Resource Management Error Vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server. The vulnerability stems from the program's lack of input validation, which prevents users from storing...
A week in security (January 25 – January 31)
January 28 was Data Privacy Day, but for Malwarebytes Labs, it was Data Privacy Week. As such, were packed with more privacy coverage than you can shake a stick at, starting with some practical steps on how to make your online life private and secure, and why privacy is core to a safer internet. ...
CVE-2021-21254
CVE-2021-21254 affects CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) versions ≤ 24.0.0. A ReDoS vulnerability arises from the plugin’s link-recognition regex, enabling significant performance degradation and browser tab freezes. The issue is fixed in version 25.0.0, with advisorie...
RDP abused for DDoS attacks
We have talked about RDP many times before. It has been a popular target for brute force attacks for a long time, but attackers have now found a new way to abuse it. Remote access has become more important during the pandemic, with as many people as possible try to work from home. Which makes it...
Enhanced Security at the Edge with Imperva DNS Protection
Your website is the gateway to your business and the potential for disruption of your site or damage to your web infrastructure makes DNS security a serious consideration for organizations. The criticality of DNS Services for ensuring network connectivity and website availability make them a hot...
Nextcloud Server Multiple Vulnerabilities (NC-SA-2021-001, NC-SA-2021-002)
Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextcloud:nextcloudserver"...
CVE-2020-8293
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules...
CVE-2020-8293
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules...
Input validation
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules...
CVE-2020-8293
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules...
CVE-2020-8293
CVE-2020-8293 : A missing input validation in Nextcloud Server allowed users to store unlimited data in workflow rules, causing load and potential DDoS on subsequent interactions. Affected versions were 18.0.x, 19.0.x, and 20.0.x prior to fixes. Connectedupdates show Nextcloud releases addressing...
PART I: Retrospective 2020: DDoS Was Back -- Bigger and Badder Than Ever Before
Never before has the risk of a distributed denial-of-service DDoS attack been higher. In 2020, we saw record-breaking attacks, a DDoS extortion campaign impacting thousands of organizations globally, more emergency customer turnups, and more Akamai customers attacked than any year on record -- an...