3851 matches found
buenosaires.gob.ar Cross Site Scripting vulnerability OBB-2150184
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
The Proliferation of Zero-days
The MIT Technology Review is reporting that 2021 is a blockbuster year for zero-day exploits: One contributing factor in the higher rate of reported zero-days is the rapid global proliferation of hacking tools. Powerful groups are all pouring heaps of cash into zero-days to use for themselves --...
Operation “Armor Piercer:” Targeted attacks in the Indian subcontinent using commercial RATs
By Asheer Malhotra, Vanja Svajcer and Justin Thattil. Cisco Talos is tracking a campaign targeting government personnel in India using themes and tactics similar to APT36 aka Mythic Leopard and Transparent Tribe.This campaign distributes malicious documents and archives to deliver the Netwire...
SQL Injection Vulnerability in Water Resources Engineering Management System of Siltronic Ltd.
SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the water project...
CISA, FBI, and NSA Release Joint Cybersecurity Advisory on Conti Ransomware
CISA, the Federal Bureau of Investigation FBI, and the National Security Agency NSA have released a joint Cybersecurity Advisory CSA alerting organizations of increased Conti ransomware attacks. Malicious cyber actors use Conti ransomware to steal sensitive files from domestic and international...
All Vulnerabilities for hertfordshire.gov.uk Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Porn Problem: Adult Ads Persist on US Gov’t, Military Sites
U.S. military and government website subdomains have a sticky problem: They’re “quite vulnerable” to blackhat SEO tactics that result in persistent redirects to spammy Viagra ads and porn videos. An example is one that showed up on a dot.mil subdomain on the Minnesota National Guard site you can...
Attackers Impersonate DoT in Two-Day Phishing Scam
Threat actors impersonated the U.S. Department of Transportation USDOT in a two-day phishing campaign that used a combination of tactics – including creating new domains that mimic federal sites so as to appear to be legitimate – to evade security detections. Between Aug. 16-18, researchers at...
Linux Implementation of Cobalt Strike Beacon Targeting Organizations Worldwide
Researchers on Monday took the wraps off a newly discovered Linux and Windows re-implementation of Cobalt Strike Beacon that's actively set its sights on government, telecommunications, information technology, and financial institutions in the wild. The as-yet undetected version of the penetratio...
This Week in Security News - September 10, 2021
Biden announces cybersecurity initiative partnership, US Government seeks public feedback on draft federal zero trust strategy and more...
This Week in Security News - September 10, 2021
Biden announces cybersecurity initiative partnership, US Government seeks public feedback on draft federal zero trust strategy and more...
Spoofing Bug Highlights Cybersecurity for Digital Vaccine Passports
Three weeks after an independent researcher found a critical bug in the Services Australia COVID-19 digital vaccine certificate that would allow an attacker to falsify someone’s vaccine status, it still hasn’t been fixed. Researcher Richard Nelson looked into the security behind a new digital...
PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers
In August 2021, Mandiant Managed Defense identified and responded to the exploitation of a chain of vulnerabilities known as ProxyShell. The ProxyShell vulnerabilities consist of three CVEs CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 affecting the following versions of on-premises Microsoft...
CISA Insights on Risk Considerations for Managed Service Provider Customers
CISA has released a new CISA Insights, Risk Considerations for Managed Service Provider Customers MSPs, which provides Managed Service Provider MSP customers a framework for reducing risk. This framework is designed for government and private sector organizations of all sizes, and it suggests...
[Security Nation] Jill Fraser and Deborah Blyth on Securing Colorado
!\Security Nation\ Jill Fraser and Deborah Blyth on Securing Coloradohttps://blog.rapid7.com/content/images/2021/09/securitynationlogo--1-.jpg In this episode of Security Nation, we chat with Deborah Blyth, CISO of the State of Colorado, and Jill Fraser, CISO for Jefferson County, Colorado. They...
Zero-Click iPhone Exploits
Citizen Lab is reporting on two zero-click iMessage exploits, in spyware sold by the cyberweapons arms manufacturer NSO Group to the Bahraini government. These are particularly scary exploits, since they dont require to victim to do anything, like click on a link or open a file. The victim receiv...
Microsoft, Google to Invest $30 Billion in Cybersecurity Over Next 5 Years
Google and Microsoft said they are pledging to invest a total of $30 billion in cybersecurity advancements over the next five years, as the U.S. government partners with private sector companies to address threats facing the country in the wake of a string of sophisticated malicious cyber activit...
US government and private sector agree to invest time, money in cybersecurity
In the wake of several high-profile ransomware attacks against critical infrastructure and major organizations in the last few months, President Biden met with private sector and education leaders to discuss a whole-of-nation effort needed to address cybersecurity threats and bolster the nation’s...
joondalup.wa.gov.au Cross Site Scripting vulnerability OBB-2127022
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2021-23031
creationtimestamp| type| source ---|---|--- 2021-08-26 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=636 2021-08-26 11:47:18+00:00| published-proof-of-concept| https://t.me/CyberSecurityIL/4999 2021-08-29 12:28:19+00:00| seen| https://t.me/CyberGovIL/1320 2021-09-14...