The human impact of a Royal Mail phishing scam

Last week, we looked at a Royal Mail themed scam which has very quickly become the weapon of choice for phishers. It’s pretty much everywhere at this point. Even one of my relatives with a semi-mystical ability to never experience a scam ever, received a fake SMS at the weekend. The problem with...

Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange

In recent weeks, there has been quite a lot of reporting on the exploitation of the latest disclosed vulnerabilities in Microsoft’s Exchange Server by an attacker referred to as HAFNIUM. One of the major reasons these latest vulnerabilities are so dangerous and appealing to attackers is that they...

Flying Fishstar Technology Development Limited VOLANS has a weak password vulnerability

Founded in 2002, Chengdu Flying Fish Star Technology Co., Ltd. is a high-tech enterprise focusing on product innovation and R&D in digital communication industry and Internet of Things industry. Flying Fish Star Technology Development Co., Ltd VOLANS has a weak password vulnerability that can be...

Changshu Qimao Network Information Technology Co., Ltd. website building system has SQL injection vulnerability

Ltd. is a professional engaged in Changshu website optimization, Changshu website construction, Changshu website production network promotion as one of the integrated Internet enterprises. Changshu Qimao Network Information Technology Co., Ltd. station building system there is a SQL injection...

D-Link DAP-2020 Arbitrary File Read Vulnerability

Founded in 1986 and listed on the Taiwan Stock Exchange in October 1994, D-Link is the first Internet company in Taiwan Province of China to be listed on the Taiwan Stock Exchange. The AUO Group D-Link, established in 1986 and listed on the Taiwan Stock Exchange of China in October 1994, is the...

PT-2021-14479 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.7.1 Description: The issue allows arbitrary file read from a Jellyfin server's file system with well-crafted requests to certain "API Endpoints". This is more prevalent when Windows is used as the host OS. Server...

UNIVERGE Aspire series PBX vulnerable to denial-of-service (DoS)

Overview Remote system maintenance feature of UNIVERGE Aspire series PBX contain an issue in handling commands, which may cause a denial-of-service DoS. NEC Platforms, Ltd. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NEC Platforms, Ltd. coordinate...

Logic Flaw Vulnerability in RG-UAC Riptide Unified Internet Behavior Management and Audit System

Ltd. is a company that utilizes new technologies such as cloud computing, SDN, mobile Internet, big data, and Internet of Things to provide end-to-end solutions for users in various industries. A logic flaw vulnerability exists in the RG-UAC Ruijie Unified Internet Behavior Management and Auditin...

Report reveals the staggering scale of Business Email Compromise losses

Internet crime is ever present, and with the ongoing pandemic, levels of scams and fraud were exceptionally high in 2020. Opportunistic fraudsters didnt give a second thought to riding the COVID-19 wave and preying upon those who are truly in need of help, or those who truly want to help. The...

[SECURITY] Fedora 34 Update: privoxy-3.0.32-1.fc34

Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit...

Facebook's ‘Red Team X’ Hunts Bugs Outside the Social Network

The internal hacking team has spent the last year looking for vulnerabilities in the products the company uses, which could in turn make the whole internet safer...

(0Day) (Pwn2Own) Sony X800H Smart TV Vewd Type-Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sony X800H Smart TV. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling o...

The vulnerability of the Internet Explorer browser, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the Internet Explorer browser is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Internet Explorer and Microsoft Edge browsers, related to the repeated release of memory, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Internet Explorer and Microsoft Edge relates to the repeated release of memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...

Snapdragon Industrial IOT 安全漏洞

Qualcomm Snapdragon Industrial IOT is an industrial device from Qualcomm, Inc. It provides the ability to establish a network to connect, protect, and utilize data. A security vulnerability exists in the Snapdragon Industrial IOT that stems from improperly checking the length of received...

kernel: Geneve/IPsec traffic may be unencrypted between two Geneve endpoints

A flaw was found in the Linux kernel. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone in between the two endpoints to read the traffic unencrypted. The main threat from this...

Microsoft Exchange and Verkada Hacks: Isolate Your Apps and APIs from the Internet Cesspool

It's been an interesting start to March in terms of public security incidents. This month kicked off with multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server. And, as if that wasn't enough, that attack was quickly followed by the news that a hacktivis...

5 steps to enable your corporate SOC to rapidly detect and respond to IoT/OT threats

As organizations connect massive numbers of IoT/OT devices to their networks to optimize operations, boards and management teams are increasingly concerned about the expanding attack surface and corporate liability that they represent. These connected devices can be compromised by adversaries to...

Information Disclosure

highcharts-export-server is vulnerable to information disclosure. If the export server is accessible via internet, it allows reading of internal HTTP resources and outputting files served by other services on the internal network in which the export server is hosted...

The vulnerability of the implementation of the IPv6 protocol in the Trace TCP/IP stack allows a attacker to cause a service failure.

The vulnerability of the IPv6 implementation in the Trace TCP/IP stack is related to insufficient validation of input data during packet processing. Exploiting this vulnerability can allow a malicious actor to cause service failures...