Managing the Human Security Factor in the Age of Ransomware

Security analysts have determined that cybercrime cost the global economy $1.5 trillion in 2018. Ransomware, in particular, is estimated to grow by as much as 350 percent over the next year. And while the ransom for a generic ransomware attack has now risen to nearly $13,000, with recent targeted...

CVE-2010-2247

CVE-2010-2247 concerns the makepasswd utility, where default password generation length was insecure. Public details across connected documents show that the default password length was raised from a 6–8 character range to 16 characters (128 bits) to address insecurity, with the change configurab...

CVE-2019-14929

CVE-2019-14929 affects Mitsubishi Electric Europe B.V. smartRTU ME-RTU devices (firmware up to 2.02) and INEA ME-RTU devices (up to 3.0). The root cause is unprotected storage of credentials (passwords stored in plaintext) due to weak credential management, enabling an unauthenticated attacker to...

CVE-2019-18201

CVE-2019-18201 affects Fujitsu Wireless Keyboard Set LX390 GK381 devices. Root cause: 2.4 GHz communications lack proper encryption, enabling an attacker to sniff keystrokes and other sensitive data (passwords). The issue is documented with high severity (CVSS 3.1: HIGH) and has been linked to pr...

Password Lense - Reveal Character Types In A Password

What is this? Certain characters in passwords 'O' and '0', 'I' and 'l', etc. can be hard to identify when you need to type them in and copy-paste is unavailable. Password Lense is a small web application that provides a quick and secure way to get a more informative view of your password. Feature...

CVE-2019-15749

CVE-2019-15749 affects SITOS six Build v6.2.1. The flaw allows a user to change their password and recovery email address without confirming the change with the old password, enabling an attacker who has access to the victim’s account (e.g., via XSS or an unattended workstation) to modify credent...

CVE-2007-5201

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments...

Google Adds Password Checkup Feature to Chrome Browser

Google will soon alert Chrome browser users of weak or compromised passwords. The checks will be in real time as Chrome users visit a password protected website. Bad passwords will trigger a red dialogue box alerting users to take action to better protect their account. The move integrates a...

samba -- multiple vulnerabilities

The samba project reports: Malicious servers can cause Samba client code to return filenames containing path separators to calling code. When the password contains multi-byte non-ASCII characters, the check password script does not receive the full password string. Users with the "get changes"...

CVE-2019-11733

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

CISOs: Support vendor security ops for best cloud results

Data from McKinsey Insights suggests that many CISOs are uneasy about increasing dependence on SaaS applications and the security risks – real or perceived – the cloud represents. Their apprehension isn’t slowing down cloud adoption. As McKinsey put it, “Most companies … will eventually confront...

CVE-2019-15085

CVE-2019-15085 affects PRiSE adAS 1.7.0. The issue is that the current database password is embedded in the change password form, exposing the password to potential access. This vulnerability impacts confidentiality (C) and is classified under CVSS v3.1 as High impact (C:H) with a Network attack ...

There She Breaches! Watch Out For Your Identity Data!

Data breaches keep on coming. Here’s what you can do to stay ahead of the hackers Money makes the world go around. It’s the glue that holds our society together and the engine that drives our economy. But it’s also coveted by a growing global population of highly resourceful and determined...

Hackers steal 560,000 user accounts in XKCD forum breach

By Waqas If you have an account on XKCD change your password right now and also change the password on other accounts in case you used the same password. This is a post from HackRead.com Read the original post: Hackers steal 560,000 user accounts in XKCD forum breach...

SUSE-SU-2019:2258-1 Recommended update for NetworkManager

This update for NetworkManager fixes the following issues: Security issue fixed: - Fixed that passwords are not echoed on terminal when asking for them bsc990204...

A week in security (August 12 – 18)

Last week on Malwarebytes Labs, we took a look at the potential pitfalls of facial recognition technology, looked at ways domestic abuse survivors can secure their data, and explored the education threat landscape. We also kicked off a series looking at the Hidden Bee infection chain, and put...

Information leakage vulnerability in Far Autumn Medical Online Exam System v3.8

Far Autumn Medical Online Examination System adopts the universal test bank management software, applicable to all levels and types of medical schools and hospitals, the content contains the three basic exams for medical and nursing personnel, title exams, licensing exams, academic exams, trainin...

CISA Statement on Iranian Cybersecurity Threats

Cybersecurity and Infrastructure Security Agency CISA Director Christopher C. Krebs has released a statement in response to the recent rise in malicious cyber activity—including spear phishing and brute force attacks—by Iranian regime actors and proxies. CISA encourages users and administrators t...

Troy Hunt: 'Messy' Password Problem Isn't Getting Better

LONDON, UK – The security world is facing a major issue that has led to widespread breaches, data exposure, and more – and it all stems from millions of insecure passwords used for everything from enterprise PCs to internet of things IoT devices. Poor password hygiene – including reusing password...

GHSA-5F7M-MMPC-QHH4 mysql Node.JS Module Vulnerable to Remote Memory Exposure

Versions of mysql before 2.14.0 are vulnerable to remove memory exposure. Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password. Only mysql running on Node.js versions below 6.0.0 are affected due to a throw added in...