Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn

On October 10, 2022, there were 576,562 LinkedIn accounts that listed their current employer as Apple Inc. The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at Amazon comes as LinkedIn is struggling to combat a...

Malicious Package

Overview @moonactive-innersource/ins-profiles-service-sdk-nodejs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore,...

Cloudfox - Automating Situational Awareness For Cloud Penetration Tests

CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. CloudFox helps you answer the following commo...

Glut of Fake LinkedIn Profiles Pits HR Against the Bots

A recent proliferation of phony executive profiles on LinkedIn is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities -- which pair AI-generated profile photos wit...

Fake CISO Profiles on LinkedIn Target Fortune 500s

Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer CISO roles at some of the worlds largest corporations. Its not clear whos behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are...

CVE-2022-27967

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

CVE-2022-27968

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET request sent to /WebApp/SettingsFileMonitor/GetFileMonitorProfiles...

CVE-2022-27967

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

Design/Logic Flaw

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET request sent to /WebApp/SettingsFileMonitor/GetFileMonitorProfiles...

Design/Logic Flaw

Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/SettingsExclusion/GetExclusionsProfiles...

CVE-2022-27968

Cynet 360 Web Portal prior to v4.5 is vulnerable. Affected component: the GET endpoint /WebApp/SettingsFileMonitor/GetFileMonitorProfiles allows attackers to access a list of monitored files and profiles through a crafted request. Root cause: insufficient access control on the GetFileMonitorProfi...

CVE-2022-27967

CVE-2022-27967 affects Cynet 360 Web Portal versions prior to 4.5. The issue enables an unauthenticated/indirect access to a list of excluded files and profiles through a crafted GET request to the endpoint "/WebApp/SettingsExclusion/GetExclusionsProfiles". The exposed data comprises excluded fil...

PT-2022-18727 · Cynet · Cynet 360 Web Portal

Name of the Vulnerable Software and Affected Versions: Cynet 360 Web Portal versions prior to 4.5 Description: The issue allows attackers to access a list of excluded files and profiles via a crafted GET request sent to "/WebApp/SettingsExclusion/GetExclusionsProfiles". Recommendations: For...

PT-2022-18728 · Cynet · Cynet 360 Web Portal

Name of the Vulnerable Software and Affected Versions: Cynet 360 Web Portal versions prior to 4.5 Description: The issue allows attackers to access a list of monitored files and profiles via a crafted GET request sent to "/WebApp/SettingsFileMonitor/GetFileMonitorProfiles". Recommendations: For...

Ubuntu: Security Advisory (USN-859-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-38392

creationtimestamp| type| source ---|---|--- 2022-08-17 22:40:28+00:00| seen| https://t.me/cibsecurity/48295 2022-08-19 12:01:44+00:00| seen| https://t.me/habrcomnews/9053 2022-08-19 13:08:50+00:00| seen| https://t.me/codebysec/6433 2022-08-19 13:50:04+00:00| seen| https://t.me/truesecator/3313...

Google Android安全漏洞

Google Android is a Linux-based open source operating system from the American company Google. A security vulnerability exists in Google Android 13. An attacker exploited the vulnerability to escalate local privileges and enable working profiles...

Massive Losses Define Epidemic of ‘Pig Butchering’

U.S. state and federal investigators are being inundated with reports from people whove lost hundreds of thousands or millions of dollars in connection with a complex investment scam known as "pig butchering," wherein people are lured by flirtatious strangers online into investing in cryptocurren...

Cross site scripting

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...

CVE-2022-31136 Cross-site Scripting in BookWyrm

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as...