Threatpost Data: Password Managers Are Worth the Risk, Readers Say

Despite a high-profile memory-related vulnerability in password managers capturing headlines last week, a recent Threatpost poll found that 84 percent of respondents use password managers – while only 10 percent said they don’t due to security risks. There have been vulnerabilities found before i...

Hacking the GCHQ Backdoor

Last week, I evaluated the security of a recent GCHQ backdoor proposal for communications systems. Furthering the debate, Nate Cardozo and Seth Schoen of EFF explain how this sort of backdoor can be detected: In fact, we think when the ghost feature is active­ -- silently inserting a secret...

Protecting Critical Infrastructure and Roadways: How Smart Cities Create New Risks

Advanced technology has changed countless facets of everyday life, from internal enterprise processes to consumer pursuits and beyond. Even the design, management and support for large and small cities has shifted thanks to innovative smart city systems. While advanced components to support...

Semrush: Ports are not shown in third-party site redirect warning page.

Summary: Ports are not shown in third-party site redirect warning page Vulnerable Endpoint :- https://www.semrush.com/redirect?urlhttp://example.com:1337 Description: I noticed 311330 this report where you guys fixed a open redirect report by adding a external third-party site redirect warning pa...

As the Government Shutdown Drags on, Security Risks Intensify

From potential nation state hacks to a brain drain, the shutdown has done nothing good for cybersecurity...

The Collection App has a flawed logic vulnerability

The Library is a digital reading application under the banner of Xiamen Jianpao Library, which is a digital reading platform integrating public welfare network library and one-stop reading service. There are logic flaws in the Library's app that allow attackers to use proxy tools to obtain CAPTCH...

CVE-2018-14720 vulnerabilities

Vulnerabilities for packages: hive...

What happens when packages go bad?

I built spritecow.com back in 2011, and I no longer actively maintain it. A few months ago, a user berated me for using a crypto currency miner on the site without their informed consent. And sure enough, the site's JS had a small addition that loaded the mining JS, and sent the result somewhere...

Biometrics: Security Solution or Issue?

NYC – With more transactions occurring online – and subsequently, the number of data breaches increasing – biometrics are moving to the forefront in discussions as a top way to authenticate data securely. However, challenges remain. The method is not yet being widely utilized by consumers or...

Liberapay: Publicly editable GitHub wikis

Hello team, While browsing https://github.com/liberapay I found that many of the repositories have their wikis publicly editable by any GitHub user. The following are some of the affected repositories: https://github.com/liberapay/cardregistration-js-kit/wiki...

Kubernetes user privilege elevation vulnerability, the exposure to security risks-vulnerability warning-the black bar safety net

Recently, Kubernetes open source container software found a key of a user privilege elevation vulnerability, CVE-2018-1002105, which software is today most of the cloud infrastructure of the fixed component. This vulnerability can allow an attacker unrestricted remote access, steal data, or cause...

Parlez-vous Machine?

Have you ever heard of the MQTT or CoAP protocols? No? Well the device on your wrist, and so many devices around you, could be using them right now. MQTT and CoAP are machine-to-machine or M2M protocols. With the rise of the internet of things IoT and operational technology OT, there’s increased...

Old Printer Vulnerabilities Die Hard

Despite copious warnings and efforts by the security community to harden the defenses of printers, they continue to represent a ripe target for attackers. Just this past summer researchers at Check Point found a vulnerability that allowed an attacker to compromise a multi-function printer with fa...

As Black Friday Looms, IoT Gadgets Take the Risk Spotlight

With the holiday shopping season poised to officially kick off this weekend, it’s likely that connected gadgets and toys are high atop many a consumer wish-list. As those of us in the security space know, however, internet of things IoT devices can quickly go from fun to creepy, depending on how...

Improper access control

Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD...

CVE-2018-3285 vulnerabilities

Vulnerabilities for packages: mysql...

CVE-2018-3195 vulnerabilities

Vulnerabilities for packages: mysql...

ICS Tactical Security Trends: Analysis of the Most Frequent Security Risks Observed in the Field

Introduction FireEye iSIGHT Intelligence compiled extensive data from dozens of ICS security health assessment engagements ICS Healthcheck performed by Mandiant, FireEye's consulting team, to identify the most pervasive and highest priority security risks in industrial facilities. The information...

Voting Machines Are Still Absurdly At Risk

A new report details dozens of vulnerabilities across seven models of voting machines—all of which are currently in use...

Security Risks of Government Hacking

Some of us -- myself included -- have proposed lawful government hacking as an alternative to backdoors. A new report from the Center of Internet and Society looks at the security risks of allowing government hacking. They include: Disincentive for vulnerability disclosure Cultivation of a market...