3265 matches found
Zoom Lied about End-to-End Encryption
The facts arent news, but Zoom will pay $85M -- to the class-action attorneys, and to users -- for lying to users about end-to-end encryption, and for giving user data to Facebook and Google without consent. The proposed settlement would generally give Zoom users $15 or $25 each and was filed...
Zoom and gloom? Video comms org agrees to settle for $85m
Zoom has agreed to an $85m settlement regarding privacy, zoom-bombing, and data sharing. The class action privacy lawsuit filed in the US against the embattled company wasn’t particularly impressed with the following: Zoom-bombing running wild in video sessions. Zoom-bombing, the practice of...
CVE-2021-24447
The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard...
CVE-2021-24447
The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard...
Design/Logic Flaw
The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard...
CVE-2021-24447
The CVE covers the WordPress plugin WP Image Zoom, vulnerable before version 1.47. The root cause is lack of validation of the tab parameter used in include_once(), leading to a Local File Inclusion in the admin dashboard. Public sources consistently describe a local file inclusion vulnerability,...
WordPress 路径遍历漏洞
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin WP Image Zoom has a file inclusion vulnerability in versions prior to 1.47. The vulnerability stems...
Fake Zoom App Dropped by New APT ‘Luminous Moth’
Researchers have spotted a weird one: A newly identified threat actor linked to China that’s first mass-attacking, but then cherry-picking, just a few targets to hit with malware and data exfiltration. Kaspersky researchers said in a Wednesday writeup that they’ve named the advanced threat actor...
China's Cyberspies Targeting Southeast Asian Government Entities
A sweeping and "highly active campaign" that originally set its sights on Myanmar has broadened its focus to strike a number of targets located in the Philippines, according to new research. Russian cybersecurity firm Kaspersky, which first spotted the infections in October 2020, attributed them ...
LuminousMoth APT: Sweeping attacks for the chosen few
APT actors are known for the frequently targeted nature of their attacks. Typically, they will handpick a set of targets that in turn are handled with almost surgical precision, with infection vectors, malicious implants and payloads being tailored to the victims identities or environment. Its no...
Cisco 7000 Series IP Camera Memory Leak Vulnerability
The Cisco 7000 Series IP cameras are 5 megapixel, high definition, outdoor fixed dome cameras in vandal resistant enclosures with pan/tilt/zoom functionality.The Cisco 7000 Series IP camera implementation of Link Layer Discovery Protocol LLDP in firmware versions prior to 2.12.4 is vulnerable to ...
WordPress WP Image Zoom plugin <= 1.46 - Local File Inclusion (LFI) vulnerability
Local File Inclusion vulnerability discovered by apple502j in WordPress WP Image Zoom plugin versions = 1.46. Solution Update the WordPress WP Image Zoom plugin to the latest available version at least 1.47.1...
WP Image Zoom < 1.47 - Local File Inclusion
The plugin did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard PoC PoC: https://example.com/wp-admin/admin.php?page=zoooomsettings=whatever This URL shows includeonce error, which indicates that the paramet...
WP Image Zoom < 1.47 - Local File Inclusion
The plugin did not validate its tab parameter before using it in the includeonce function, leading to a local file inclusion issue in the admin dashboard PoC: https://example.com/wp-admin/admin.php?page=zoooomsettings&tab=whatever This URL shows includeonce error, which indicates that the paramet...
The vulnerability of the client’s execution file airhost.exe allows unauthorized access to protected information when conducting real-time audio and video conferences using Zoom Client for Meetings.
The vulnerability of the airhost.exe executable file used by clients for real-time audio and video conferencing with Zoom Client for Meetings is related to the rigid encoding of registration data when using the SHA-256 hashing algorithm. Exploiting this vulnerability can allow a malicious...
Security and Human Behavior (SHB) 2021
Today is the second day of the fourteenth Workshop on Security and Human Behavior. The University of Cambridge is the host, but were all on Zoom. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m keynoting the all-virtual RSA Conference 2021, May 17-20, 2021. I’m keynoting the 5th International Symposium on Cyber Security Cryptology and Machine Learning via Zoom, July 8-9, 2021. I’ll be speaking at an Informa event on...
Zoom deepfaker fools politicians…twice
We recently said deepfakes “remain the weapon of choice for malign interference campaigns, troll farms, revenge porn, and occasionally humorous celebrity face-swaps”. Skepticism that these techniques would work on a grand scale such as an election, remains in place. In the realm of malign...
Windows, Ubuntu, Zoom, Safari, MS Exchange Hacked at Pwn2Own 2021
The 2021 spring edition of Pwn2Own hacking contest concluded last week on April 8 with a three-way tie between Team Devcore, OV, and Computest researchers Daan Keuper and Thijs Alkemade. A total of $1.2 million was awarded for 16 high-profile exploits over the course of the three-day virtual even...
