CVE-2021-34404

Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allow an unprivileged attacker with physical access to cause denial of service or impact integrity and confidentiality beyond the security scope of BROM...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a fully integrated set of global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, etc. Scripting is one of the scripting management console components. A...

A New Destructive Malware Targeting Ukrainian Government and Business Entities

Cybersecurity teams from Microsoft on Saturday disclosed they identified evidence of a new destructive malware operation dubbed "WhisperGate" targeting government, non-profit, and information technology entities in Ukraine amid brewing geopolitical tensions between the country and Russia. "The...

Real Big Phish: Mobile Phishing & Managing User Fallibility

According to a recent survey from Ivanti, nearly three-quarters 74 percent of IT professionals reported that their organizations have fallen victim to a phishing attack – and 40 percent of those happened in the last month alone. Increasingly, mobile phishing is the culprit. What’s more, nearly ha...

Automating Agent-less Vulnerability Assessment for Intune Enrolled Mobile Devices

Most Mobile Device Management solutions lack critical functionality such as vulnerability assessment and patch management. Integration with a popular MDM like Microsoft Intune allows Qualys to provide automated onboarding and continuous scanning of your mobile devices, among other functions to...

New York AG Warns 17 Firms of Credential Attacks

New York Attorney General Letitia James reported 1.1 million credentials tied to 17 “well known” state businesses were compromised in recent cyberattacks. According to the alert, many of the firms were unaware that that their customer’s passwords had been compromised. The bulletin was issued...

Cyberattackers Hit Data of 80K Patients at Fertility Centers of Illinois

The protected health information of nearly 80,000 patients of Fertility Centers of Illinois FCI may have been pawed over by cyber intruders following a cyberattack. FCI runs four clinics across Illinois. According to the U.S. Department of Health and Human Services HHS Office for Civil Rights’ da...

3.7M FlexBooker Records Dumped on Hacker Forum

A threat group that identifies itself as Uawrongteam is dumping data stolen from FlexBooker – a popular online appointment scheduling tool for booking services ranging from counseling to haircuts – on a cybercriminal forum. FlexBooker sent a notification to its users, explaining that its Amazon A...

1.1M Compromised Accounts Found at 17 Major Companies

There have been more than 1.1 million online accounts compromised in a series of credential-stuffing attacks against 17 different companies, according to a New York State investigation. Credential-stuffing attacks, such as last year’s attack on Spotify, use automated scripts to try high volumes o...

Broward Breach Highlights Healthcare Supply-Chain Problems

This week’s announcement by Florida’s Broward Health System that the most intimate medical data of 1,357,879 of its patients was breached in the fall should serve as a warning that the healthcare software supply chain will be a juicy target for cybercriminals as we head into 2022, researchers war...

Uber Bug, Ignored for Years, Casts Doubt on Official Uber Emails

A security vulnerability that would allow malicious attackers to send email from Uber’s network appears to be closed – but users could have been swindled already. The easy-to-find bug has been hanging around for years, ready to take Uber’s customers for a ride of a very different sort. According ...

McMenamins Data Breach Affects 12 Years of Employee Info

A ransomware attack on the McMenamins dining and hospitality empire in the Pacific Northwest came along with a data breach covering 12 years of employee data, the organization has confirmed. The Dec. 12 incident – which some have attributed to the Conti gang – forced McMenamins to shut down vario...

T-Mobile’s latest data breach exposed users to SIM swapping attacks

By Waqas T-Mobile is the only telecom giant to suffer at least three known data breaches in 2021. This is a post from HackRead.com Read the original post: T-Mobiles latest data breach exposed users to SIM swapping attacks...

IoT SAFE — An Innovative Way to Secure IoT

By the end of 2021, there will be 12 billion connected IoT devices, and by 2025, that number will rise to 27 billion. All these devices will be connected to the internet and will send useful data that will make industries, medicine, and cars more intelligent and more efficient. However, will all...

Police forces pipe 225 million pwned passwords into ‘Have I Been Pwned?’

On his blog, Troy Hunt has announced a major milestone in the ‘Have I Been Pwned?’ project, thanks to the contributions of two of the worlds foremost law enforcement agencies, the FBI and the NCA the UK equivalent of the FBI, the National Crime Agency. This enormous injection of used passwords ha...

Conti Gang Suspected of Ransomware Attack on McMenamins

A family-run chain of hotels and restaurants this week has been grappling with the aftermath of a ransomware attack that occurred last weekend that may have exposed employees’ sensitive personal data, according to multiple reports. The incident – which some have attributed to the Conti gang –...

Sql injection

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter providerid, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI...

FatPipe WARP, IPVPN, and MPVPN Authorization Vulnerability (CNVD-2021-101934)

FatPipe is a WAN redundancy technology from FatPipe USA that provides companies with automated and dynamic failover as a result of a WAN component or service failure resulting in a data line connection outage.A security vulnerability exists in FatPipe WARP, IPVPN and MPVPN, which stems from a lac...

HTCondor has unspecified vulnerabilities

HTCondor is a workload management system. HTCondor has a security vulnerability that could be exploited by an attacker to take control of other users' jobs or read secrets from their data...

OpenEMR SQL Injection Vulnerability (CNVD-2021-103511)

OpenEMR is an open source healthcare management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing applications. openEMR is vulnerable to SQL injection, which can be exploited by...