CVE-2021-21688

An incorrect access restriction vulnerability was found in Jenkins. The FilePathreadingFileVisitor does not reject any operations giving users unrestricted read access with certain operations creating archives, copyRecursiveTo. This may allow an attacker to get access to restricted data. Mitigati...

mi-webdev.com Improper Access Control vulnerability OBB-2226309

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

What is Twitch?

Twitch is primarily a site dedicated to live streaming content. It also offers the ability to chat with others in the Stream you happen to be in via text. The primary draw of Twitch streams is video games and e-sports, leading to the rise of many big name streamers and content creators. Is Twitch...

Celebrity jewelry house Graff falls victim to ransomware

Data on countless celebrities, including politicians, is apparently now in the hands of ransomware attackers after a group using the Conti variant compromised systems of one of the world’s most exclusive jewelry houses, Graff. Despite what mathematicians like to think, there is an exception to...

Automation Enables Innovation in the Cloud

As public cloud adoption continues to grow year after year, we see more and more enterprises realizing the strategic advantage the cloud can provide to help deliver new and innovative products quicker, roll out new features with ease, and reach new customers. But along with those advantages comes...

Kingdee Cloud Star Management Center has an arbitrary file reading vulnerability

Kingdee Cloud Star Management Center is a new generation of strategic enterprise management software developed by Kingdee Software China Co. based on cloud computing, big data, social, artificial intelligence, Internet of Things and other cutting-edge technologies. There is an arbitrary file...

Nation-State Attacker of Telecommunications Networks

Someone has been hacking telecommunications networks around the world: LightBasin aka UNC1945 is an activity cluster that has been consistently targeting the telecommunications sector at a global scale since at least 2016, leveraging custom tools and an in-depth knowledge of telecommunications...

Gigabyte Allegedly Hit by AvosLocker Ransomware

The AvosLocker ransomware gang is claiming that it breached tech giant Gigabyte and has leaked a sample of what it claims are files stolen from the Taiwanese company’s network. It’s offering to sell the rest. On Wednesday, the gang posted a “press release” announcing that it had purportedly gutte...

VPN Exposes Data for 1M Users, Leading to Researcher Questioning

Free virtual private network VPN service Quickfox, which provides access to Chinese websites from outside the country, exposed the personally identifiable information PII of more than a million users in just the latest high-profile VPN security failure. The incident has some security practitioner...

Employees Make Best Frontline Phishing Defense

The cybersecurity good news and bad news about phishing attacks is employees can be an enterprise’s weakest link or strongest first line of defense. Yes, we are talking about inboxes, human nature and the increasingly sophisticated number of phishing attacks. The Federal Bureau of Investigation...

Design/Logic Flaw

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: UI Infrastructure. The supported version that is affected is 6.4.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation...

CVE-2021-35585

CVE-2021-35585 is a documented vulnerability in the Oracle Incentive Compensation UI of Oracle E-Business Suite. Affected, supported versions are 12.1.1–12.1.3. The issue is exploitable by a low-privilege, network-accessible attacker over HTTP, leading to unauthorized creation/deletion/modificati...

CVE-2021-35563

CVE-2021-35563 affects Oracle Shipping Execution in Oracle E-Business Suite (component: Workflow Events). Affected versions: 12.2.6–12.2.10. The vulnerability allows a low-privileged, network-accessible attacker over HTTP to compromise data, enabling unauthorized creation, deletion, or modificati...

Time to Build Accountability Back into Cybersecurity

In the age of remote work — where hybrid teams work out of offices, houses and coffee shops using a multitude of devices — presents challenges in terms of understanding who’s responsible for ensuring proper cyber-hygiene across the perimeter-less footprint. Suffice it to say that cybersecurity ha...

“Killware”: Is it just as bad as it sounds?

On October 12, after interviewing US Secretary of Homeland Security Alejandro Mayorkas, USA TODAY’s editorial board warned its readers about a dangerous new form of cyberattack under this eye-catching headline: “The next big cyberthreat isnt ransomware. Its killware. And its just as bad as it...

Verizon’s Visible Wireless Carrier Confirms Credential-Stuffing Attack

On Wednesday, Verizon’s Visible – an all-digital, uber-cheap wireless carrier – confirmed what customers have been complaining about on Reddit and Twitter all week: They lost control of their accounts; had their passwords and shipping addresses changed; and some got stuck with bills for pricey ne...

CVE-2020-19961

ZZCMS 2019 is vulnerable to a SQL injection via the subzs.php component, affecting ZZCMS versions around 2019. The root cause is lack of proper input filtering/escaping in subzs.php, enabling an attacker to retrieve sensitive database data. Public disclosures come from multiple sources (NVD, Red ...

30 Mins or Less: Rapid Attacks Extort Orgs Without Ransomware

In less time than it takes to get a stuffed crust pizza delivered, a new group called SnapMC can breach an organization’s systems, steal their sensitive data, and demand payment to keep it from being published, according to a new report from NCC Group’s threat intelligence team — no ransomware...

Germ-term, but all year. How criminals are hacking schools

In some schools, the autumn term is often called “germ-term” due to the number of bugs the children bring back after the summer holidays. It usually calms down after a few weeks, however, with hacking there is no slow down. Its all year, its relentless. In the last 10 months of this year schools...

10 Phishing Stats That’ll Make Your C-Suite Think

Wanting to run a phishing simulation is one thing, but persuading colleagues of the importance of doing so is another. You need to keep your organization safe, not just satisfy basic compliance requirements. You need to improve security awareness and colleague behaviors, throughout your...