MoleRats using Facebook, Dropbox, Google Docs to spread malware

By Deeba Ahmed Cybereason researchers have identified an ongoing espionage campaign using three yet unidentified malware variants. This is a post from HackRead.com Read the original post: MoleRats using Facebook, Dropbox, Google Docs to spread malware...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Log4j. Vulnerability Details CVEID: CVE-2020-9488 DESCRIPTION: Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appende...

openSUSE Security Update : the Linux Kernel (openSUSE-2020-2034)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2020-28915: A buffer over-read at the framebuffer layer in the fbcon code could be used by local attackers to read kernel memory, aka CID-6735b4632def bnc1178886. -...

Security update for neomutt (moderate)

openSUSE Security Update: Security update for neomutt Announcement ID: openSUSE-SU-2020:2127-1 Rating: moderate References: 1172906 1172935 1173197 1179035 1179113 Cross-References: CVE-2020-14093 CVE-2020-14154 CVE-2020-14954 CVE-2020-28896 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15....

Google Services Weaponized to Bypass Security in Phishing, BEC Campaigns

A spike in recent phishing and business email compromise BEC attacks can be traced back to criminals learning how to exploit Google Services, according to research from Armorblox. Social distancing has driven entire businesses into the arms of the Google ecosystem looking for a reliable, simple w...

Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser

Throughout 2020, ransomware activity has become increasingly prolific, relying on an ecosystem of distinct but co-enabling operations to gain access to targets of interest before conducting extortion. Mandiant Threat Intelligence has tracked several loader and backdoor campaigns that lead to the...

Security update for nextcloud (moderate)

openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2020:1652-1 Rating: moderate References: 1171572 1171579 1177346 Cross-References: CVE-2020-8154 CVE-2020-8155 CVE-2020-8183 CVE-2020-8228 CVE-2020-8233 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1...

CVE-2020-25634

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs...

koa2-swagger-ui (2.2.1), md-docs-express (>=0.0.1, <=0.0.2) potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.0.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory: GHSA-388G-JWPG-X6J4...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: OSV:GHSA-4F9M-PXWH-68HG...

koa2-swagger-ui (2.2.1), md-docs-express (>=0.0.1, <=0.0.2) potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.0.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.2 Source cves: unknown CVE Source advisory: OSV:GHSA-388G-JWPG-X6J4...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: GHSA-4F9M-PXWH-68HG...

Fedora: Security Advisory for python3-docs (FEDORA-2020-c3b07cc5c9)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Lark Technologies: Stored XSS & SSRF in Lark Docs

A stored XSS cross site scripting vulnerability was discovered in Lark Docs that could be escalated into a Server Side Request Forgery SSRF vulnerability if opened in a headless browser on the Lark server. The vulnerability has been resolved. We thank @mike12 for reporting this to our team and...

[SECURITY] Fedora 32 Update: python3-3.8.3-1.fc32

Python is an accessible, high-level, dynamically typed, interpreted program ming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the...

org.apache.nifi.registry:nifi-registry-assembly (>=0.1.0, <=0.5.0), org.apache.nifi.registry:nifi-registry-docs (>=0.4.0, <=0.5.0) potentially affected by CVE-2020-9482 via org.apache.nifi.registry:nifi-registry-web-api (>=0.1.0, <=0.5.0)

org.apache.nifi.registry:nifi-registry-web-api MAVEN version =0.1.0, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2020-9482 Source advisory: MEND:CVE-2020-9482...

python27:2.7 security, bug fix, and enhancement update

An update is available for python-pymongo, python2-rpm-macros, python-docutils, pytest, python-psycopg2, python-PyMySQL, python-lxml, PyYAML, python-pytest-mock, python-attrs, python-jinja2, python-docs, python-requests, python-mock, python-ipaddress, python-funcsigs, python-py, python-chardet,...

Huawei EulerOS: Security Advisory for polkit (EulerOS-SA-2019-1070)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 30 Update: python3-3.7.6-1.fc30

Python is an accessible, high-level, dynamically typed, interpreted program ming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the...

[SECURITY] Fedora 31 Update: python3-3.7.6-1.fc31

Python is an accessible, high-level, dynamically typed, interpreted program ming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the...