From the Dorm Room to the White House: How Researcher Jack Cable Works to Ensure Election Security

In a recent episode of Security Nation, Rapid7 welcomed Jack Cable, a junior at Stanford University and employee of the U.S. Cybersecutiy and Infrastructure Security Agency, to discuss the importance of ensuring election security beyond just voting machines. Read on as he shares how to fight...

CVE-2020-14512 USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916

GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords...

RSAC 2020: GM's Transportation Future Hinges on Cybersecurity

SAN FRANCISCO — General Motors is working on self-driving cars, cars that monitor heart rates and other vital functions, zero-emission vehicles and more – all underpinned by exceedingly complex coding and relying on ubiquitous connectivity. But there’s a problem. The cyber-talent gap is hitting t...

Designing the Smart Experience at Akamai HQ

We are now 90 days out from a major milestone for Akamai: the opening of our new headquarters in Cambridge, Massachusetts. The state-of-the-art tower in the tech hub of Kendall Square is particularly exciting for me in my dual roles as CIO and SVP of Global Services & Support, because it marks th...

CVE-2019-20446

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially...

Nebraska Medicine Breached By Rogue Employee

Hospital network Nebraska Medicine has disclosed a data breach after a former employee accessed sensitive patient data – including medical records and Social Security numbers. The Nebraska Medicine network encompasses Nebraska’s largest hospital, Nebraska Medical Center, as well as other location...

Europol Shuts Down Over 30,500 Piracy Websites in Global Operation

In a coordinated global law enforcement operation, Europol has taken down more than 30,500 websites for distributing counterfeit and pirated items over the Internet and arrested three suspects. Among other things, the seized domains reportedly offered various counterfeit goods and pirated product...

Ransomware Bites 400 Veterinary Hospitals

National Veterinary Associates NVA, a California company that owns more than 700 animal care facilities around the globe, is still working to recover from a ransomware attack late last month that affected more than half of those properties, separating many veterinary practices from their patient...

CVE-2019-17216

An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort...

Razer: [pay.gold.razer.com] Stored XSS - Order payment

The tester discovered that the pay.gold.razer.com site suffered from a Stored XSS issue that could be used to steal a client id and key. The tester worked with team to provide multiple POCs to help them resolve the issue. Razer appreciates all the assistance from corraldev, which was above and...

Fishwrap Campaign Sways Social Media Users with Old News

An influence operation that recycles old news about terror incidents and re-publishes them as if they were new is making the rounds on social media, according to Recorded Future analysis. The technique, which the researchers have dubbed Fishwrap since it repurposes old news, is also using a speci...

Trump Can’t Make a North Korea Deal on His Own

The Hanoi debacle shows that if you want to make progress with North Korea, you have to put in the work...

CVE-2018-13811

A vulnerability has been identified in SIMATIC STEP 7 TIA Portal All Versions V15.1. Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the...

Extending Public-Private Partnerships with Milipol

By: Loïc Guézo At Trend Micro, we’ve been protecting consumers, SMBs, enterprises and government customers from the latest threats for three decades now. This has required us to build a global team of experienced researchers, state-of-the-art R&D labs and much more, to fuel our industry-leading...

Davolink DVW-3200N

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Davolink Equipment: DVW-3200N Vulnerability: Use of Password Hash With Insufficient Computational Effort 2. RISK EVALUATION Successful exploitation of this vulnerability may result in a remote...

[SECURITY] Fedora 28 Update: rubygem-sinatra-2.0.0-4.fc28

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort...

[SECURITY] Fedora 27 Update: rubygem-sinatra-2.0.0-3.fc27

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort...

Multiple memory safety issues

Affected versions contain multiple memory safety issues, such as: - Unsoundly coercing immutable references to mutable references - Unsoundly extending lifetimes of strings - Adding the Send marker trait to objects that cannot be safely sent between threads This may result in a variety of memory...

LastPass: global properties can be modified across isolated worlds, allowing remote code execution

A major part of the LastPass password manager is content scripts, additional privileged javascript that is injected into pages and can change or monitor content. LastPass use content scripts to search webpages for forms, add additional UI elements, and so on. The reason that it's safe to have...

Pinpointing Targets: Exploiting Web Analytics to Ensnare Victims

Over the past year, FireEye Threat Intelligence has identified suspected nation-state sponsored cyber-actors engaged in a large-scale reconnaissance effort. This effort makes use of web analytics—the technologies to collect, analyze, and report data The individuals behind this activity have amass...