Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost version 9.11.2 and prior versions 9.11.x and version 9.5.10 and prior versions 9.5.x. The vulnerability stems from a failure to protect the MFA code from...

8 security tips for small businesses

Small businesses and startups are known to face some extra challenges when it comes to cybersecurity. Because they don’t have the size or budget to have a fully-fledged dedicated security team, it often comes down to one person that doesn’t have the time to do everything that is recommended or ev...

Google Cloud to Enforce Multi-Factor Authentication by 2025 for All Users

Google's cloud division has announced that it will enforce mandatory multi-factor authentication MFA for all users by the end of 2025 as part of its efforts to improve account security. "We will be implementing mandatory MFA for Google Cloud in a phased approach that will roll out to all users...

PT-2024-8207

Name of the Vulnerable Software and Affected Versions Really Simple Security Free, Pro, and Pro Multisite versions 9.0.0 through 9.1.1.1 Description The Really Simple Security plugins for WordPress are affected by an authentication bypass issue. This is due to improper user check error handling i...

Warning: Hackers could take over your email account by stealing cookies, even if you have MFA

The Federal Bureau of Investigation FBI has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication MFA a user has set up. Here's how it works. Most of us don’t think twice about checking the “Remember...

New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers

Over 1,500 Android devices have been infected by a new strain of Android banking malware called ToxicPanda that allows threat actors to conduct fraudulent banking transactions. "ToxicPanda's main goal is to initiate money transfers from compromised devices via account takeover ATO using a...

Crooks bank on Microsoft’s search engine to phish customers

We identified a new wave of phishing for banking credentials that targets consumers via Microsoft's search engine. A Bing search query for 'Keybank login' currently returns malicious links on the first page, and sometimes as the top search result. We have reported the fraudulent sites to Microsof...

CVE-2024-51561

This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting and manipulating the responses exchanged during the second factor authentication process...

PT-2024-34705 · Aero · Aero

Name of the Vulnerable Software and Affected Versions: Aero affected versions not specified Description: This issue exists due to improper implementation of the OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this by intercepting and manipulating...

CVE-2024-9191

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine...

Okta Verify 安全漏洞

Okta Verify is a lightweight application from Okta that allows you to securely access your apps with two-step verification, ensuring that you and only you have access to your app account. A security vulnerability exists in Okta Verify versions 5.0.2 through 5.3.2, which originates in the Windows...

Foreign Threat Actor Conducting Large-Scale Spearphishing Campaign with RDP Attachments

CISA has received multiple reports of a large-scale spearphishing campaign targeting organizations in several sectors, including government and information technology IT. The foreign threat actor, often posing as a trusted entity, is sending spearphishing emails containing malicious remote deskto...

PT-2024-34165 · Frappe · Press

Name of the Vulnerable Software and Affected Versions: Press versions prior to the version containing commit ba0007c28ac814260f836849bc07d29beea7deb6 Description: The issue concerns a password reset vulnerability in Press, a custom app for Frappe Cloud that manages various services including...

The vulnerability of the microprogrammed software of industrial routers SCALANCE M-800, related to insufficient protection of registration data, allows a hacker to replace other users’ 2FA tokens and expose the protected information.

The vulnerability of the microprogrammed software in industrial routers SCALANCE M-800 is related to insufficient protection for registration data. Exploiting this vulnerability could allow a hacker to replace other users’ 2FA tokens and expose the protected information...

Press 授权问题漏洞

Press is a Frappe open source Frappe custom application running Frappe Cloud. Press suffers from an authorization issue vulnerability that stems from allowing anyone with the right to bypass 2FA access to a mailbox to reset the password...

Sensitive Information Exposure

pterodactyl/panel is vulnerable to Sensitive Information Exposure. The vulnerability is due to the insecure handling of passwords in HTTP query parameters, which are logged in plain text when two-factor authentication is disabled. It can allow unauthorized access if an attacker gains access to...

100 million US citizens officially impacted by Change Healthcare data breach

In April, we reported that a “substantial proportion” of Americans may have had their health and personal data stolen in the Change Healthcare breach. That was based on a report provided by the UnitedHealth Group after the February cyberattack on its subsidiary Change Healthcare. The attack on...

SEC Charges 4 Companies Over Misleading SolarWinds Cyber Attack Disclosures

The U.S. Securities and Exchange Commission SEC has charged four current and former public companies for making "materially misleading disclosures" related to the large-scale cyber attack that stemmed from the hack of SolarWinds in 2020. The SEC said the companies – Avaya, Check Point, Mimecast,...

CVE-2024-49762 Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones...

CVE-2024-49762

CVE-2024-49762 affects the Pterodactyl Panel. When a user disables 2FA, a DELETE request includes the current password in a query parameter. Although TLS encrypts query parameters in transit, many web servers log these parameters in plaintext, potentially exposing passwords from logs if an attack...