6307 matches found
Most-Wanted Threatpost Stories of 2020
As 2020 draws to a close, it’s clear that work-from-home security, ransomware, COVID-19-themed social engineering and attacks by nation-states will go down as defining topics for the cybersecurity world for the year. Threatpost also took a retrospective view on what readers were most interested...
Top Security Recommendations for 2021
Happy HaXmas! We hope everyone is having a wonderful holiday season so far. This year has been wild and unpredictable, and has brought unique risks and threats to the forefront of business activities. So, to help everyone stay safer in 2021, the Strategic Advisory Services team here at Rapid7 is...
Nosy Ex-Partners Armed with Instagram Passwords Pose a Serious Threat
Breakups can be traumatic in all sorts of ways. Now we know they can pose a serious cybersecurity threat too. A new survey found that an alarming number of people are still accessing their exes’ accounts without their knowledge — a handful for malicious reasons. The survey conducted during Novemb...
A “quick wins” approach to securing Azure Active Directory and Office 365 and improving your security posture
In the last post, we discussed Office 365 and how enabling certain features without understanding all the components can lead to a false sense of security. We demonstrated how implementing a break glass account, multi-factor authentication MFA, and the removal of legacy authentication can help...
A “quick wins” approach to securing Azure Active Directory and Office 365 and improving your security posture
In the last post, we discussed Office 365 and how enabling certain features without understanding all the components can lead to a false sense of security. We demonstrated how implementing a break glass account, multi-factor authentication MFA, and the removal of legacy authentication can help...
Help Others Be "Cyber Aware" This Festive Season—And All Year Round!
Are you tired of being the cybersecurity help desk for everyone you know? Are you frustrated with spending all your time securing your corporate environment, only to have to deal with the threat that snuck in through naive end-users? Are you new to security and wondering how you ended up here? Th...
NCSC: Be Cyber Aware, especially during the Christmas season
In early December, the National Cyber Security Centre, a UK-based cybersecurity body and a part of GCHQ, kicked off the next chapter of its Cyber Aware campaign initiative, focusing on online shopping threats during the Christmas season. Cyber Aware is the UK government’s "national campaign on...
PT-2020-17293 · Logmein · Logmein Lastpass Password Manager
Name of the Vulnerable Software and Affected Versions: LogMein LastPass Password Manager version 4.8.11.2403 Description: An issue was discovered in the LogMein LastPass Password Manager app for iOS, where the password authentication for unlocking can be bypassed by forcing the authentication...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
Authentication flaw
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
Frappe Authorization Issues Vulnerability
Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from the Frappe team. A security vulnerability exists in Frappe two-factor authentication, which stems from the fact that the system also responds by sending a 2fa secret key during two-factor...
NSA Warns: Patched VMware Bug Under Active Attack
Active attacks against a flaw in VMware’s Workspace One Access continue, three days after the vendor patched the vulnerability and urged customers to fix the bug classified as a zero-day at the time. Now the U.S. National Security Agency NSA has escalated concerns and on Monday warned that foreig...
Protect Yourself from Holiday Cyber Threats – Ask the Howlers, Episode 16 Highlights
In episode 16 of “Ask the Howlers,” host Stacia Tympanick, senior solution engineer, met up with Ryan Hendricks, staff architect and manager, to discuss the latest topics concerning cybersecurity impacting the online holiday shopping season. Check out some highlights from the discussion and gain...
The US Used the Patriot Act to Justify Logging Website Users
Plus: Better Twitter two-factor, a Spotify hack, and more of the week’s top security news...
Nextcloud: Two-factor authentication enforcement bypass
the attacker could bypass the two-factor authentication enforcement Steps to reproduce 1. Login with an Administrator account. 2. Click on your administrator profile icon. 3. Users - Add group - group name: Enforcement. 4. New User - Username: Bypass - Password: NextCloudEnforcement - Add User in...
CVE-2020-29136
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach SEC-575...
Spotify resets some user logins after hacker database found floating online
A team of researchers working for vpnMentor has found a treasure trove in the form of an unsecured Elasticsearch database containing over 380 million records. The trove contained login credentials and other data belonging to Spotify users. So whats Spotify doing leaving its user data hanging arou...