6307 matches found
2-Factor Authentication Bypass Flaw Reported in cPanel and WHM Software
cPanel, a provider of popular administrative tools to manage web hosting, has patched a security vulnerability that could have allowed remote attackers with access to valid credentials to bypass two-factor authentication 2FA protection on an account. The issue, tracked as "SEC-575" and discovered...
Spotify Users Hit with Rash of Account Takeovers
Subscribers of Spotify streaming music service may have experienced some disruption, thanks to a likely credential-stuffing operation. Credential stuffing takes advantage of people who reuse the same passwords across multiple online accounts. Attackers will use IDs and passwords stolen from anoth...
Mirosoft advises ditching voice, SMS multi-factor authentication
By Deeba Ahmed Microsoft wants users to opt for securer technologies citing multi-factor authentication MFA as the "least secure" method available nowadays. This is a post from HackRead.com Read the original post: Mirosoft advises ditching voice, SMS multi-factor authentication...
Worried About SaaS Misconfigurations? Check These 5 Settings Everybody Misses
Enterprises depend on SaaS applications for countless functions, like collaboration, marketing, file sharing, and more. But problematically, they often lack the resources to configure those apps to prevent cyberattacks, data exfiltration, and other risks. Catastrophic and costly data breaches...
Worried About SaaS Misconfigurations? Check These 5 Settings Everybody Misses
Enterprises depend on SaaS applications for countless functions, like collaboration, marketing, file sharing, and more. But problematically, they often lack the resources to configure those apps to prevent cyberattacks, data exfiltration, and other risks. Catastrophic and costly data breaches...
openSUSE Security Update : phpMyAdmin (openSUSE-2020-1806)
This update for phpMyAdmin fixes the following issues : phpMyAdmin was updated to 4.9.7 boo1177842 : - Fix two factor authentication that was broken in 4.9.6 - Fix incompatibilities with older PHP versions Update to 4.9.6 : - Fixed XSS relating to the transformation feature boo1177561...
EulerOS Virtualization 3.0.6.6 : bind (EulerOS-SA-2020-2444)
According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker...
SwiftyInsta - Instagram Unofficial Private API Swift
Instagram offers two kinds of APIs to developers. The Instagram API Platform extremely limited in functionality and close to being discontinued, and the Instagram Graph API for Business and Creator accounts only. However, Instagram apps rely on a third type of API , the so-called Private API or...
NICER Protocol Deep Dive: Internet Exposure of Citrix ADC/NetScaler
Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...
The Story Behind Security Breaches
There are many potential causes of security breaches, including malicious attacks, system glitches, equipment failures, software bugs, and zero days. What is a common root cause here? Human error. According to Micke Ahola, “In a security context, human error means unintentional actions—or lack of...
CVE-2020-8236
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it...
OPENSUSE-SU-2020:1806-1 Security update for phpMyAdmin
This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.7 boo1177842: Fix two factor authentication that was broken in 4.9.6 Fix incompatibilities with older PHP versions Update to 4.9.6: - Fixed XSS relating to the transformation feature boo1177561 CVE-2020-26934,...
National Cybersecurity Awareness Month: Security Pros Offer Top Tips for Staying Safe Online
Held every October, CISA’s National Cybersecurity Awareness Month NCSAM aims to educate organizations and individuals about the ever-changing field of cybersecurity and encourage proper security practices. In honor of this event, we rounded up six key tips from our network of experts to help you...
CVE-2020-8236: Improper Authentication
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it...
Lock and Code S1Ep18: Finding consumer value in Cybersecurity Awareness Month with Jamie Court
This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Jamie Court, president of the non-profit advocacy group Consumer Watchdog, about the consumer value in Cybersecurity Awareness Month. Launched initially ...
Vmware Horizon DaaS Bypass Two-Factor Authentication
The vulnerability of the software for deploying virtual computers and Vmware Horizon DaaS applications is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to bypass the two-factor authentication process...
CVE-2020-15909
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
Session fixation
SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...
NICER Protocol Deep Dive: Internet Exposure of IMAP and POP
Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...