6308 matches found
CVE-2018-7213
The Password Manager Extension in Abine Blur 7.8.242 before 7.8.2428 allows attackers to bypass the Multi-Factor Authentication and macOS disk-encryption protection mechanisms, and consequently exfiltrate secured data, because the right-click context menu is not secured...
Financial Cyber Threat Sharing Group Phished
The Financial Services Information Sharing and Analysis Center FS-ISAC, an industry forum for sharing data about critical cybersecurity threats facing the banking and finance industries, said today that a successful phishing attack on one of its employees was used to launch additional phishing...
Memcached-fueled 1.3 Tbps attacks
At 17:28 GMT, February 28th, Akamai experienced a 1.3 Tbps DDoS attack against one of our customers, a software development company, driven by memcached reflection. This attack was the largest attack seen to date by Akamai, more than twice the size of the September, 2016 attacks that announced th...
How to Fight Mobile Number Port-out Scams
T-Mobile, AT&T and other mobile carriers are reminding customers to take advantage of free services that can block identity thieves from easily "porting" your mobile number out to another provider, which allows crooks to intercept your calls and messages while your phone goes dark. Tips for...
Memcached UDP Reflection Attacks
Akamai is aware of a new DDoS reflection attack vector: UDP-based memcached traffic. Memcached is a tool meant to cache data and reduce strain on heavier data stores, like disk or databases. The protocol allows the server to be queried for information about key value stores and is only intended t...
Nextcloud: twofactor_auth bypassable if provider fails to load
Just want to preface this by saying that this is probably not a significant vulnerability, as it requires that the server either have recently been incorrectly upgraded or otherwise misconfigured. However in the administration of my own personal NextCloud instance I have hit this several times...
ReelPhish: A Real-Time Two-Factor Phishing Tool
Social Engineering and Two-Factor Authentication Social engineering campaigns are a constant threat to businesses because they target the weakest chain in security: people. A typical attack would capture a victim’s username and password and store it for an attacker to reuse later. Two-Factor...
CVE-2018-6389 WordPress Parameter Resource Consumption Remote DoS
Yesterday Monday, February 5, 2018, a zero-day vulnerability in WordPress core was disclosed, which allows an attacker to perform a denial of service DoS attack against a vulnerable application. The vulnerability exists in the modules used to load JS and CSS files. These modules were designed to...
A week in security (January 22 – January 28)
Last week on Labs, we analyzed a rogue app outbreak on Twitter, took a look at how Singapore's government is faring with network defense, and rolled out our 2017 State of Malware report. We also became visionaries in Gartner's Magic Quadrant report and explored a VR data mishap. Other news Man...
Cybersecurity New Year’s resolutions, you say? Why not.
It's mid-January, and oh, how time flies. It wasn’t long since we bid farewell to 2017 and welcomed the new year with renewed hope and vigor. Of course, with such positivity comes a sense of an equally favorable outlook for the year ahead. However good that may sound, being faced with a tabula ra...
WordPress Two-Factor Authentication – Clockwork SMS plugin <=1.0.3 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability found by Elias Dimopoulos in WordPress Two-Factor Authentication – Clockwork SMS plugin versions =1.0.3 Solution Update the WordPress Two-Factor Authentication – Clockwork SMS plugin to the latest available version at least 1.1.0...
Akamaizing Your Dev & QA Environments
Over the last few months, I've been talking to many development and test teams who deliver their sites and applications through the Akamai Intelligent Platform. One common challenge they face is how to test their Akamai delivery configurations on the Internet against their private development and...
BankBot Returns On Play Store – A Never Ending Android Malware Story
Even after so many efforts by Google for making its Play Store away from malware, shady apps somehow managed to fool its anti-malware protections and infect people with malicious software. A team of researchers from several security firms has uncovered two new malware campaigns targeting Google...
CVE-2017-16634
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method...
CVE-2017-16634
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method...
CVE-2017-16634
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method...
Authentication flaw
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method...
CVE-2017-16634: Improper Authentication
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method...
CVE-2017-16634
CVE-2017-16634 affects Joomla! 3.x prior to 3.8.2 and stems from a bug in the core authentication flow that allows bypassing a user’s two‑factor authentication method. The connected Nessus entries corroborate authentication bypass for Joomla! versions under 3.8.2. The documented remediation is to...
