1069 matches found
This Week in Security News: Watering Hole Campaign Operation Earth Kitsune Spying on Users’ Systems and Fancy Bear Imposters Are on a Hacking Extortion Spree
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about a watering hole campaign Trend Micro dubbed ‘Operation Earth Kitsune’ that is spying on users’ systems through compromised...
COVID-19 and Acedia
Note: This isnt my usual essay topic. Still, I want to put it on my blog. Six months into the pandemic with no end in sight, many of us have been feeling a sense of unease that goes beyond anxiety or distress. Its a nameless feeling that somehow makes it hard to go on with even the nice things we...
future-x.de Cross Site Scripting vulnerability OBB-1329755
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-23830
A Cross-Site Request Forgery CSRF vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site...
CVE-2020-23830: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site...
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future when the UID/GID will be recycled.
...
Have I Been Pwned Set to Go Open-Source
Have I Been Pwned, the service that logs data breaches and lets individuals search to see if they’ve been affected by one, is about to go open-source. The result of that, according to its founder, will be additional transparency and security-enhancing features. HIBP, which was kicked off in 2013,...
indiafuturetycoons.com Improper Access Control vulnerability OBB-1250557
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Update on NIST's Post-Quantum Cryptography Program
NIST has posted an update on their post-quantum cryptography program: After spending more than three years examining new approaches to encryption and data protection that could defeat an assault from a quantum computer, the National Institute of Standards and Technology NIST has winnowed the 69...
Paving the Path to Passwordless
Passwords seem to be the digital equivalent of the phrase, “can’t live with ’em, can’t live without ’em.” They’re supposed to protect sensitive information and data, but passwords can also be incredibly frustrating; you shouldn’t use the same one across the board, which means you probably have...
Greening the Digital Economy
COVID-19 and related quarantine protocols have pushed the world even more online than it already was. Global energy consumption for all things digital has been increasing by about 9% per year between 2015 and 2020, and is tracking to be responsible for about 8% of greenhouse gas GHG emission by...
Default credentials
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default...
futureocean.org Cross Site Scripting vulnerability OBB-1208624
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
rio allows a use-after-free buffer access when a future is leaked
When a rio::Completion is leaked, its drop code will not run. The drop code is responsible for waiting until the kernel completes the I/O operation into, or out of, the buffer borrowed by rio::Completion. Leaking the struct will allow one to access and/or drop the buffer, which can lead to a...
CVE-2020-11014
Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the...
systemd: services with DynamicUser can create SUID/SGID binaries
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...
Enabling Workforce Productivity in Challenging Times
As the world shifts to an increasingly virtual environment, Akamai continues to be at the forefront of helping customers enable workforce productivity with Akamai's Enterprise Application Access and Enterprise Threat Protector. From our detailed offer to our recent Edge Live Virtual Summit, where...
SQL Injection Vulnerability in the Website Building System of Hainan Creative Future Culture and Media Co.
Hainan Creative Future Culture Media Co., Ltd. is engaged in brand one-stop service e-commerce advertising consulting services media enterprises. We design complete solutions for users and provide the best advertising support services. There is a SQL injection vulnerability in the website system ...
Microsoft Patch Tuesday, April 2020 Edition
Microsoft today released updates to fix 113 security vulnerabilities in its various Windows operating systems and related software. Those include at least three flaws that are actively being exploited, as well as two others which were publicly detailed prior to today, potentially giving attackers...
SQL Injection Vulnerability in the Website Building System of Hainan Creative Future Culture Media Co.
Hainan Creative Future Culture Media Co., Ltd. is engaged in brand one-stop service e-commerce advertising consulting services media enterprises. We design complete solutions for users and provide the best advertising support services. There is a SQL injection vulnerability in the website system ...