PT-2021-3758

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 92.0.4515.131 Microsoft Edge affected versions not specified Description The issue is related to an out of bounds write in the Tab Groups component of Google Chrome and Microsoft Edge browsers. This occurs when...

Ransomware Is Getting Ugly

Modern ransomware has two dimensions: pay to get your data back, and pay not to have your data dumped on the Internet. The DC police are the victims of this ransomware, and the criminals have just posted personnel records -- "including the results of psychological assessments and polygraph tests;...

GameStop FOMO Inspires a New Wave of Crypto Pump-and-Dumps

Thousands of would-be investors are joining Discord groups that promise big earnings by manipulating the crypto market...

Chromium: CVE-2021-30511 Out of bounds read in Tab Groups

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

KLA12176 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A use after free vulnerability in...

Telegram Fraudsters Ramp Up Forged COVID-19 Vaccine Card Sales

Telegram groups are being abused by fraudsters peddling fake COVID-19 vaccination cards to the unvaccinated and anti-vaxxer communities, according to researchers. Brittany Allen, trust and safety architect at Sift, noticed the illicit sales on the encrypted messaging platform as the COVID-19...

Google Chromium Buffer Overflow Vulnerability (CNVD-2021-34712)

Google Chromium is an open source web browser from Google USA. A security vulnerability previously existed in Google Chromium version 90.0.4430.212. The vulnerability stems from an out-of-scope read security issue found in the program's "Tab Groups" component. No details of the vulnerability are...

Google Chrome buffer error vulnerability

Google Chromium is an open source web browser from Google USA. A security vulnerability previously existed in Google Chromium version 90.0.4430.212. The vulnerability stems from an out-of-scope read security issue found in the program's "Tab Groups" component. No details of the vulnerability are...

Stopping Carbanak+FIN7: How Microsoft led in the MITRE Engenuity® ATT&CK® Evaluation

In MITRE Engenuity’s recent Carbanak+FIN7 ATT&CK Evaluation, Microsoft demonstrated that we can stop advanced, real-world attacks by threat actor groups with our industry-leading security capabilities. In this year’s evaluation, we engaged our unified Microsoft 365 Defender stack, with...

Stopping Carbanak+FIN7: How Microsoft led in the MITRE Engenuity® ATT&CK® Evaluation

In MITRE Engenuity’s recent Carbanak+FIN7 ATT&CK Evaluation, Microsoft demonstrated that we can stop advanced, real-world attacks by threat actor groups with our industry-leading security capabilities. In this year’s evaluation, we engaged our unified Microsoft 365 Defender stack, with...

ALPINE-CVE-2021-20254

A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache...

UBUNTU-CVE-2021-20254

A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache...

PT-2024-11094

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a deadlock that occurs when cloning inline extents and using qgroups in the btrfs file system. This happens because when reserving metadata space for a transactio...

Spotlight on Cybercriminal Supply Chains

An examination of cybercrime ecosystems reveals it mirrors legitimate financial organization and market systems. “Cybercriminals need to move money and pay employees in their organization just like any other company,” said Derek Manky Chief Security Insights & Global Threat Alliances at Fortinet’...

Pulse Secure Critical Zero-Day Security Bug Under Active Exploit

A critical zero-day security vulnerability in Pulse Secure VPN devices has been exploited by nation-state actors to launch cyberattacks against U.S. defense, finance and government targets, as well as victims in Europe, researchers said. Download “The Evolution of Ransomware” to gain valuable...

BlackCat CMS 1.3.6 - (Multiple) Stored Cross-Site Scripting (XSS) Vulnerability

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)

Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting XSS Date: 04/07/2021 Exploit Author: Ömer Hasan Durmuş Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Step 1 : Login to admin account in...

CVE-2021-30496

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service application crash if the victim pastes an attacker-supplied message e.g., in the Persian language into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that...

Carbanak and FIN7 Attack Techniques

What happens in Carbanak and FIN7 attacks? Here are some techniques used by these financially motivated threat groups that target banks, retail stores, and other establishments...

The Storybook Approach to MITRE ATT&CK

Read this year’s MITRE Engenuity ATT Evaluations story, which simulates techniques associated with notorious threat groups Carbanak and FIN7 to test solutions' ability to detect and stop APT & Targeted Attacks...