Security and Human Behavior (SHB) 2021

Today is the second day of the fourteenth Workshop on Security and Human Behavior. The University of Cambridge is the host, but were all on Zoom. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro...

kernel: malicious USB devices can lead to multiple out-of-bounds write

An out-of-bounds write flaw was found in the Linux kernel’s HID drivers. An attacker, able to plug in a malicious USB device, can crash the system or read and write to memory with an incorrect address...

On the Taxonomy and Evolution of Ransomware

Given the frequency with which “ransomware” appears in news articles, it may be worthwhile to take a step back and actually consider what the term means. Any malware or attack that culminates in extorting ransom from the victim is commonly referred to as ransomware. The general idea is to encrypt...

kernel: possible out of bounds write in kbd_keycode of keyboard.c

A flaw out of bounds write in the Linux kernel human interface devices subsystem was found in the way user calls find key code by index. A local user could use this flaw to crash the system or escalate privileges on the system...

MINTHCM Weak Password Requirement Vulnerability

MINTHCM is a MINTHCM open source application. A human resource management software. A weak password requirement vulnerability exists in the Create New User function in MintHCM RELEASE version 3.0.8, which can be exploited by an attacker to brute-force password cracking...

SQL Injection Vulnerability in Lansing Sky Human Resource Management System

Ltd. is a focus on human resources management software research, development and solutions for high-tech enterprises. Lanxin Tianji human resources management system SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive information in the database...

Beyond MFA: Rethinking the Authentication Key

You have to hand it to the cyber-thieves: They have proven extremely adept at defeating security measures once thought reliable. Case in point: multifactor authentication MFA. While two-factor authentication 2FA using push text notifications has become the de-facto standard for login security, ba...

Threat spotlight: DarkSide, the ransomware used in the Colonial Pipeline attack

Late last week, the business network systems of Colonial Pipeline, the biggest supplier of fuels on the East Coast of the United States, were compromised due to a ransomware attack, forcing the company to temporarily shut down its operations while investigations are underway. Monday morning,...

CVE-2021-25660

A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" incl. SIPLUS variants All versions V15.1 Update 6, SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" incl. SIPLUS variants All versions V16 Update 4, SIMATIC HMI Comfort Panels V15 4" - 22" incl. SIPLUS...

Visualize and Analyze Bots with Real User Monitoring

You interact with more than just customers on your website. Bots make up a disproportionate amount of traffic, which can skew human behavior analysis data -- and cause you to make the wrong business decisions. In fact, one Akamai customer with 30% of total traffic from bots noticed a huge gap in...

CVE-2021-27383

A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" incl. SIPLUS variants All versions V15.1 Update 6, SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" incl. SIPLUS variants All versions V16 Update 4, SIMATIC HMI Comfort Panels V15 4" - 22" incl. SIPLUS...

Visualize and Analyze Bots with Real User Monitoring

You interact with more than just customers on your website. Bots make up a disproportionate amount of traffic, which can skew human behavior analysis data -- and cause you to make the wrong business decisions...

myrights.gov.ge Cross Site Scripting vulnerability OBB-2010339

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| myrights.gov.ge ---|--- Open Bug Bounty...

Vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle E-Business Suite. This component allows unauthorized access by attackers to devices.

The vulnerability of the sub-component of the French HR component of the Oracle HRMS system, a business automation system from Oracle’s E-Business Suite, is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device...

LIVE Webinar — The Rabbit Hole of Automation

The concept of automation has taken on a life of its own in recent years. The idea is nothing new, but the current interest in automation is a mix of both hype and innovation. On the one hand, it's much easier today to automate everything from small processes to massive-scale tasks than it's ever...

Human Resource Information System 0.1 Remote Code Execution

Exploit Title: Human Resource Information System 0.1 - Remote Code Execution Unauthenticated Date: 04-05-2021 Exploit Author: Reza Afsahi Vendor Homepage: https://www.sourcecodester.com Software Link:...

Why Retailers Fail to Stop Shopping Bots

In the 1970s the United States encountered an “oil embargo” that dramatically curtailed people from being able to purchase gasoline for their vehicles. “No Gas Today” signs were everywhere. Gas rationing was imposed by only allowing car owners to buy gas based on whether the final numbers on thei...

Denial of Service Vulnerability in CenturyStar Configuration Software (CNVD-2021-35746)

Century Star Configuration Software is an obstruction software launched by Beijing Century Changqiu Technology Co., Ltd. is a real-time human-machine interface utility program generator, consisting of the CSMaker development system and CSViewer runtime system, the CSMaker development system is th...

MintHCM Cross-Site Scripting Vulnerability

MINTHCM is a human resources management software developed by MINTHCM MintHCM A cross-site scripting vulnerability exists in version 3.0.8. The vulnerability stems from the Import feature that allows an attacker to perform cross-site scripting XSS loads in file uploads, which can be exploited by ...

Authorization Bypass

java is vulnerable to Authorization Bypass. A difficult to exploit vulnerability allows unauthenticated attacker with network access to affect intgrity of the system. The attack requires human interaction from a person other than the attacker...