62 matches found
How to Tell a Job Offer from an ID Theft Trap
One of the oldest scams around -- the fake job interview that seeks only to harvest your personal and financial data -- is on the rise, the FBI warns. Heres the story of a recent LinkedIn impersonation scam that led to more than 100 people getting duped, and one almost-victim who decided the job...
Why Password Hygiene Needs a Reboot
In today's digital world, password security is more important than ever. While biometrics, one-time passwords OTP, and other emerging forms of authentication are often touted as replacements to the traditional password, today, this concept is more marketing hype than anything else. But just becau...
Protect Kubernetes Clusters with Admission Controller
Discover the power of admission controllers. Container security can be challenging, but this article will teach you how to guard your Kubernetes clusters against threats by screening containers before they even initialize...
Fake Trezor app steals more than $1 million worth of crypto coins
Several users of Trezor, a small hardware device that acts as a cryptocurrency wallet, have been duped by a fake app with the same name. The app was available on Google Play and Apple’s App Store and also claimed to be from SatoshiLabs, the creators of Trezor. According to the Washington Post, th...
mammographie-screening-online.de Cross Site Scripting vulnerability OBB-1340490
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Thermal Imaging as Security Theater
Seems like thermal imaging is the security theater technology of today. These features are so tempting that thermal cameras are being installed at an increasing pace. They're used in airports and other public transportation centers to screen travelers, increasingly used by companies to screen...
Google Bans 600 Android Apps from Play Store for Serving Disruptive Ads
Google has banned nearly 600 Android apps from the Play Store for bombarding users with disruptive ads and violating its advertising guidelines. The company categorizes disruptive ads as "ads that are displayed to users in unexpected ways, including impairing or interfering with the usability of...
CVE-2019-12426
CVE-2019-12426 affects Apache OFBiz versions 16.11.01 through 16.11.06. An unauthenticated actor could access information on certain backend screens by invoking setSessionLocale, leading to information disclosure. The available connected sources corroborate unauthenticated information exposure in...
Dow Jones’ screening watchlist data exposed online
By Waqas A database hosted on Amazon Web Services AWS and owned by Dow Jones has accidentally been exposed putting approx. 2.4 million corporate entities and individuals at risk of data theft. Reportedly, the exposed database comprises sensitive information about terrorists, criminals, and shady...
Can Everybody Read the US Terrorist Watch List?
After years of claiming that the Terrorist Screening Database is kept secret within the government, we have now learned that the DHS shares it "with more than 1,400 private entities, including hospitals and universities...." Critics say that the watchlist is wildly overbroad and mismanaged, and...
Don't Fear the TSA Cutting Airport Security. Be Glad That They're Talking about It.
Last week, CNN reported that the Transportation Security Administration is considering eliminating security at U.S. airports that fly only smaller planes -- 60 seats or fewer. Passengers connecting to larger planes would clear security at their destinations. To be clear, the TSA has put forth no...
High network usage after you implement file screening on a Windows Server 2012 R2-based Work Folders sync server
High network usage after you implement file screening on a Windows Server 2012 R2-based Work Folders sync server This article describes an issue that occurs on a Windows Server 2012 R2-based Work Folders sync server. You can fix this issue by using the update in this article. Before you install...
Hack The Pentagon Bug Bounty Opens April 18
The Department of Defense announced today that registration for its Hack the Pentagon bug bounty trial program is open, and that the program will be run on the HackerOne platform. The trial of the government’s first bug bounty program will run April 18 to May 12. The DoD said only certain...
USN-2545-1 linux-lts-utopic vulnerabilities
A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges. CVE-2013-7421 A flaw was...
Fedora 20 : gnupg-1.4.17-1.fc20 (2014-7676)
New upstream v1.4.17 - Avoid DoS due to garbled compressed data packets. - Screen keyserver reponses to avoid import of unwanted keys by rogue servers. - Add hash algorithms to the 'sig' records of the colon output. - More specific reason codes for INVRECP status. - Drop gpg.ru.1 Note that Tenabl...
Localize: XSS in main page (invitation)
If a project name is saved with a XSS string such as: “!-- and a translator visits and requests and invite, it'll result in the xss executing in the main page, due to the fact that it shows your requests. Screen: http://prntscr.com/3awwuv...
Edward Snowden asylum : Hong Kong, Ecuador and Iceland
Edward Snowden, an American former contractor for the National Security Agency NSA, came forward as the whistle-blower in one of the biggest internal leaks in U.S. intelligence history now seeking asylum According to the United Nations High Commissioner for Refugees, Snowden would not be given...
Applicants Coerced Into Surfing Facebook While Employers Watch
If you want to get that slick job you’ve been gunning for, you might have to suffer a bit of snooping. According to recent news reports, employers are increasingly asking applicants for jobs to submit their user credentials or asking to watch while applicants peruse their own social media account...
Oracle Java ICC Screening Tag Parsing Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Runtime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Java...
Rogue iPhone Apps Explored at Black Hat
Lax security screening at Apple’s App Store and a design flaw are putting iPhone users at risk of downloading malicious apps that could steal data and spy on them, a Swiss researcher warns at Black Hat DC. Read the full article. cnet...