Car owners warned of another theft-enabling relay attack

Tesla owners are no strangers to seeing reports of cars being tampered with outside of their control. Back in 2021, a zero-click exploit aided a drone in taking over the cars entertainment system. In 2016, we had a brakes and doors issue. 2020 saw people rewriting key-fob firmware via Bluetooth...

MAL-2022-232 Malicious code in @epc-apps/api-ingestor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1475080989244adedec56990b4f047611496dd13042e21b835e7a53d0e4e7fb5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

QNAP QTS Video Station Multiple Vulnerabilities (QSA-22-14)

QNAP Video Station is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qnap:videostation"; if...

Hospital Management System SQL Injection Vulnerability (CNVD-2022-83601)

Hospital Management System is a hospital management system. A SQL injection vulnerability exists in Hospital Management System v1.0, which includes modules for patient information management, appointment services, and financial management. The vulnerability is related to the lack of validation of...

CVE-2021-44056

An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station...

CVE-2021-44056

An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station...

Authentication flaw

An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station...

CVE-2021-38679

CVE-2021-38679 is an improper authentication vulnerability affecting QNAP NAS running Kazoo Server . The root cause is failure of authentication controls in Kazoo Server, which can allow an attacker to compromise system security. Affected versions include Kazoo Server up to and including 4.11.21,...

PT-2022-10750

Name of the Vulnerable Software and Affected Versions Kazoo Server versions prior to 4.11.22 Description An improper authentication issue has been reported to affect QNAP NAS running Kazoo Server, allowing attackers to compromise the system's security if exploited. Recommendations For Kazoo Serve...

New Malware Used by SolarWinds Attackers Went Undetected for Years

The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent...

CVE-2022-21707 Incorrect Authorization in wasmCloud

wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly WASM actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, b...

SolarWinds Hackers Targeting Government and Business Entities Worldwide

Nobelium, the threat actor attributed to the massive SolarWinds supply chain compromise, has been once again linked to a series of attacks targeting multiple cloud solution providers, services, and reseller companies, as the hacking group continues to refine and retool its tactics at an alarming...

CVE-2021-22410

There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. A module of the client does not verify the input sufficiently. Attackers can exploit this vulnerability by modifying input after logging onto the client. This may compromise the normal service of the client...

Rickroll Grad Prank Exposes Exterity IPTV Bug

UPDATE When Township High School District 214 in Illinois got rickrolled all at once across its six different schools just before graduation, it was more than a meticulously executed senior prank. Cybersecurity star-in-the-making and recent high-school graduate Minh Duong found, and was able to...

3.1M Neiman Marcus Customer Card Details Breached

Dallas-based Neiman Marcus Group is known worldwide as the go-to luxury retailer for the well-heeled. But their reputation for impeccable quality just took a big hit with revelations that the company was breached by an attacker back in May 2020. It took 17 months for the retailer to notice. Just...

Military’s RFID Tracking of Guns May Endanger Troops

Reports that the military has started outfitting firearms with RFID tags for tracking have raised security alarms. The concern: What if the enemy uses the tags to track soldiers on the battlefield? The Department of Defense, the Marines and the Navy have already rejected the RFID tagging tech for...

AD Starter Scan - Kerberoasting

Binary data adsikerberoasting.nbin...

Zero Trust: The Protection Model for the Post-Pandemic World

One year and a half following the start of the COVID-19 pandemic, we're seeing most companies either maintaining their remote work policies or slowly moving to a hybrid model. In fact, an estimated 36.2 million Americans will be working remotely by 2025, which is nearly double pre-pandemic levels...

CVE-2021-33542

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The...

Unspecified vulnerability in Rsync rsync-ssl

Rsync is a suite of data mirroring backup applications for Unix-like systems. A security vulnerability exists in Rsync's rsync-ssl, which can be exploited by an attacker to compromise confidentiality and integrity...