3333 matches found
PT-2021-17066 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: The issue allows an attacker to see all users in the CMS using the API endpoint "/users/id". For each call, they get in response a lot of information about the user, such as email address, firs...
Credential-Stuffing Attack Targets Regional Internet Registry
Regional internet registry RIPE NCC is warning of a credential-stuffing attack against its single sign-on service, RIPE NCC Access, and is encouraging users to implement two-factor authentication 2FA. Click to Register Located in Amsterdam, the Réseaux IP Européens Network Coordination Centre RIP...
Celeb SIM-Swap Crime Ring Stole $100M from U.S. Victims
A posse of alleged SIM-swapping cybercriminals has been rounded up across Europe by law-enforcement after the crooks finagled more than $100 million from U.S. celebrities and their families. Eight people in the U.K. were arrested in connection with the crime ring, in addition to individuals in...
Poor Password Security Led to Recent Water Treatment Facility Hack
New details have emerged about the remote computer intrusion at a Florida water treatment facility last Friday, highlighting a lack of adequate security measures needed to bulletproof critical infrastructure environments. The breach involved an unsuccessful attempt on the part of an adversary to...
Ukrainian Police Arrest Author of World's Largest Phishing Service U-Admin
Law enforcement officials in Ukraine, in coordination with authorities from the U.S. and Australia, last week shut down one of the world's largest phishing services that were used to attack financial institutions in 11 countries, causing tens of millions of dollars in losses. The Ukrainian attorn...
Unspecified Vulnerability in Jetbrains JetBrains Hub
JetBrains Hub is a web-based application from the Czech company JetBrains. The program is capable of integrating multiple JetBrains team tools together. JetBrains Hub suffers from a security vulnerability that stems from the fact that an authenticated user can delete any other user's 2FA settings...
Microsoft Office 365 Attacks Sparked from Google Firebase
A phishing campaign bent on stealing Microsoft login credentials is using Google Firebase to bypass email security measures in Microsoft Office 365, researchers said. Researchers at Armorblox uncovered invoice-themed emails sent to at least 20,000 mailboxes that purport to share information about...
CVE-2021-25759
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...
CVE-2021-25759
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user...
Jetbrains JetBrains Hub 安全漏洞
JetBrains Hub is a web-based application from the Czech company JetBrains. The program is capable of integrating multiple JetBrains team tools together. JetBrains Hub suffers from a security vulnerability that stems from the fact that an authenticated user can delete any other user's 2FA settings...
Tiny Kobalos Malware Bedevils Supercomputers to Steal Logins
A tiny-sized malware that packs a big punch has been targeting supercomputers, especially those used in academia and scientific enterprises. It allows initial access for a variety of follow-on attacks, including credential theft – and potentially data exfiltration or cryptomining. That’s accordin...
Italy CERT Warns of a New Credential Stealing Android Malware
Researchers have disclosed a new family of Android malware that abuses accessibility services in the device to hijack user credentials and record audio and video. Dubbed "Oscorp" by Italy's CERT-AGID and spotted by AddressIntel, the malware "induces the user to install an accessibility service wi...
CVE-2021-3138
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms...
PT-2021-19276 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions 2.7.0 through beta1 Description: A rate-limit bypass issue leads to a bypass of the 2FA requirement for certain forms. Recommendations: For versions 2.7.0 through beta1, update to a version that includes a fix for the...
Discourse 安全漏洞
Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse 2.7.0, which stems from 2FA's reliance on certain forms rate-limit.No details of the vulnerability are currently available...
Help Others Be "Cyber Aware" This Festive Season—And All Year Round!
Are you tired of being the cybersecurity help desk for everyone you know? Are you frustrated with spending all your time securing your corporate environment, only to have to deal with the threat that snuck in through naive end-users? Are you new to security and wondering how you ended up here? Th...
NCSC: Be Cyber Aware, especially during the Christmas season
In early December, the National Cyber Security Centre, a UK-based cybersecurity body and a part of GCHQ, kicked off the next chapter of its Cyber Aware campaign initiative, focusing on online shopping threats during the Christmas season. Cyber Aware is the UK government’s "national campaign on...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
