CopperStealer Malware Targets Facebook and Instagram Business Accounts

A malware that until now has gone undocumented has been quietly hijacking online accounts of advertisers and users of Facebook, Apple, Amazon, Google and other web giants since July 2019 and then using them for nefarious activity, researchers have found. Dubbed CopperStealer, the malware acts...

How Akamai Can Help You Fight the Latest Exploitation Attempts Against Microsoft Exchange

Co-authored by Ryan Barnett. AppSec Protections for Microsoft Exchange CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 On March 2, 2021, the Microsoft Security Response Center alerted its customers to several critical security updates to Microsoft Exchange Server, addressing...

ALERT: Malicious Amazon Alexa Skills Can Easily Bypass Vetting Process

Researchers have uncovered gaps in Amazon's skill vetting process for the Alexa voice assistant ecosystem that could allow a malicious actor to publish a deceptive skill under any arbitrary developer name and even make backend code changes after approval to trick users into giving up sensitive...

Fedora 33 : prosody (2021-a639ec5d6e)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-a639ec5d6e advisory. - Prosody 0.11.8 ============== This is a new minor release for the 0.11.x stable branch, it includes bug fixes and performance improvements! Upstream would...

atomic-openshift: cross-namespace owner references can trigger deletions of valid children

A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects...

CVE-2020-13186

An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link...

CVE-2020-13858

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations...

PT-2021-9675

Name of the Vulnerable Software and Affected Versions Mofi Network MOFI4500-4GXeLTE versions 3.6.1-std through 4.0.8-std Description An issue was discovered in Mofi Network MOFI4500-4GXeLTE devices, where two undocumented administrator accounts, sftp and mofidev, are defined in /etc/passwd. The...

CVE-2021-25138

creationtimestamp| type| source ---|---|--- 2021-01-29 23:25:23+00:00| seen| https://t.me/cibsecurity/22867...

Microsoft surpasses $10 billion in security business revenue, more than 40 percent year-over-year growth

I joined Microsoft a little more than six months ago—amid a global pandemic and a new norm of remote work, as well as one of the most rapidly evolving threat landscapes in history. We’ve witnessed more sophisticated attacks, like the recent SolarWinds incident, as well as an increase in attack...

TikTok Flaw Lay Bare Phone Numbers, User IDs For Phishing Attacks

A vulnerability in the popular TikTok short-form video-sharing platform could have allowed attackers to easily compile users’ phone numbers, unique user IDs and other data ripe for phishing attacks. TikTok, owned by ByteDance, has more than 800 million active users worldwide. The vulnerability,...

[SECURITY] Fedora 33 Update: awstats-7.8-2.fc33

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy server...

CVE-2020-35952

login.php in PHPFusion aka PHP-Fusion Andromeda 9.x before 2020-12-30 generates error messages that distinguish between incorrect username and incorrect password i.e., not a single "Incorrect username or password" message in both cases, which might allow enumeration...

VideoBytes: Offensive security tools and the bad guys that use them

Hello Folks! In this Videobyte, we’re talking about what penetration testing tools malware gangs love to use and why they are better than what you can get on the black market. This article describes the VirusBulletin talk of a security researcher from Interzer Labs, Paul Litvak, in which he...

CVE-2020-25111

creationtimestamp| type| source ---|---|--- 2020-12-12 02:35:51+00:00| seen| https://t.me/cibsecurity/20650 2020-12-12 02:38:52+00:00| seen| https://t.me/cibsecurity/20670 2020-12-12 03:25:19+00:00| seen| https://t.me/cibsecurity/20690 2020-12-12 04:07:06+00:00| seen| https://t.me/cibsecurity/207...

CVE-2020-15375

creationtimestamp| type| source ---|---|--- 2020-12-12 00:36:03+00:00| seen| https://t.me/cibsecurity/20561 2020-12-12 00:45:55+00:00| seen| https://t.me/cibsecurity/20581 2020-12-12 01:05:11+00:00| seen| https://t.me/cibsecurity/20600 2020-12-12 01:25:19+00:00| seen| https://t.me/cibsecurity/206...

PGMiner, Innovative Monero-Mining Botnet, Surprises Researchers

An innovative Linux-based cryptocurrency mining botnet has been uncovered, which exploits a disputed PostgreSQL remote code-execution RCE vulnerability to compromise database servers. The malware is unusual and completely novel in a host of ways, researchers said. According to researchers at Palo...

CVE-2020-25838

creationtimestamp| type| source ---|---|--- 2020-12-11 07:35:17+00:00| seen| https://t.me/cibsecurity/19778 2020-12-11 07:38:16+00:00| seen| https://t.me/cibsecurity/19798 2020-12-11 08:25:33+00:00| seen| https://t.me/cibsecurity/19818 2020-12-11 09:25:28+00:00| seen| https://t.me/cibsecurity/198...

New Grelos Skimmer Variants Siphon Credit Card Data

Just as seasonal online shopping kicks into high gear, new variants of the point-of-sale Grelos skimmer malware have been identified. Variants are targeting the payment-card data of online retail shoppers on dozens of compromised websites, researchers warn. The Grelos skimmer malware has been...

AudimexEE Cross-Site Scripting Vulnerability

AudimexEE is an auditing software for large organizations. A cross-site scripting vulnerability exists in AudimexEE versions prior to 14.1.1, which allows remote attackers to perform web script or html injection via action, cargo, panel, leading to data leakage if the uniqueerrornumbers security...