99 matches found
PCI DSS 4.0: How to Ensure Full Compliance with New Requirements
The Payment Card Industry Data Security Standard PCI DSS is one of the oldest mainstream requirements for compliance, originating in 2004. The PCI Security Standards Council manages the standard to ensure security for the global payment system. It globally applies to all entities that store,...
CVE-2023-36672
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an...
Fleek Network Releases New Whitepaper for Decentralized Edge Platform
By Owais Sultan Brooklyn, New York, 31 July 2023 – Fleek Network has released a new whitepaper describing the decentralized edge… This is a post from HackRead.com Read the original post: Fleek Network Releases New Whitepaper for Decentralized Edge Platform...
Accelerate compliance with the Landing Zone Accelerator on AWS
Increasing complex compliance requirements is placing a heavy burden on security leaders. To better support organizations' pursuit of FedRAMP High Compliance, AWS launched the Landing Zone Accelerator on AWS. We conducted a thorough evaluation of the solution and shared our findings in the new LZ...
Debian: Security Advisory (DLA-489-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
A Deep Dive into Reversing CODESYS
Industrial Control System ICS networking stacks are often the go-to bogeyman for infosec and cybersecurity professionals, and doubly so for offensive, red-team style security folks. How often have you been new on site, all ready to run a bog-standard nmap scan across the internal address space,...
ICONICS and Mitsubishi Electric Products
1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Low attack complexity Vendor: ICONICS, Mitsubishi Electric Equipment: ICONICS Product Suite Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to write arbitrary files. 3. TECHNICAL...
Internet Bug Bounty: Pause-based desync in Apache HTTPD
Apache was vulnerable to a pause-based desync. This vulnerability is described in detail in my whitepaper here: https://portswigger.net/research/browser-powered-desync-attackspause Impact This enables server-side HTTP Request Smuggling when Apache is deployed as a back-end server, and it also...
MAL-2022-2184 Malicious code in copay-whitepaper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f565f189934fb947f3e16c26e2540927d06043c6ec62bb5b9ae1f2f7c7c4b9a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in copay-whitepaper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f565f189934fb947f3e16c26e2540927d06043c6ec62bb5b9ae1f2f7c7c4b9a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
New Qualys Research Report: Inside a Redline InfoStealer Campaign
The Qualys Threat Research Team continues its efforts to identify and document previously unseen adversary activity to better understand their tactics, techniques, and procedures TTPs and defend against them. Recently we identified a new Redline InfoStealer campaign that spreads via fake cracked...
5G: The Final Frontier
5G: The Final Frontier This story was written by Kevin Mcgrath · April 7th, 2022 Today Trellix Threat Labs is excited to announce the release of a whitepaper dedicated to 5G and its potential security concerns. As we look at the potential of 5G, we foresee it impacting nearly every facet of digit...
STEWS - A Security Tool For Enumerating WebSockets
STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains Fingerprint : determine what WebSockets server is running ...
Evolving Zero Trust—Lessons learned and emerging trends
Looking back at the last two years, to say that our security strategies have evolved would be an understatement. Organizations around the world made overnight transitions to remote work models in response to a global pandemic, forcing them to reassess attack surface areas as they underwent an...
ForgeCert - "Golden" Certificates
ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was released ...
[Whitepaper] XDR vs. NDR/NTA – What do Organizations Truly Need to Stay Safe?
Security teams whose organizations are outside the Fortune 500 are faced with a dilemma. Most teams will have to choose between deploying either a network traffic analysis NTA or network detection and response NDR tool or an endpoint detection and response EDR tool to supplement their existing...
Uniswap Oracle uses wrong prices
Handle cmichel Vulnerability details The Uniswap oracle uses a mock contract with hard-coded prices to retrieve the price which is not feasible in production. Not sure if this is part of the contest, this will probably still be changed? But note that even when using the "real deal"...
Remote code execution
Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe...
