304 matches found
Remote Code Execution (RCE)
winter/storm is vulnerable to Remote Code Execution. An authenticated attacker with permission to to create or modify theme templates with the cms editor can disable the cms.enableSafeMode feature, allowing for the modification of the backend.php code through the web interface...
Remote Code Execution (RCE)
winter/storm is vulnerable to Remote Code Execution. An authenticated attacker with permission to create or modify theme templates with the cms editor can disable the cms.enableSafeMode feature, allowing for the modification of the backend php code through the web interface...
GHSA-Q37H-JHF3-85CJ Bypass of CMS Safe Mode Security Feature
Impact Authenticated users with permissions to create or modify theme template objects through the backend "CMS" editor can exploit this vulnerability to bypass the cms.enableSafeMode security feature if enabled disables modification of PHP code through the web interface when enabled. This is onl...
Bypass of CMS Safe Mode Security Feature
Impact Authenticated users with permissions to create or modify theme template objects through the backend "CMS" editor can exploit this vulnerability to bypass the cms.enableSafeMode security feature if enabled disables modification of PHP code through the web interface when enabled. This is onl...
Welcome to the Burner Phone Olympics
China’s Winter Games are overshadowed by human rights problems and overreaching state surveillance...
FBI: Use a Burner Phone at the Olympics
Use a burner phone if you’re traveling to the Olympics, the FBI warned on Tuesday, lest you come home with a nasty case of malware and/or snatched personal data. The FBI didn’t mention specific threats, per se, but its alert warned those traveling to the February 2022 Beijing Winter Olympics and...
Heartland OA2021 Winter Snow Edition suffers from a logic flaw vulnerability (CNVD-2022-13942)
Heartland OA is developed based on the SaaS architecture of cloud computing model to meet the needs of government cloud, industrial cloud, education cloud and other intelligent cloud platform construction. A logic flaw vulnerability exists in Heartland OA2021 Winter Snow Edition, which can be...
Experts Shed Light On Distinctive Tactics Used by Hades Ransomware
Cybersecurity researchers on Tuesday disclosed "distinctive" tactics, techniques, and procedures TTPs adopted by operators of Hades ransomware that set it apart from the rest of the pack, attributing it to a financially motivated threat group called GOLD WINTER. "In many ways, the GOLD WINTER...
Kia Motors Hit With $20M Ransomware Attack – Report
So far, Kia Motors America has publicly acknowledged an “extended system outage,” but ransomware gang DoppelPaymer claimed it has locked down the company’s files in a cyberattack that includes a $20 million ransom demand. That $20 million will gain Kia a decryptor and a guarantee to not to publis...
How kids coped with COVID-hit winter holidays
Due to the pandemic situation in late 2020, street festivities got canceled worldwide. For many families, get-togethers with grandparents over the Christmas period were also put on hold. As a result, children across the globe sought holiday fun and games from the comfort of home. And thanks to...
DOJ Charges 6 Sandworm APT Members in NotPetya Cyberattacks
The Department of Justice DOJ on Monday announced charges against six Russian nationals who are allegedly tied to the Sandworm APT. The threat group is believed to have launched several high-profile cyberattacks over the past few years – including the destructive NotPetya cyberattack that targete...
winter-mit-familie.de Cross Site Scripting vulnerability OBB-1348219
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
winter-creation.com Cross Site Scripting vulnerability OBB-1278388
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
winter-creation.com Cross Site Scripting vulnerability OBB-1226227
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Quarterly Report: Incident Response trends in fall 2019
By David Liebenberg and Kendall McKay. While many Cisco Talos Incident Response CTIR engagements have shown similar patterns over the past two quarters, we’re seeing a dangerous trend emerge this winter. Threat actors are increasingly combining the exfiltration of sensitive data along with data...
Details of the Olympic Destroyer APT
Interesting details on Olympic Destroyer, the nation-state cyberattack against the 2018 Winter Olympic Games in South Korea. Wired's Andy Greenberg presents evidence that the perpetrator was Russia, and not North Korea or China...
Security fix for the ALT Linux 10 package samba version 4.9.4-alt1
Dec. 20, 2018 Evgeny Sinelnikov 4.9.4-alt1 - Update to first winter security release - Security fixes regressions: + CVE-2018-16853 Do not segfault if client is not set + CVE-2018-14629 Fix CNAME loop prevention using counter regression...
USN-3795-1 libssh vulnerability
Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this issue to bypass authentication without any credentials...
What's New in Performance
One of the things I like most about living in New England is the changing of seasons. I find myself looking forward, thinking about what's exciting about the next one. Each season offers something unique and special, and if you're ambitious enough to try new things, a variety of new opportunities...
Hackers Who Hit Winter Olympics 2018 Are Still Alive and Kicking
Remember the 'Olympic Destroyer' cyber attack? The group behind it is still alive, kicking and has now been found targeting biological and chemical threat prevention laboratories in Europe and Ukraine, and a few financial organisation in Russia. Earlier this year, an unknown group of notorious...