FreshRSS

🔒
△ 🔃
☐ ☆ ✇ The Hacker News

Hackers Exploit Job Boards, Stealing Millions of Resumes and Personal Data

By Newsroom — February 6th 2024 at 10:14
Employment agencies and retail companies chiefly located in the Asia-Pacific (APAC) region have been targeted by a previously undocumented threat actor known as ResumeLooters since early 2023 with the goal of stealing sensitive data. Singapore-headquartered Group-IB said the hacking crew's activities are geared towards job search platforms and the theft of resumes, with as many as 65
☐ ☆ ✇ The Hacker News

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

By Newsroom — January 22nd 2024 at 16:35
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to projects can be hijacked through domain name purchases and since most default build configurations are vulnerable, it would be difficult or even impossible to know whether an attack was being performed
☐ ☆ ✇ The Hacker News

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

By Newsroom — January 18th 2024 at 12:34
Continuous integration and continuous delivery (CI/CD) misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks. The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of TensorFlow releases on GitHub and PyPi by compromising TensorFlow's build agents via
☐ ☆ ✇ The Hacker News

Opera MyFlaw Bug Could Let Hackers Run ANY File on Your Mac or Windows

By Newsroom — January 15th 2024 at 13:58
Cybersecurity researchers have disclosed a now-patched security flaw in the Opera web browser for Microsoft Windows and Apple macOS that could be exploited to execute any file on the underlying operating system. The remote code execution vulnerability has been codenamed MyFlaw by the Guardio Labs research team owing to the fact that it takes advantage of a feature called My Flow that
☐ ☆ ✇ The Hacker News

Chinese Hackers Exploit Zero-Day Flaws in Ivanti Connect Secure and Policy Secure

By Newsroom — January 11th 2024 at 05:29
A pair of zero-day flaws identified in Ivanti Connect Secure (ICS) and Policy Secure have been chained by suspected China-linked nation-state actors to breach less than 10 customers. Cybersecurity firm Volexity, which identified the activity on the network of one of its customers in the second week of December 2023, attributed it to a hacking group it tracks under the name UTA0178
☐ ☆ ✇ The Hacker News

Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution

By Newsroom — January 5th 2024 at 07:42
Ivanti has released security updates to address a critical flaw impacting its Endpoint Manager (EPM) solution that, if successfully exploited, could result in remote code execution (RCE) on susceptible servers. Tracked as CVE-2023-39336, the vulnerability has been rated 9.6 out of 10 on the CVSS scoring system. The shortcoming impacts EPM 2021 and EPM 2022 prior to SU5. “If exploited, an
☐ ☆ ✇ The Hacker News

New JavaScript Malware Targeted 50,000+ Users at Dozens of Banks Worldwide

By Newsroom — December 21st 2023 at 12:38
A new piece of JavaScript malware has been observed attempting to steal users' online banking account credentials as part of a campaign that has targeted more than 40 financial institutions across the world. The activity cluster, which employs JavaScript web injections, is estimated to have led to at least 50,000 infected user sessions spanning North America, South America, Europe, and Japan.
☐ ☆ ✇ The Hacker News

Bug or Feature? Hidden Web Application Vulnerabilities Uncovered

By The Hacker News — December 15th 2023 at 11:08
Web Application Security consists of a myriad of security controls that ensure that a web application: Functions as expected. Cannot be exploited to operate out of bounds. Cannot initiate operations that it is not supposed to do. Web Applications have become ubiquitous after the expansion of Web 2.0, which Social Media Platforms, E-Commerce websites, and email clients saturating the internet
☐ ☆ ✇ The Hacker News

New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks

By Newsroom — December 14th 2023 at 06:30
A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific (APAC) region since at least September 2023. "GambleForce uses a set of basic yet very effective techniques, including SQL injections and the exploitation of vulnerable website content management systems (CMS) to steal sensitive
☐ ☆ ✇ The Hacker News

Zyxel Releases Patches to Fix 15 Flaws in NAS, Firewall, and AP Devices

By Newsroom — December 1st 2023 at 06:22
Zyxel has released patches to address 15 security issues impacting network-attached storage (NAS), firewall, and access point (AP) devices, including three critical flaws that could lead to authentication bypass and command injection. The three vulnerabilities are listed below - CVE-2023-35138 (CVSS score: 9.8) - A command injection vulnerability that could allow an
☐ ☆ ✇ The Hacker News

Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine

By Newsroom — November 28th 2023 at 10:33
A coordinated law enforcement operation has led to the arrest of key individuals in Ukraine who are alleged to be a part of several ransomware schemes. "On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne, and Vinnytsia, resulting in the arrest of the 32-year-old ringleader," Europol said in a statement today. "Four of the ringleader's most active
☐ ☆ ✇ The Hacker News

CISA Sets a Deadline - Patch Juniper Junos OS Flaws Before November 17

By Newsroom — November 14th 2023 at 06:03
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given a November 17, 2023, deadline for federal agencies and organizations to apply mitigations to secure against a number of security flaws in Juniper Junos OS that came to light in August. The agency on Monday added five vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active
☐ ☆ ✇ The Hacker News

Citrix Devices Under Attack: NetScaler Flaw Exploited to Capture User Credentials

By Newsroom — October 10th 2023 at 05:52
A recently disclosed critical flaw in Citrix NetScaler ADC and Gateway devices is being exploited by threat actors to conduct a credential harvesting campaign. IBM X-Force, which uncovered the activity last month, said adversaries exploited "CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user
☐ ☆ ✇ Naked Security

Ghostscript bug could allow rogue documents to run system commands

By Paul Ducklin — July 4th 2023 at 17:57
Even if you've never heard of the venerable Ghostscript project, you may have it installed without knowing.

☐ ☆ ✇ The Hacker News

MITRE Unveils Top 25 Most Dangerous Software Weaknesses of 2023: Are You at Risk?

By Ravie Lakshmanan — June 30th 2023 at 05:44
MITRE has released its annual list of the Top 25 "most dangerous software weaknesses" for the year 2023. "These weaknesses lead to serious vulnerabilities in software," the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said. "An attacker can often exploit these vulnerabilities to take control of an affected system, steal data, or prevent applications from working." The list is
☐ ☆ ✇ The Hacker News

Critical SQL Injection Flaws Expose Gentoo Soko to Remote Code Execution

By Ravie Lakshmanan — June 28th 2023 at 07:24
Multiple SQL injection vulnerabilities have been disclosed in Gentoo Soko that could lead to remote code execution (RCE) on vulnerable systems. "These SQL injections happened despite the use of an Object-Relational Mapping (ORM) library and prepared statements," SonarSource researcher Thomas Chauchefoin said, adding they could result in RCE on Soko because of a "misconfiguration of the database.
☐ ☆ ✇ The Hacker News

New Mockingjay Process Injection Technique Could Let Malware Evade Detection

By Ravie Lakshmanan — June 27th 2023 at 14:22
A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers Thiago Peixoto, Felipe Duarte, and Ido Naor said in a report shared with The Hacker News. "The
☐ ☆ ✇ The Hacker News

Alert! Hackers Exploiting Critical Vulnerability in VMware's Aria Operations Networks

By Ravie Lakshmanan — June 21st 2023 at 05:00
VMware has flagged that a recently patched critical command injection vulnerability in Aria Operations for Networks (formerly vRealize Network Insight) has come under active exploitation in the wild. The flaw, tracked as CVE-2023-20887, could allow a malicious actor with network access to the product to perform a command injection attack, resulting in remote code execution. It impacts VMware
☐ ☆ ✇ Naked Security

MOVEit mayhem 3: “Disable HTTP and HTTPS traffic immediately”

By Paul Ducklin — June 15th 2023 at 22:10
Twice more unto the breach... third patch tested and released, shut down web access until you've applied it

mi-1200

☐ ☆ ✇ The Hacker News

New Critical MOVEit Transfer SQL Injection Vulnerabilities Discovered - Patch Now!

By Ravie Lakshmanan — June 10th 2023 at 08:50
Progress Software, the company behind the MOVEit Transfer application, has released patches to address brand new SQL injection vulnerabilities affecting the file transfer solution that could enable the theft of sensitive information. "Multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain
☐ ☆ ✇ The Hacker News

Cacti, Realtek, and IBM Aspera Faspex Vulnerabilities Under Active Exploitation

By Ravie Lakshmanan — April 1st 2023 at 04:51
Critical security flaws in Cacti, Realtek, and IBM Aspera Faspex are being exploited by various threat actors in hacks targeting unpatched systems. This entails the abuse of CVE-2022-46169 (CVSS score: 9.8) and CVE-2021-35394 (CVSS score: 9.8) to deliver MooBot and ShellBot (aka PerlBot), Fortinet FortiGuard Labs said in a report published this week. CVE-2022-46169 relates to a critical
☐ ☆ ✇ The Hacker News

Researchers Detail Severe "Super FabriXss" Vulnerability in Microsoft Azure SFX

By Ravie Lakshmanan — March 30th 2023 at 17:02
Details have emerged about a now-patched vulnerability in Azure Service Fabric Explorer (SFX) that could lead to unauthenticated remote code execution. Tracked as CVE-2023-23383 (CVSS score: 8.2), the issue has been dubbed "Super FabriXss" by Orca Security, a nod to the FabriXss flaw (CVE-2022-35829, CVSS score: 6.2) that was fixed by Microsoft in October 2022. "The Super FabriXss vulnerability
☐ ☆ ✇ The Hacker News

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

By Ravie Lakshmanan — February 1st 2023 at 19:59
Cybersecurity researchers have disclosed details of two security flaws in the open source ImageMagick software that could potentially lead to a denial-of-service (DoS) and information disclosure. The two issues, which were identified by Latin American cybersecurity firm Metabase Q in version 7.1.0-49, were addressed in ImageMagick version 7.1.0-52, released in November 2022. <!--adsense--> A
☐ ☆ ✇ Naked Security

Credit card skimming – the long and winding road of supply chain failure

By Paul Ducklin — December 8th 2022 at 19:58
Don't keep calling home to a JavaScript server that closed its doors eight years ago!

☐ ☆ ✇ The Hacker News

Researchers Reported Critical SQLi and Access Flaws in Zendesk Analytics Service

By Ravie Lakshmanan — November 15th 2022 at 13:49
Cybersecurity researchers have disclosed details of now-patched flaws in Zendesk Explore that could have been exploited by an attacker to gain unauthorized access to information from customer accounts that have the feature turned on. "Before it was patched, the flaw would have allowed threat actors to access conversations, email addresses, tickets, comments, and other information from Zendesk
☐ ☆ ✇ The Hacker News

Critical Vulnerability Discovered in Atlassian Bitbucket Server and Data Center

By Ravie Lakshmanan — August 26th 2022 at 19:39
Atlassian has rolled out fixes for a critical security flaw in Bitbucket Server and Data Center that could lead to the execution of malicious code on vulnerable installations. Tracked as CVE-2022-36804 (CVSS score: 9.9), the issue has been characterized as a command injection vulnerability in multiple endpoints that could be exploited via specially crafted HTTP requests. <!--adsense--> “An
☐ ☆ ✇ The Hacker News

SonicWall Issues Patch for Critical Bug Affecting its Analytics and GMS Products

By Ravie Lakshmanan — July 22nd 2022 at 18:35
Network security company SonicWall on Friday rolled out fixes to mitigate a critical SQL injection (SQLi) vulnerability affecting its Analytics On-Prem and Global Management System (GMS) products. The vulnerability, tracked as CVE-2022-22280, is rated 9.4 for severity on the CVSS scoring system and stems from what the company describes is an "improper neutralization of special elements" used in
☐ ☆ ✇ Naked Security

OpenSSL issues a bugfix for the previous bugfix

By Paul Ducklin — June 24th 2022 at 15:32
Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

❌