Android_Hid – Use Android As Rubber Ducky Against Another Android Device
Use Android as Rubber Ducky against another Android device HID attack using AndroidUsing Android as Rubber Ducky against Android. This...
Year: 2021
MDR Vendor Must-Haves, Part 3: Ingestion of Other Technology Investments
This blog post is part of an ongoing series about evaluating Managed Detection and Response (MDR) providers. For more insights,...
Reflected XSS Vulnerability In “Ivory Search” WP Plugin Impact Over 60K sites
Researchers discovered a reflected XSS vulnerability in the Ivory Search WordPress Plugin installed on over 60,000 sites. On March 28,...
Experts found 2 Linux Kernel flaws that can allow bypassing Spectre mitigations
Linux kernel recently fixed a couple of vulnerabilities that could allow an attacker to bypass mitigations designed to protect devices...
Hundreds of thousands of projects affected by a flaw in netmask npm package
A vulnerability in the netmask npm package, tracked as CVE-2021-28918, could be exploited by attackers to conduct a variety of...
30 Docker images downloaded 20M times in cryptojacking attacks
Experts discovered that 30 malicious Docker images with a total number of 20 million pulls were involved in cryptomining operations. Palo...
London-based academies Harris Federation hit by ransomware attack
Harris Federation, the multi-academy trust of 50 primary and secondary academies in and around London, was hit by a ransomware...
China-linked RedEcho APT took down part of its C2 domains
China-linked APT group RedEcho has taken down its attack infrastructure after it was exposed at the end of February by...
CVE-2020-23162
Summary: Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read...
CVE-2020-16964
Summary: Windows Backup Engine Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16958, CVE-2020-16959, CVE-2020-16960, CVE-2020-16961, CVE-2020-16962, CVE-2020-16963....
CVE-2021-1373
Summary: A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless...
CVE-2019-16869
Summary: Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which...
CVE-2020-14209
Summary: Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs...
The one reason your iPhone needs a VPN
For years, Apple has marketed its iPhone as the more secure, more private option when compared to other smart phones,...
5G slicing vulnerability could be used in DoS attacks
The IT security researchers at AdaptiveMobile have called out what looks like an important vulnerability in the architecture of 5G...
Steam users: Don’t fall for the “I accidentally reported you” scam
Suppose that, out of the blue, a Steam user tells you they’ve accidentally reported you for something you didn’t do,...
Beware of Ongoing Brute-Force Attacks Against NAS Devices, QNAP Warns
Taiwanese firm, QNAP has warned its clients of ongoing attacks targeting QNAP NAS (network-attached storage) devices and urged to strengthen...
CNA Hit by a Phoenix CryptoLocker Ransomware Attack
Insurance giant, CNA had to shut down its systems and temporarily close its website due to a novel ransomware attack....
$571 Million to be Paid over Bitcoin Scam
The Commodity Futures Trading Commission on 26th March 2021 declared that the U.S. District Court for the Southern District of...
Doxing in the corporate sector
Introduction Doxing refers to the collection of confidential information about a person without their consent for the purpose of inflicting...
KICS – Find Security Vulnerabilities, Compliance Issues, And Infrastructure Misconfigurations Early In The Development Cycle Of Your Infrastructure-As-Code
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx....
Boomerang – A Tool To Expose Multiple Internal Servers To Web/Cloud
Boomerang is a tool to expose multiple internal servers to web/cloud using HTTP+TCP Tunneling. The Server will expose 2 ports...
SolarWinds Patches Four New Vulnerabilities in Their Orion Platform
On Thursday, March 25, 2021, SolarWinds released fixes for four new vulnerabilities in their Orion platform, the most severe of...
MDR Vendor Must-Haves, Part 2: Ingestion of Network Device Data
This blog post is part of an ongoing series about evaluating Managed Detection and Response (MDR) providers. For more insights,...
