Page 309 - Vulnerabilities News Today

minute read Share this article: Aamir Lakhani, cybersecurity researcher for Fortinet’s FortiGuard Labs, discusses criminals flocking to web server and browser attacks, and what to do about it. Smart cybercriminals are going after web servers and browsers, more so than after individuals. Unfortunately, these types of attacks often go ignored, as they’re harder to test for (in terms of pen-testing). With much of the world now working remotely, this threat has intensified. Attacke...

Researchers said the FoundCore malware represents a big step forward when it comes to evasion. An advanced cyberespionage campaign targeting government and military entities in Vietnam has been discovered that delivered a remote-access tool (RAT) for carrying out espionage operations, researchers said. Further analysis suggested that this campaign was conducted by a group related to a Chinese-speaking advanced persistent threat (APT) known as Cycldek (a.k.a. Goblin Panda, APT 27 and Conimes), a...

minute read Share this article: The researcher is offering details on CVE-2020-9922, which can be triggered just by sending a target an email with two .ZIP files attached. A zero-click security vulnerability in Apple’s macOS Mail would allow a cyberattacker to add or modify any arbitrary file inside Mail’s sandbox environment, leading to a range of attack types. According to Mikko Kenttälä, founder and CEO of SensorFu, exploitation of the bug could lead to unauthorized disclo...

CISA Orders Agencies to Recheck for Exchange Compromises Twitter Get Permission The Cybersecurity and Infrastructure Security Agency is ordering federal executive branch agencies to rescan and recheck their networks by Monday for any signs of compromise related to unpatched vulnerabilities in on-premises Microsoft Exchange email servers. In addition, the agencies have until June 28 to implement CISAs recommended steps to harden their infrastructure against attacks. Exchange Server Flaws Micro...

minute read Share this article: Cyberattackers have set up a website for a fake company called SecuriElite, as well as associated Twitter and LinkedIn accounts. The same North Korean threat actors that targeted security researchers in January appear to be readying a new campaign using a fake company (and associated social-media accounts) that aim to lure security professionals into another cyber-espionage trap. Google discovered the site as well as Twitter and LinkedIn profiles for...

minute read Share this article: Chris Hass, director of information security and research at Automox, discusses how to shore up cybersecurity defenses and what to prioritize. Last year and early spring has been undoubtedly tough for cybersecurity. We’ve seen one of – if not the – worst cyberattacks on U.S. companies and government agencies in the last decade; and the ProxyLogon Microsoft Exchange vulnerabilities continue to be dangerous. Knowing just how vulnerable many comp...

A vast majority of companies in a global survey from Microsoft report being a victim of a firmware-focused cyberattack, but defense spending lags.

minute read Share this article: Some legacy models of QNAP network attached storage devices are vulnerable to remote unauthenticated attacks because of two unpatched vulnerabilities. Two critical zero-day bugs affect legacy QNAP Systems storage hardware, and expose devices to remote unauthenticated attackers. The bugs, tracked as CVE-2020-2509 and CVE-2021-36195, impact QNAP’s model TS-231 network attached storage (NAS) hardware, allowing an attacker to manipulate stored data an...

Sponsored by: minute read Share this article: Insider Risk Management builds a framework around the new paradigm of “risk tolerance,” aiming to give security teams the visibility and context around data activity to protect that data, without putting rigid constraints on users. The pandemic was a force accelerator for digital transformation in the enterprise. It’s not just the dramatic remote work shift — it’s a profound shift toward prioritizing speed and fl...

The American Rescue Act is the latest zeitgeisty lure being circulated in an email campaign. Cybercriminals have wasted no time in hopping on the American Rescue Plan – the COVID-19 relief legislation just signed into law – as a lure for email-based scams. According to researchers at Cofense, a campaign began circulating in March that capitalized on Americans’ interest in the forthcoming $1,400 relief payments and other aid. The emails impersonate the IRS, using the agency’s official lo...