Page 324 - Vulnerabilities News Today

Watering-hole attacks executed by ‘experts’ exploited Chrome, Windows and Android flaws and were carried out on two servers.

Security teams are preparing for the inevitable return to the workplace – and the privacy implications of exposure notification apps that companies may need to adopt.

On the heels of a cyberattack on the EMA, cybercriminals have now leaked Pfizer and BioNTech COVID-19 vaccine data on the internet.

minute read Share this article: Two security vulnerabilities — one a privilege-escalation problem and the other a stored XSS bug — afflict a WordPress plugin with 40,000 installs. Two vulnerabilities (one critical) in a WordPress plugin called Orbit Fox could allow attackers to inject malicious code into vulnerable websites and/or take control of a website. Orbit Fox is a multi-featured WordPress plugin that works with the Elementor, Beaver Builder and Gutenberg site-building ...

minute read Share this article: Cisco fixed high-severity flaws tied to 67 CVEs overall, including ones found inits AnyConnect Secure Mobility Client and in its RV110W, RV130, RV130W, and RV215W small business routers. A high-severity flaw in Cisco’s smart Wi-Fi solution for retailers could allow a remote attacker to alter the password of any account user on affected systems. The vulnerability is part of a number of patches issued by Cisco addressing 67 high-severity CVEs on Wed...

minute read Share this article: Capcom, the game developer behind Resident Evil, Street Fighter and Dark Stalkers, now says its recent attack compromised the personal data of up to 400,000 gamers. A ransomware attack launched against gaming company Capcom last November keeps getting worse. The company now says that the personal data of up to 400,000 of its customers was compromised in the attack — 40,000 more than the company originally thought. Capcom is a Japan-based publisher ...

minute read Share this article: The BumbleBee web shell allows APT attackers to upload and download files, and move laterally by running commands. A webshell called BumbleBee has taken flight in an ongoing xHunt espionage campaign that has targeted Microsoft Exchange servers at Kuwaiti organizations. According to researchers at Palo Alto Networks’ Unit 42, BumbleBee (so named because of its color scheme) was observed being used to upload and download files to and from a compromi...

A sophisticated threat actor has hijacked email security connections to spy on targets.

GLOF, vulnerabilities and local action Opinion January 11, 2021 In my previous article, ‘Integrating GLOF into policy’ (January 4), I argued that increased frequency of Glacial Lake Outburst Flood (GLOF) makes it necessary for Pakistan to establish locally workable mechanisms to enhance the resilience of vulnerable communities. This means that these local institutions have the capacity to identify and manage GLOF-induced risks, and they have resources to implement mitigation and adaptatio...

Researchers have spotted notable code overlap between the Sunburst backdoor and a known Turla weapon. New details on the Sunburst backdoor used in the sprawling SolarWinds supply-chain attack potentially link it to previously known activity by the Turla advanced persistent threat (APT) group. Researchers at Kaspersky have uncovered several code similarities between Sunburst and the Kazuar backdoor. Kazuar is a malware written using the .NET framework that was first reported by Palo Alto in 2017...