Happy New Year and welcome to the first Kaspersky Transatlantic Cable podcast of 2022. With Jeff still out, Ahmed and I take on this episode as a two-man show. To kick things off, we reflect on the Christmas holiday and this years it toy, the Chatter Bluetooth Telephone from Fisher-Price. This toy is pretty cool, and show more ...
WordPress Catch Themes Demo Import plugin versions prior to 1.8 suffer from a remote shell upload vulnerability.
Ubuntu Security Notice 5204-1 - Chris Bailey discovered that Django incorrectly handled evaluating submitted passwords. A remote attacker could possibly use this issue to consume resources, resulting in a denial of service. Dennis Brinkrolf discovered that Django incorrectly handled the dictsort template filter. A show more ...
Dixell XWEB 500 suffers from an arbitrary file write vulnerability.
Red Hat Security Advisory 2022-0015-01 - Red Hat Single Sign-On 7.5 container images, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This is a security update Red Hat Single Sign-On 7.5, and includes one security fix.
Gerapy version 0.9.7 suffers from a remote code execution vulnerability.
Affiliate Pro version 1.7 suffers from multiple cross site scripting vulnerabilities.
Hostel Management System version 2.1 suffers from a cross site scripting vulnerability.
TermTalk Server version 3.24.0.2 suffers from an arbitrary file read vulnerability.
Rocket LMS version 1.1 suffers from a persistent cross site scripting vulnerability.
openSIS Student Information System version 8.0 suffers from a remote SQL injection vulnerability.
Online Admission System version 1.0 suffers from an unauthenticated remote code execution vulnerability.
Hospitals Patient Records Management System version 1.0 suffers from an account takeover vulnerability.
WordPress AAWP plugin version 3.16 suffers from a cross site scripting vulnerability.
uDoctorAppointment version 2.1.1 suffers from multiple cross site scripting vulnerabilities.
Automox Agent version 32 suffers from a local privilege escalation vulnerability.
Vodafone H-500-s version 3.5.10 suffers from a wifi password disclosure vulnerability.
Hospitals Patient Records Management System version 1.0 suffers from a remote SQL injection vulnerability.
Easy Cart Shopping Cart version 2021 suffers from a cross site scripting vulnerability.
AWebServer GhostBuilding version 18 suffers from a denial of service vulnerability.
Virtual Airline Manager version 2.6.2 suffers from a remote SQL injection vulnerability.
cWifi Hotspot Wireless CP suffers from a code execution vulnerability.
RiteCMS versions 3.1.0 and below suffer from an arbitrary file overwrite vulnerability.
RiteCMS versions 3.1.0 and below suffer from an arbitrary file deletion vulnerability.
VMware Security Advisory 2022-0001 - VMware Workstation, Fusion and ESXi updates address a heap overflow vulnerability.
Safari Montage version 8.5 suffers from a cross site scripting vulnerability.
Threat actors leveraged a cloud video hosting service to carry out a supply chain attack on more than 100 real estate websites operated by Sotheby's Realty that involved injecting malicious skimmers to steal sensitive personal information. "The attacker injected the skimmer JavaScript codes into video, so whenever others import the video, their websites get embedded with skimmer codes as well,"
Microsoft is warning of continuing attempts by nation-state adversaries and commodity attackers to take advantage of security vulnerabilities uncovered in the Log4j open-source logging framework to deploy malware on vulnerable systems. "Exploitation attempts and testing have remained high during the last weeks of December," Microsoft Threat Intelligence Center (MSTIC) said in revised guidance
Cybersecurity researchers have taken the wraps of an organized financial-theft operation undertaken by a discreet actor to target transaction processing systems and siphon funds from entities primarily located in Latin America for at least four years. The malicious hacking group has been codenamed Elephant Beetle by Israeli incident response firm Sygnia, with the intrusions aimed at banks and
An ongoing ZLoader malware campaign has been uncovered exploiting remote monitoring tools and a nine-year-old flaw concerning Microsoft's digital signature verification to siphon user credentials and sensitive information. Israeli cybersecurity company Check Point Research, which has been tracking the sophisticated infection chain since November 2021, attributed it to a cybercriminal group
Think carefully before rushing to scan the payment QR code stuck on the side of a parking meter - it may well be an attempt by fraudsters to phish your financial information. Read more in my article on the Hot for Security blog.
Each year, as online shopping ramps up in the weeks before the holidays, so do online scams targeting the elderly. This season – in many ways unprecedented – is no different in this regard. In fact, COVID-19, Zoom meetings, vaccination recommendations and travel warnings all provide ample and unique precedent for show more ...
