A researcher received a $5,500 bug bounty for discovering a vulnerability (CVE-2024-2879) in LayerSlider, a plug-in with more than a million active installations.
...moreSummary
Total Articles Found: 27
Top sources:
- Dark Reading 21
- Threatpost 6
Top Keywords:
- Vulnerabilities: 4
- Web Security: 3
- IoT: 2
- Malware: 1
- Breach: 1
Top Authors
Top Articles:
- Apple Patches Three Actively Exploited Zero-Days, Part of iOS Emergency Update
- Hacker Leaks More Than 500K Telnet Credentials for IoT Devices
- Snake Keylogger Spreads Through Malicious PDFs
- 'Log in with...' Feature Allows Full Online Account Takeover for Millions
- Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover
- Swipe Right for Data Leaks: Dating Apps Expose Location, More
- Spell-Checking in Google Chrome, Microsoft Edge Browsers Leaks Passwords
- Report: Air-Gapped Networks Vulnerable to DNS Attacks
- Unpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk
- Millions of Java Apps Remain Vulnerable to Log4Shell
Critical Security Flaw Exposes 1 Million WordPress Sites to SQL Injection
Published: 2024-04-05 11:34:21
Popularity: None
Author: Elizabeth Montalbano, Contributing Writer
300K Internet Hosts at Risk for 'Devastating' Loop DoS Attack
Published: 2024-03-21 18:17:06
Popularity: 8
Author: Elizabeth Montalbano, Contributing Writer
Attackers can create a self-perpetuating, infinite scenario in such a way that volumes of traffic overwhelm network resources indefinitely.
...moreGoogle Kubernetes Clusters Suffer Widespread Exposure to External Attackers
Published: 2024-01-25 16:40:00
Popularity: 16
Author: Elizabeth Montalbano, Contributing Writer
Misunderstanding the permissions of an authentication group in Google Kubernetes Engine (GKE) opens millions of containers to anyone with a Google account.
...more'Log in with...' Feature Allows Full Online Account Takeover for Millions
Published: 2023-10-24 13:00:00
Popularity: 285
Author: Elizabeth Montalbano, Contributor, Dark Reading
Hundreds of millions of users of Grammarly, Vidio, and the Indonesian e-commerce giant Bukalapak are at risk for financial fraud and credential theft due to OAuth misfires — and other online services likely have the same problems.
...moreMicrosoft Patches 'Dangerous' RCE Flaw in Azure Cloud Service
Published: 2023-03-30 18:58:13
Popularity: 50
Author: Elizabeth Montalbano, Contributor, Dark Reading
The vulnerability would have allowed an unauthenticated attacker to execute code on a container hosted on one of the platform's nodes.
...moreBooking.com's OAuth Implementation Allows Full Account Takeover
Published: 2023-03-02 16:16:00
Popularity: 15
Author: Elizabeth Montalbano, Contributor, Dark Reading
Researchers exploited issues in the authentication protocol to force an open redirection from the popular hotel reservations site when users used Facebook to log in to accounts.
...moreReport: Air-Gapped Networks Vulnerable to DNS Attacks
Published: 2022-12-08 14:12:04
Popularity: 119
Author: Elizabeth Montalbano, Contributor, Dark Reading
Common mistakes in network configuration can jeopardize the security of highly protected assets and allow attackers to steal critical data from the enterprise.
...moreCritical Open Source vm2 Sandbox Escape Bug Affects Millions
Published: 2022-10-11 14:23:07
Popularity: 56
Author: Elizabeth Montalbano, Contributor, Dark Reading
Attackers could exploit the "Sandbreak" security bug, which has earned a 10 out of 10 on the CVSS scale, to execute a sandbox escape, achieve RCE, and run shell commands on a hosting machine.
...moreAndroid Leaks Wi-Fi Traffic Even When VPN Protection Features Are On
Published: 2022-10-12 16:20:35
Popularity: 14
Author: Elizabeth Montalbano, Contributor, Dark Reading
The platform lets network connectivity data escape outside of the secure tunnel when connected to a public network, posing a "privacy concern" for users with "certain threat models," researchers said.
...moreSpell-Checking in Google Chrome, Microsoft Edge Browsers Leaks Passwords
Published: 2022-09-20 17:37:16
Popularity: 131
Author: Elizabeth Montalbano, Contributor, Dark Reading
It's called "spell-jacking": Both browsers have spell-check features that send data to Microsoft and Google when users fill out forms for websites or Web services.
...morePhishing Campaign Targets PyPI Users to Distribute Malicious Code
Published: 2022-08-30 14:16:23
Popularity: 35
Author: Elizabeth Montalbano, Contributor, Dark Reading
The first-of-its-kind campaign threatens to remove code packages if developers don’t submit their code to a "validation" process.
...moreCritical Vulnerability in Premium WordPress Themes Allows for Site Takeover
Published: 2022-05-19 13:03:37
Popularity: 238
Author: Elizabeth Montalbano
Keywords:
Privilege escalation flaw discovered in the Jupiter and JupiterX Core Plugin affects more than 90,000 sites.
...moreSnake Keylogger Spreads Through Malicious PDFs
Microsoft Word also leveraged in the email campaign, which uses a 22-year-old Office RCE bug.
...moreUnpatched DNS Bug Puts Millions of Routers, IoT Devices at Risk
Published: 2022-05-04 10:27:47
Popularity: 97
Author: Elizabeth Montalbano
Keywords:
A flaw in all versions of the popular C standard libraries uClibe and uClibe-ng can allow for DNS poisoning attacks against target devices.
...moreMillions of Java Apps Remain Vulnerable to Log4Shell
Published: 2022-04-27 12:11:25
Popularity: 70
Author: Elizabeth Montalbano
Keywords:
Four months after the critical flaw was discovered, attackers have a massive attack surface from which they can exploit the flaw and take over systems, researchers found.
...moreApple Patches Three Actively Exploited Zero-Days, Part of iOS Emergency Update
Published: 2021-01-27 12:21:28
Popularity: 1153
Author: Elizabeth Montalbano
Keywords:
An anonymous researcher identified bugs in the software’s kernel and WebKit browser engine that are likely part of an exploit chain.
...moreHacker Leaks More Than 500K Telnet Credentials for IoT Devices
Published: 2020-01-21 11:57:20
Popularity: 568
Author: Elizabeth Montalbano
Keywords:
Bad actor obtained passwords for servers, home routers, and smart devices by scanning internet for devices open to the Telnet port.
...moreD-Link Routers Vulnerable to Takeover Via Exploit for Zero-Day
Published: 2024-05-15 15:42:28
Popularity: 10
Author: Elizabeth Montalbano, Contributing Writer
A vulnerability in the HNAP login request protocol that affects a family of devices gives unauthenticated users root access for command execution.
...moreRussia's Fancy Bear Pummels Windows Print Spooler Bug
Published: 2024-04-23 13:21:39
Popularity: 14
Author: Elizabeth Montalbano, Contributing Writer
The infamous Russian threat actor has created a custom tool called GooseEgg to exploit CVE-2022-38028 in cyber-espionage attacks against targets in Ukraine, Western Europe, and North America.
...moreCisco Zero-Days Anchor 'ArcaneDoor' Cyber-Espionage Campaign
Published: 2024-04-25 15:59:45
Popularity: 6
Author: Elizabeth Montalbano, Contributing Writer
Attacks by a previously unknown threat actor leveraged two bugs in firewall devices to install custom backdoors on several government networks globally.
...moreOkta Warns Once Again of Credential-Stuffing Attacks
Published: 2024-05-30 15:43:41
Popularity: 6
Author: Elizabeth Montalbano, Contributing Writer
🤖: "password fail"
This time it's the identity management service provider's cross-origin authentication feature that's being targeted by adversaries.
...more20 Million Trusted Domains Vulnerable to Email Hosting Exploits
Published: 2024-07-18 17:53:43
Popularity: 21
Author: Elizabeth Montalbano, Contributing Writer
🤖: "Email fail"
Three newly discovered SMTP smuggling attack techniques can exploit misconfigurations and design decisions made by at least 50 email-hosting providers.
...moreSwipe Right for Data Leaks: Dating Apps Expose Location, More
Published: 2024-07-22 18:18:55
Popularity: 145
Author: Elizabeth Montalbano, Contributing Writer
🤖: "Data leak alert"
Apps like Tinder, Bumble, Grindr, Badoo, OKCupid, MeetMe, and Hinge all have API vulnerabilities that expose sensitive user data, and six allow a threat actor to pinpoint exactly where someone is.
...moreAttackers Exploit 'EvilVideo' Telegram Zero-Day to Hide Malware
Published: 2024-07-23 16:21:16
Popularity: 7
Author: Elizabeth Montalbano, Contributing Writer
🤖: "Sneaky malware"
An exploit sold on an underground forum requires user action to download an unspecified malicious payload.
...moreSecurity Firm Accidentally Hires North Korean Hacker, Did Not KnowBe4
Published: 2024-07-25 15:32:05
Popularity: 22
Author: Elizabeth Montalbano, Contributing Writer
🤖: "oops, hired wrong guy"
A software engineer hired for an internal IT AI team immediately became an insider threat by loading malware onto his workstation.
...moreGitHub Attack Vector Cracks Open Google, Microsoft, AWS Projects
Published: 2024-08-14 14:16:57
Popularity: 22
Author: Elizabeth Montalbano, Contributing Writer
🤖: ""Ouch, they're vulnerable""
Cloud services and thus millions of end users who access them could have been affected by the poisoning of artifacts in the development workflow of open source projects.
...morePython-Based Malware Slithers Into Systems via Legit VS Code
Published: 2024-10-02 15:18:01
Popularity: 6
Author: Elizabeth Montalbano, Contributing Writer
🤖: "Sneaky snake"
The prolific Chinese APT Mustang Panda is the likely culprit behind a sophisticated cyber-espionage attack that sets up persistent remote access to victim machines.
...more