Condividi

RSS

Piu’ articoli…

• Da Secure Online Desktop a Cyberfero: il rebranding dell’azienda leader nella cybersecurity
• NIS2 – Come il nuovo regolamento cyber potenzia la sicurezza dell’Europa
• Advanced persistent threat (APT): cosa sono e come difendersi
• Penetration Testing e MFA: Una Strategia Duplice per Massimizzare la Sicurezza
• SOAR e l’automazione della sicurezza informatica
• Penetration Testing: Dove Colpire per Proteggere la Tua Rete Informatica
• Ransomware: una piaga che mette in ginocchio aziende e istituzioni. Pagare o non pagare? Ecco la risposta.
• Perché l’audit IT e il log management sono importanti per la Cybersecurity

Categorie …

• Backup as a Service (25)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (23)
• Conferenza Cloud (4)
• Cyberfero (15)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (21)
• ownCloud (7)
• Privacy (8)
• Security (215)
  • Cyber Threat Intelligence (CTI) (9)
  • Deception (4)
  • Ethical Phishing (10)
  • Netwrix Auditor (2)
  • Penetration Test (18)
  • Posture Guard (4)
  • SOCaaS (66)
    • EDR (6)
    • SIEM (12)
    • SOAR (5)
    • UEBA (9)
  • Vulnerabilita' (83)
• Web Hosting (16)

Tags

CSIRT

• Aggiornamenti per Ruby-SAML (AL05/240918/CSIRT-ITA) Settembre 18, 2024
  Rilevata vulnerabilità – già risolta dal vendor – che interessa la libreria ruby-saml del noto linguaggio di programmazione Ruby, tipicamente utilizzata per implementare le modalità di autorizzazione SAML lato client. Tale vulnerabilità, qualora sfruttata, potrebbe consentire, a un attaccante non autenticato, di bypassare i meccanismi di sicurezza e accedere al sistema interessato.
• Sanata vulnerabilità su GitLab CE/EE (AL04/240918/CSIRT-ITA) Settembre 18, 2024
  Rilasciati aggiornamenti di sicurezza che risolvono una vulnerabilità con gravità “critica” in GitLab Community Edition (CE) ed Enterprise Edition (EE).
• Risolte vulnerabilità in Google Chrome (AL03/240918/CSIRT-ITA) Settembre 18, 2024
  Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 9 vulnerabilità di sicurezza, di cui una con gravità “alta”.
• Aggiornamenti di sicurezza LibreOffice (AL02/240918/CSIRT-ITA) Settembre 18, 2024
  Sanata una vulnerabilità con gravità “alta” in LibreOffice, noto software di produttività open source e multipiattaforma. Tale vulnerabilità, in determinate condizioni, potrebbe permettere l’esecuzione di macro malevole tramite documenti opportunamente predisposti.
• Risolte vulnerabilità in prodotti VMware (AL01/240918/CSIRT-ITA) Settembre 18, 2024
  VMware ha rilasciato aggiornamenti di sicurezza per sanare alcune vulnerabilità, di cui una con gravità “critica” nei prodotti vCenter Server e Cloud Foundation, noto software di virtualizzazione.
• Vulnerabilità in FileSender (AL02/240917/CSIRT-ITA) Settembre 17, 2024
  Rilevata una vulnerabilità di sicurezza, con gravità “alta” in FileSender, applicazione web open source utilizzata per inviare file di grandi dimensioni in modo sicuro.
• Aggiornamenti di sicurezza Android (AL01/240703/CSIRT-ITA) - Aggiornamento Settembre 17, 2024
  Google ha rilasciato gli aggiornamenti di sicurezza di luglio per sanare 27 vulnerabilità che interessano il sistema operativo Android.
• Aggiornamenti Mensili Microsoft (AL01/240814/CSIRT-ITA) - Aggiornamento Settembre 17, 2024
  Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 85 nuove vulnerabilità, di cui 10 di tipo 0-day.
• Sanata vulnerabilità in Apache OFBiz (AL02/240805/CSIRT-ITA) - Aggiornamento Settembre 17, 2024
  Apache Software Foundation ha rilasciato un aggiornamento di sicurezza per il prodotto OFBiz che sana una vulnerabilità con gravità “alta”. Tale vulnerabilità, qualora sfruttata, potrebbe consentire, in determinate condizioni, a un utente malintenzionato remoto di manipolare l’output dello schermo sull’istanza interessata.
• Ivanti September Security Update (AL06/240911/CSIRT-ITA) Settembre 17, 2024
  Ivanti rilascia aggiornamenti di sicurezza che risolvono 12 vulnerabilità, di cui 10 con gravità “critica” e 2 con gravità “alta”, nei prodotti Ivanti EndPoint Manager.

darkreading

• Contractor Software Targeted via Microsoft SQL Server Loophole Settembre 18, 2024
  By accessing the MSSQL, threat actors gain admin-level access to the application, allowing them to automate their attacks.
• Packed With Features, 'SambaSpy' RAT Delivers Hefty Punch Settembre 18, 2024
  Thought to be Brazilian in origin, the remote access Trojan is the "perfect tool for a 21st-century James Bond."
• QR Phishing Scams Gain Motorized Momentum in UK Settembre 18, 2024
  Criminal actors are finding their niche in utilizing QR phishing codes, otherwise known as "quishing," to victimize unsuspecting tourists in Europe and beyond.
• FCC: AT&T Didn't Adequately Protect Customers' Cloud Data Settembre 18, 2024
  Regulators fine AT&T $13 million for failing to protect customer information held by a third-party vendor, and extend consumer data protections to the cloud.
• Phishing Espionage Attack Targets US-Taiwan Defense Conference Settembre 18, 2024
  Hackers sent a convincing lure document, but after 20 years of similar attacks, the target organization was well prepared.
• Thousands of ServiceNow KB Instances Expose Sensitive Corporate Data Settembre 18, 2024
  Despite security updates to protect data, 45% of total enterprise instances of the cloud-based IT management platform leaked PII, internal system details, and active credentials over the past year.
• How Shifts in Cyber Insurance Are Affecting the Security Landscape Settembre 18, 2024
  Ultimately, the goal of businesses and cyber insurers alike is to build more resilient IT environments to avoid cyberattacks and the ransom, downtime, and reputation hit that come along with them.
• Infostealers: An Early Warning for Ransomware Attacks Settembre 18, 2024
  Can cyber defenders use the presence of infostealers as a canary in the coal mine to preempt ransomware attacks?
• As Geopolitical Tensions Mount, Iran's Cyber Operations Grow Settembre 18, 2024
  Increasing attacks by the OilRig/APT34 group linked to Iran's Ministry of Intelligence and Security show that the nation's capabilities are growing, and targeting regional allies and enemies alike.
• CISA Urges Software Makers to Eliminate XSS Flaws Settembre 17, 2024
  The latest Secure by Design alert from CISA outlines recommended actions security teams should implement to reduce the prevalence of cross-site scripting vulnerabilities in software.

Full Disclosure

• Stored XSS in "Edit Profile" - htmlyv2.9.9 Settembre 19, 2024
  Posted by Andrey Stoykov on Sep 18# Exploit Title: Stored XSS in "Edit Profile" - htmlyv2.9.9 # Date: 9/2024 # Exploit Author: Andrey Stoykov # Version: 2.9.9 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-11-stored-xss.html Stored XSS #1: Steps to Reproduce: 1. Login as author 2. Browse to "Edit Profile" 3. In "Content" field add […]
• Stored XSS in "Menu Editor" - htmlyv2.9.9 Settembre 19, 2024
  Posted by Andrey Stoykov on Sep 18# Exploit Title: Stored XSS in "Menu Editor" - htmlyv2.9.9 # Date: 9/2024 # Exploit Author: Andrey Stoykov # Version: 2.9.9 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-10-stored-xss.html Stored XSS #1: Steps to Reproduce: 1. Login as admin 2. Browse to "Menu Editor" 3. In "Name" field add […]
• Backdoor.Win32.BlackAngel.13 / Unauthenticated Remote Command Execution Settembre 19, 2024
  Posted by malvuln on Sep 18Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/d1523df44da5fd40df92602b8ded59c8.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.BlackAngel.13 Vulnerability: Unauthenticated Remote Command Execution Description: The malware listens on TCP port 1850. Third party adversaries who can reach an infected host can issue commands made available by […]
• Backdoor.Win32.CCInvader.10 / Authentication Bypass Settembre 19, 2024
  Posted by malvuln on Sep 18Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/cb86af8daa35f6977c80814ec6e40d63.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.CCInvader.10 Vulnerability: Authentication Bypass Description: The malware runs an FTP server. Third-party adversarys who can reach infected systems can logon using any username/password combination. Intruders may then upload...
• Backdoor.Win32.Delf.yj / Information Disclosure Settembre 19, 2024
  Posted by malvuln on Sep 18Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/f991c25f1f601cc8d14dca4737415238.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Delf.yj Vulnerability: Information Disclosure Description: The malware listens on TCP port 8080. Third-party adversaries who can reach an infected system, can download screen captures of a victims machine by […]
• SEC Consult blog :: Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey (CVE-2024-38014) + msiscan tool release Settembre 17, 2024
  Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 16The SEC Consult Vulnerability Lab published a new blog post titled: "Microsoft Windows MSI Installer - Repair to SYSTEM - A detailed journey" covering the recent Microsoft September 2024 patch for CVE-2024-38014. Blog URL: --------- https://r.sec-consult.com/msi Author: ------- Michael Baer, SEC Consult Vulnerability Lab Abstract: […]
• Stored XSS to Account Takeover - htmlyv2.9.9 Settembre 17, 2024
  Posted by Andrey Stoykov on Sep 16# Exploit Title: Stored XSS to Account Takeover - htmlyv2.9.9 # Date: 9/2024 # Exploit Author: Andrey Stoykov # Version: 2.9.9 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/08/friday-fun-pentest-series-9-stored-xss.html Description: - It was found that the application suffers from stored XSS - Low level user having an "author" role […]
• APPLE-SA-09-16-2024-10 macOS Ventura 13.7 Settembre 17, 2024
  Posted by Apple Product Security via Fulldisclosure on Sep 16APPLE-SA-09-16-2024-10 macOS Ventura 13.7 macOS Ventura 13.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/121234. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: macOS Ventura Impact: An app may […]
• APPLE-SA-09-16-2024-9 macOS Sonoma 14.7 Settembre 17, 2024
  Posted by Apple Product Security via Fulldisclosure on Sep 16APPLE-SA-09-16-2024-9 macOS Sonoma 14.7 macOS Sonoma 14.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/121247. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available for: macOS Sonoma Impact: An app may […]
• APPLE-SA-09-16-2024-8 iOS 17.7 and iPadOS 17.7 Settembre 17, 2024
  Posted by Apple Product Security via Fulldisclosure on Sep 16APPLE-SA-09-16-2024-8 iOS 17.7 and iPadOS 17.7 iOS 17.7 and iPadOS 17.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/121246. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS […]