Vulnerabilities
Giacomo LanziWastedLocker: Next generation ransomware
WastedLocker is ransomware attack software that began targeting businesses and other organizations in May 2020. It is known for its high ransom demands reaching millions of dollars per victim. It is the product of a group of highly skilled cyber criminals who have been operating for over a decade: Evil Corp. Who is behind WastedLocker Ransomware The group behind WastedLocker…
Giacomo LanziDoes ISO 27001 standard require a Pentest?
A legitimate question that often arises is whether the Penetration Test is necessary for compliance with the ISO 27001 standard. To fully understand the answer, it is necessary to clarify what is meant by these terms and to understand the relationship between all the components of the certification. ISO 27001 standard A technical standard, also incorrectly called a standard, is…
Piergiorgio Venuti
Path traversal in Photo Gallery (WordPress plugin)
Path traversal in Photo Gallery may allow admins to read most files on the filesystem (WordPress plugin)
Piergiorgio Venuti
CVE-2017-7620 Mantis Bug Tracker
CVE-2017-7620 Mantis Bug Tracker 1.3.10 / v2.3.0 CSRF Permalink Injection
Piergiorgio Venuti
WordPress Newsletter Supsystic 1.1.7
WordPress Newsletter Supsystic 1.1.7 – Cross Site Scripting Vulnerability
Piergiorgio Venuti
[CVE-2017-5868] OpenVPN Access Server
[CVE-2017-5868] OpenVPN Access Server : CRLF injection with Session fixation
Piergiorgio Venuti
Linux Kernel Privilege Escalation
SSD Advisory – Linux Kernel XFRM Privilege Escalation
Piergiorgio Venuti
SSD Advisory – Linux Kernel AF_PACKET Use-After-Free
Piergiorgio Venuti
SSD Advisory – Webmin Multiple Vulnerabilities
Piergiorgio Venuti
SSD Advisory – PHP Melody Multiple Vulnerabilities
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Ad Widget Plugin Local File Inclusion Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Simple Login Log Plugin Multiple SQL Injection Security Vulnerabilities
Piergiorgio Venuti
WordPress does not hash or expire wp_signups.activation_key allowing an attacker with SQL injection to create accounts
Piergiorgio Venuti
DefenseCode Security Advisory: Magento Commerce CSRF, Stored Cross Site Scripting #1
Piergiorgio Venuti
Exploit toolkit for CVE-2017-8759 – Microsoft .NET Framework RCE (Builder + listener + video tutorial)
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress PressForward Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Podlove Podcast Publisher Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Easy Modal Plugin Multiple Security Vulnerabilities
Piergiorgio Venuti
Defense in depth — the Microsoft way (part 48): privilege escalation for dummies — they didn’t make SUCH a stupid blunder?
Piergiorgio Venuti
Multiple Local Privilege Escalation Vulnerabilities in Acunetix Web Vulnerability Scanner 11
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress AffiliateWP Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Huge-IT Video Gallery Plugin Security Vulnerability
Piergiorgio Venuti
Joomla com_tag v1.7.6 – (tag) SQL Injection Vulnerability
Piergiorgio Venuti
Qualys Security Advisory – CVE-2017-1000367 in Sudo’s get_process_ttyname() for Linux
Piergiorgio Venuti
Defense in depth — the Microsoft way (part 48): privilege escalation for dummies — they didn’t make SUCH a stupid blunder?
Piergiorgio Venuti
Microsoft Dynamic CRM 2016 – Cross-Site Scripting vulnerability
Piergiorgio Venuti
Executable installers are vulnerable^WEVIL (case 52): escalation of privilege with Microsoft’s .NET Framework installers
Piergiorgio Venuti
Reflected XSS in WordPress Download Manager could allow an attacker to do almost anything an admin can (WordPress plugin)
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress All In One Schema.org Rich Snippets Plugin Security Vulnerability
Piergiorgio Venuti
Stealing Windows Credentials Using Google Chrome
Piergiorgio Venuti
WordPress EELV Newsletter v4.5 – Multiple Vulnerabilities
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: GOOGLE google-api-php-client Multiple Security Vulnerabilities
Piergiorgio Venuti
DefenseCode WebScanner DAST Advisory: WordPress User Access Manager Plugin Security Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Tracking Code Manager Plugin Multiple Security Vulnerabilities
Piergiorgio Venuti
CSRF in wordpress plugin clean login allows remote attacker change wordpress login redirect url or logout redirect url to evil address
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress WebDorado Gallery Plugin SQL Injection Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Spider Event Calendar Plugin SQL Injection Vulnerability
Piergiorgio Venuti
DefenseCode ThunderScan SAST Advisory: WordPress Facebook Plugin SQL Injection Vulnerability
Piergiorgio Venuti
Cross-Site Request Forgery & Cross-Site Scripting in Contact Form Manager WordPress Plugin
Piergiorgio Venuti
Cross-Site Request Forgery in WordPress Press This function allows DoS
Alessandro Stesi
Cross-Site Request Forgery in Atahualpa WordPress Theme
Alessandro Stesi
Cross-Site Scripting in Magic Fields 1 WordPress Plugin
Alessandro Stesi
WordPress Adminer plugin allows public (local) database login
Alessandro Stesi
Cross-Site Request Forgery in WordPress Download Manager Plugin
Alessandro Stesi
Simple Ads Manager WordPress plugin unauthenticated PHP Object injection vulnerability
Alessandro Stesi
Cross-Site Request Forgery in File Manager WordPress plugin
Alessandro Stesi
Admin Custom Login WordPress plugin custom login page affected by persistent Cross-Site Scripting
Alessandro Stesi
Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field
Alessandro Stesi
Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability
Alessandro Stesi
WordPress Plugin Kama Click Counter 3.4.9 – Blind SQL Injection
Alessandro Stesi
Persistent Cross-Site Scripting vulnerability in User Access Manager WordPress Plugin
Alessandro Stesi
Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification
Alessandro Stesi
CMS Commander Client WordPress Plugin unauthenticated PHP Object injection vulnerability
Alessandro Stesi
New exploit for new vulnerability in WordPress Plugin + tutorial
Alessandro Stesi
Nginx (Debian-based + Gentoo distros) – Root Privilege Escalation [CVE-2016-1247 UPDATE]
Alessandro Stesi
Multiple vulnerabilities in cPanel <= 60.0.34
Piergiorgio Venuti
MySQL / MariaDB / PerconaDB – Privilege Escalation / Race Condition Exploit [CVE-2016-6663 / OCVE-2016-5616]
Piergiorgio Venuti
Cross-Site Scripting in Check Email WordPress Plugin
Piergiorgio Venuti
Nginx (Debian-based distros) – Root Privilege Escalation Vulnerability (CVE-2016-1247)
Piergiorgio Venuti
Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting in Calendar WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin
Piergiorgio Venuti
Cross-Site Scripting vulnerability in Quotes Collection WordPress Plugin
Piergiorgio Venuti
MySQL / MariaDB / PerconaDB – Root Privilege Escalation Exploit ( CVE-2016-6664 / CVE-2016-5617 )
Piergiorgio Venuti
[oss-security] CVE request:Lynx invalid URL parsing with ‘?’
Share
RSS
More Articles…
- Zero-Day attack: what they are and how to defend yourself with SOCaaS
- Monitoring system, an overview
- Data Exfiltration: defense against data theft
- Install a Let’s Encrypt certificate on Debian based machine
- WastedLocker: Next generation ransomware
- Protecting a site in WordPress: security package
- Critical ransomware: examples of successful attacks
- Secure Online Desktop Social Initiatives
Categories …
- Backup as a Service (2)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (20)
- Conferenza Cloud (4)
- ICT Monitoring (4)
- Log Management (2)
- News (16)
- ownCloud (4)
- Privacy (6)
- Secure Online Desktop (14)
- Security (6)
- SOCaaS (9)
- Vulnerabilities (83)
- Web Hosting (12)
Tags
Acronis Acronis backup Acronis Cloud Backup BaaS Backup black friday CDN cloud cloud computing Cloud Conference Cloud CRM for Call center cloud provider reggio emilia cloud server cloud service provider cloud services cyber security cyber security cyber threat Demo Cloud Server GDPR Machine Learning Monitoraggio infrastruttura ICT nextgen siem online hosting owncloud owncloud pentest Plesk Ransomware Ransomware server virtuale sicurezza siem Smart Working SOAR SOCaaS VDS Virtual Machine vps web hosting webinar web security Wordpress Zabbix Zabbix as a Service
Dark Reading:
- NSA Appoints Rob Joyce as Cyber Director January 15, 2021Joyce has long worked in US cybersecurity leadership, most recently serving as the NSA's top representative in the UK.
- Successful Malware Incidents Rise as Attackers Shift Tactics January 15, 2021As employees moved to working from home and on mobile devices, attackers followed them and focused on weekend attacks, a security firm says.
- How to Achieve Collaboration Tool Compliance January 15, 2021Organizations must fully understand the regulatory guidance on collaboration security and privacy so they can continue to implement and expand their use of tools such as Zoom and Teams.
- Name That Toon: Before I Go ... January 15, 2021Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
- These Kids Are All Right January 15, 2021Faculty and students at the William E. Doar School for the Performing Arts in Washington, D.C. created "Cyberspace," a rap song about online safety as part of the NSA's national STOP. THINK. CONNECT. campaign back in 2012. Wonder how many went into security.
- Shifting Privacy Landscape, Disruptive Technologies Will Test Businesses January 14, 2021A new machine learning tool aims to mine privacy policies on behalf of users.
- 'Chimera' Threat Group Abuses Microsoft & Google Cloud Services January 14, 2021Researchers detail a new threat group targeting cloud services to achieve goals aligning with Chinese interests.
- Businesses Struggle with Cloud Availability as Attackers Take Aim January 14, 2021Researchers find organizations struggle with availability for cloud applications as government officials warn of cloud-focused cyberattacks.
- NSA Recommends Using Only 'Designated' DNS Resolvers January 14, 2021Agency provides guidelines on securely deploying DNS over HTTPS, aka DoH.
- Who Is Responsible for Protecting Physical Security Systems From Cyberattacks? January 14, 2021It's a question that continues to engage debate, as the majority of new physical security devices being installed are now connected to a network. While this offers myriad benefits, it also raises the question: Who is responsible for their cybersecurity?
Full Disclosure
- SEC Consult SA-20210113-1 :: Multiple vulnerabilities in flatCore CMS January 13, 2021Posted by SEC Consult Vulnerability Lab on Jan 13SEC Consult Vulnerability Lab Security Advisory < 20210113-1 > ======================================================================= title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: < 2.0.0 Build 139 fixed version: Release 2.0.0 Build 139 CVE number: CVE-2021-23835, CVE-2021-23836, CVE-2021-23837, CVE-2021-23838 impact: High homepage:...
- SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series January 13, 2021Posted by SEC Consult Vulnerability Lab on Jan 13SEC Consult Vulnerability Lab Security Advisory < 20210113-0 > ======================================================================= title: Multiple vulnerabilities product: Pepperl+Fuchs IO-Link Master Series See "Vulnerable / tested versions" vulnerable version: System 1.36 / Application 1.5.28 fixed version: System 1.52 / Application 1.6.11 CVE number:...
- Backdoor.Win32.Zombam.a / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/6c5081e9b65a52963b0b1ae612ef7eb4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.a Vulnerability: Remote Stack Buffer Overflow Description: The malware listens on TCP port 80, sending an HTTP GET request with 300 or more bytes will trigger buffer overflow overwriting EIP. Type: […]
- Backdoor.Win32.Levelone.b / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/3f82e6ddc9f5242f5af200d2fbae4ce4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Levelone.b Vulnerability: Remote Stack Buffer Overflow Description: The backdoor listens on Port 7777, sending two large consecutive HTTP OPTIONS requests trigger the buffer overflow overwriting EIP. Type: PE32 MD5:...
- Backdoor.Win32.Levelone.a / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/6a2d09c4527cf222e4e2571b074fcc0c.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Levelone.a Vulnerability: Remote Stack Buffer Overflow Description: The malware listens on Port 1500, sending a specially crafted HTTP TRACE request causes a buffer overflow and overwrites EIP with our payload. If […]
- Backdoor.Win32.Ketch.b / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/9d7be3799594a82bf7056905f501af03.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Ketch.b Vulnerability: Remote Stack Buffer Overflow Description: Makes HTTP GET request for a file "script.dat", and writes the server response to temporary file named "watchb.tmp" under c:\Windows dir. At 1032...
- Re: Backdoor.Win32.Xtreme.yvp / Insecure Permissions EoP January 13, 2021Posted by bo0od on Jan 12When you say backdoor, you mean backdoor which microsoft remotely using it or you mean a malware can take advantage of? malvuln:
- Advisory: ES2021-01 - Loopback access control bypass in coturn by using 0.0.0.0, [::1] or [::] as the peer address January 13, 2021Posted by Sandro Gauci on Jan 12# Loopback access control bypass in coturn by using 0.0.0.0, [::1] or [::] as the peer address - Fixed version: 4.5.2 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-01-coturn-access-control-bypass - Coturn Security Advisory: https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p - Other references: - CVE-2020-26262 -...
- Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability January 13, 2021Posted by Stefan Pietsch on Jan 12# Trovent Security Advisory 2010-01 # ##################################### Email address enumeration in reset password ########################################### Overview ######## Advisory ID: TRSA-2010-01 Advisory version: 1.1 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2010-01 Affected product: Web application Rocket.Chat Affected version:
- Envira Gallery - Lite Edition - Version 1.8.3.2 CVE-2020-35581 CVE-2020-35582 January 13, 2021Posted by Rodolfo Augusto do Nascimento Tavares on Jan 12==== [Tempest Security Intelligence - ADV-12/2020] ============================= Envira Gallery - Lite Edition - Version 1.8.3.2 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== [Table of Contents] ================================================ • Overview • Detailed description • Disclosure timeline • Acknowledgements • References ===== [Vulnerability Information]...
Customers
Twitter FEED
Recent activity
SecureOnlineDesktop
Tempo di lettura: 4 minLa pratica dello shadow IT e' l'utilizzo di sistemi informatici, dispositivi, software, appl… https://t.co/9wQPtvqemG
SecureOnlineDesktop
The practice of shadow IT is the use of computer systems, devices, software, applications and services without the… https://t.co/CgzjblglX9
SecureOnlineDesktop
Acronis Active Protection e' una tecnologia anti-ransomware avanzata. Protegge attivamente tutti i dati dei vostri… https://t.co/Hw7Rs2YOQa
SecureOnlineDesktop
Le insider threat sono difficili da individuare perche' provengono, appunto, dall'interno della vostra organizzazio… https://t.co/aborWoeBgK
SecureOnlineDesktop
Se il sito e' lento, stai perdendo clienti. E' molto semplice e non ci sono modi piu' gentili per dire la stessa co… https://t.co/yB18k0UH49
Newsletter
Products and Solutions
Partners
Cloud Models
News
- Zero-Day attack: what they are and how to defend yourself with SOCaaS January 6, 2021
- Monitoring system, an overview January 4, 2021
- Data Exfiltration: defense against data theft December 30, 2020
- Install a Let’s Encrypt certificate on Debian based machine December 28, 2020
- WastedLocker: Next generation ransomware December 23, 2020
Google Reviews
Riccardo Crocilli
14:02 22 Mar 19
Ho collaborato con Secure Online... Desktop per importanti progetti IT. Si sono dimostrati negli anni partner seri, competenti e professionali , l' Azienda dimostra una grande esperienza maturata in tanti anni di consulenza e lavoro su contesti IT innovativi.
Davvero consigliata !!!!!
In particolare vorrei sottolineare la figura che piu’ racchiude e sintetizza le qualità della Secure Online Desktop , il suo AD Ing. Piergiorgio Venuti, professionista impagabile , sia dal punto di vista tecnico/organizzativo che soprattutto (e non dimeno) come persona , capace di gestire , risolvere e approcciare qualsivoglia attività/problematica, davvero un grande !!!!read more
Filippo Scavone
13:39 22 Mar 19
Dopo anni di collaborazione confermo la... professionalità, competenza ed affidabilitàread more
clickday at2016
13:36 22 Mar 19
Con lo studio di consulenza di cui sono... socio, ATS – CONSULENTI ASSOCIATI S.r.l., collaboriamo già da alcuni anni, in materia di Sicurezza informatica in ambito GDPR, con la Secure Online Desktop. Si sono dimostrati partner seri, competenti e professionali sia su clienti PMI sia su Grandi imprese.read more
Paolo Raimondi
11:08 21 Apr 18
La Polimatica Progetti Srl, azienda di... cui sono titolare, collabora con soddisfazione da alcuni anni con Secure Online Desktop. L'Azienda è costituita da professionisti seri e competenti. Insieme a loro abbiamo costruito un sistema organizzato di soluzioni ICT, servizi e attività di consulenza per la compliance alla normativa in materia di protezione dei dati personali (GDPR)read more
Claudia Cavatorta
21:45 20 Apr 18
Ormai da anni lavoriamo con Secure... Online Desktop e ci siamo trovati sempre molto bene. L'Azienda ha dimostrato disponibilità costante nel risolvere problemi ed esigenze che nel nostro tipo di lavoro si presentano molto frequentemente. Sempre puntuali nell'implementare le modifiche richieste e propositivi riguardo a soluzioni che possano apportare migliorie ad un sistema già ottimale. Per quanto riguarda il prodotto: la piattaforma che abbiamo a disposizione funziona molto bene, la connessione è veloce e siamo sicuri di conservare i nostri dati in assoluta sicurezza.read more
Omid Fazeli
06:59 20 Apr 18
They have a lot of solutions for any... kind of business. Lower prices than many others. The support service is always active and efficient.read more
Miki A.
13:47 16 Apr 18
Prodotti eccellenti, a partire dai... classici hosting, sino a VPS e cloud strutturati.
Tempi veloci e staff preparato!read more
Paolo Raimondi
2018-04-21T11:06:26+0000
La Polimatica Progetti Srl, azienda di... cui sono titolare, collabora con soddisfazione da alcuni anni con Secure Online Desktop. L'Azienda è costituita da professionisti seri e competenti. Insieme a loro abbiamo costruito un sistema organizzato di soluzioni ICT, servizi e attività di consulenza per la compliance alla normativa in materia di protezione dei dati personali (GDPR).read more
Ilaria Miglietta
2018-04-21T04:16:37+0000
Servizi affidabili e di semplice... utilizzo. I loro tecnici molto attenti alle esigenze del cliente, continuate cosìread more
Francesca Marastoni
2018-04-20T11:41:31+0000
Excellent service company with... wonderful stuff. Highly recommended. Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Alessio Liga
2018-04-20T08:25:22+0000
Servizi di alto livello, competenti e... disponibili a accettare nuove sfide per sviluppare business
Ottimo supportoread more
Omid Fazeli
2018-04-20T07:03:54+0000
They have a lot of solutions for any... kind of business. Lower prices than many others. The support service is always active and efficient.read more
Matteo Revelli
2018-04-19T22:39:41+0000
Ottima azienda, offre servizi di alta... qualità con personale competente e disponibile.read more
Lorenzo Munari
2018-04-19T16:25:10+0000
Azienda molto seria e affidabile. E'... un piacere poter collaborare con realtà di questo tiporead more
Francisco Amadi
2018-04-19T10:41:17+0000
Ho avuto il piacere di collaborare con... loro e spero vivamente che succeda di nuovo. Competenti, professionali, precisi e cordiali!read more
Davide Michelotto
2018-04-19T07:42:23+0000
Ottimo servizio, seri professionisti al... timone della società e celerità nei tempi di risposta, oltre ogni aspettativa.read more
Luca Prati
2018-04-18T10:12:13+0000
Azienda eccellente, consulenza... customizzata e puntuale.
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
Copyright © 2011 Secure Online Desktop s.r.l. All Rights Reserved.
VAT: 07485920966 “Cloud Computing services - Software cloud - Cloud server - VPS” Terms of ServicePrivacy Policy ISO Certifications