Condividi

RSS

Piu’ articoli…

• Unificare la piattaforma per la threat detection
• L’importanza del monitoring ICT
• I benefici SOAR: semplificare indagine e risposta
• Security Code Review: come funziona il servizio
• Automated Response Integration: le automazioni nel SOCaaS
• Coordinazione tra CTI e SOC: come alzare ulteriormente le difese
• Novità Cloud Server: internet ridondata
• Certificato di qualità per il SOCaaS di SOD

Categorie …

• Backup as a Service (24)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (23)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (15)
• ownCloud (7)
• Privacy (8)
• Secure Online Desktop (15)
• Security (157)
  • Cyber Threat Intelligence (CTI) (5)
  • Ethical Phishing (8)
  • SOCaaS (49)
    • SIEM (12)
    • SOAR (4)
    • UEBA (9)
  • Vulnerabilita' (84)
• Web Hosting (15)

Tags

CSIRT

• Rilevata vulnerabilità in prodotti Atlassian (AL02/220630/CSIRT-ITA) Giugno 30, 2022
  Aggiornamenti di sicurezza sanano una vulnerabilità presente nei prodotti Atlassian Jira Server e Jira Service Management Server.
• Aggiornamenti di sicurezza per prodotti Mozilla (AL01/220630/CSIRT-ITA) Giugno 30, 2022
  Mozilla ha rilasciato aggiornamenti di sicurezza per sanare alcune vulnerabilità nei prodotti Firefox, Firefox ESR e Thunderbird.
• PoC pubblico per lo sfruttamento della CVE-2022-31626 (AL01/220627/CSIRT-ITA) Giugno 27, 2022
  Disponibile un Proof of Concept (PoC) per la vulnerabilità CVE-2022-31626 – già sanata dal vendor – presente in PHP. Tale vulnerabilità, qualora sfruttata, potrebbe permettere ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi target.
• La Settimana Cibernetica del 26 giugno 2022 Giugno 27, 2022
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT Italia dal 20 al 26 giugno 2022
• Vulnerabilità in prodotti NAS QNAP (AL06/220623/CSIRT-ITA) Giugno 23, 2022
  Aggiornamenti di sicurezza QNAP risolvono una vulnerabilità, con gravità “critica”, che interessa i propri dispositivi NAS.
• Rilasciati aggiornamenti di sicurezza per Jenkins e Jenkins LTS (AL05/220623/CSIRT-ITA) Giugno 23, 2022
  Rilasciato il Jenkins Security Advisory di giugno che risolve molteplici vulnerabilità in Jenkins weekly e Jenkins LTS.
• Aggiornamenti per prodotti CISCO (AL04/220623/CSIRT-ITA) Giugno 23, 2022
  Aggiornamenti di sicurezza Cisco sanano 2 nuove vulnerabilità in vari prodotti.
• Nuova versione di Google Chrome (AL03/220623/CSIRT-ITA) Giugno 23, 2022
  Nuovo aggiornamento di Google Chrome per Windows, Mac e Linux corregge 14 vulnerabilità di sicurezza.
• PoC pubblico per lo sfruttamento della CVE-2022-22980 (AL02/220623/CSIRT-ITA) Giugno 23, 2022
  Rilevato un Proof of Concept (PoC) per la vulnerabilità CVE-2022-22980 – già sanata dal vendor – presente in Spring Data MongoDB. Tale vulnerabilità, qualora sfruttata, potrebbe permettere ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi target.
• Vulnerabilità in OpenSSL (AL01/220623/CSIRT-ITA) Giugno 23, 2022
  Aggiornamenti di sicurezza risolvono una vulnerabilità in OpenSSL, che potrebbe permettere l’esecuzione di codice arbitrario sui dispositivi target.

Dark Reading

• Google: Hack-for-Hire Groups Present a Potent Threat Giugno 30, 2022
  Cyber mercenaries in countries like India, Russia, and the UAE are carrying out data theft and hacking missions for a wide range of clients across regions, a couple of new reports said.
• 18 Zero-Days Exploited So Far in 2022 Giugno 30, 2022
  It didn't have to be this way: So far 2022's tranche of zero-days shows too many variants of previously patched security bugs, according Google Project Zero.
• API Security Losses Total Billions, But It's Complicated Giugno 30, 2022
  A recent analysis of breaches involving application programming interfaces (APIs) arrives at some eye-popping damage figures, but which companies are most affected, and in what ways?
• Exchange Servers Backdoored Globally by SessionManager Giugno 30, 2022
  Malicious ISS module exploitation is the latest trend among threat actors targeting Exchange servers, analysts say.
• Study Reveals Traditional Data Security Tools Have a 60% Failure Rate Against Ransomware and Extortion Giugno 30, 2022
  Titaniam’s ‘State of Data Exfiltration & Extortion Report’ also finds that while over 70% of organizations had heavy investments in prevention, detection, and backup solutions, the majority of victims ended up giving into attackers' demands.
• NXM Announces Platform That Protects Space Infrastructure and IoT Devices From Cyberattacks Giugno 30, 2022
  NXM Autonomous Security protects against network-wide device hacks and defends against critical IoT vulnerabilities.
• A Fintech Horror Story: How One Company Prioritizes Cybersecurity Giugno 30, 2022
  A password link that didn't expire leads to the discovery of exposed personal information at a payments service.
• Critical ManageEngine ADAudit Plus Vulnerability Allows Network Takeover, Mass Data Exfiltration Giugno 30, 2022
  An unauthenticated remote code execution vulnerability found in Zoho’s compliance tool could leave organizations exposed to an information disclosure catastrophe, new analysis shows.
• Zero-Days Aren't Going Away Anytime Soon & What Leaders Need to Know Giugno 30, 2022
  There were a record number of zero-day attacks last year, but some basic cyber-hygiene strategies can help keep your organization more safe.
• Patch Now: Linux Container-Escape Flaw in Azure Service Fabric Giugno 29, 2022
  Microsoft is urging organizations that don't have automatic updates enabled to update to the latest version of Linux Server Fabric to thwart the "FabricScape" cloud bug.

Full Disclosure

• Backdoor.Win32.InfecDoor.17.c / Insecure Permissions Giugno 28, 2022
  Posted by malvuln on Jun 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/1fd70e41918c3a75c634b1c234ec36fb.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.InfecDoor.17.c Vulnerability: Insecure Permissions Description: The malware writes a ".420" settings file type to c drive granting change (C) permissions to the authenticated user group. Standard users can...
• Trojan-Mailfinder.Win32.VB.p / Insecure Permissions Giugno 28, 2022
  Posted by malvuln on Jun 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/20e438d84aa2828826d52540d80bf7f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Mailfinder.Win32.VB.p Vulnerability: Insecure Permissions Description: The malware writes a dir with multiple PE files to c drive granting change (C) permissions to the authenticated user group. Standard users can […]
• Backdoor.Win32.Shark.btu / Insecure Permissions Giugno 28, 2022
  Posted by malvuln on Jun 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/5a83f8b8c8a8b7a85b3ff632aa60e793.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Shark.btu Vulnerability: Insecure Permissions Description: The malware writes multiple PE files to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable...
• Yashma Ransomware Builder v1.2 / Insecure Permissions Giugno 28, 2022
  Posted by malvuln on Jun 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/13e878ed7e547523cffc5728f6ba4190.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Yashma Ransomware Builder v1.2 Vulnerability: Insecure Permissions Description: The malware creates PE files with insecure permissions when writing to c:\ drive, granting change (C) permissions to the authenticated user […]
• AnyDesk Public Exploit Disclosure - Arbitrary file write by symbolic link attack lead to denial-of-service attack on local machine Giugno 28, 2022
  Posted by chan chan on Jun 27Hi FullDisclosure, I would like to publish an exploit that I found on AnyDesk as follows. # Exploit Title: AnyDesk allow arbitrary file write by symbolic link attack lead to denial-of-service attack on local machine # Google Dork: [if applicable] # Date: 24/5/2022 # Exploit Author: Erwin Chan # […]
• SEC-T CFP ongoing Giugno 28, 2022
  Posted by Mattias Bååth via Fulldisclosure on Jun 27Hey all It's now less than two weeks to submit a talk to SEC-T 2022, at least if you want to be part of the first talk selection round (recommended) that we kick off July first. SEC-T is non-profit, non-corporate, two day, single track, con in Stockholm, […]
• CFP No cON Name 2022 - Barcelona Giugno 28, 2022
  Posted by Jose Nicolas Castellano via Fulldisclosure on Jun 27No cON Name 2022 - Barcelona ************************************ *****  Call For Papers        ****** ************************************ https://www.noconname.org/call-for-papers/ Exact place not disclosed until a few weeks before due celebration.     * INTRODUCTION The organization has  opened CFP proposals. No cON Name is the eldest Hacking and Security Conference in Span. […]
• Onapsis Security Advisory 2022-0007: Directory Traversal vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0) Giugno 21, 2022
  Posted by Onapsis Research via Fulldisclosure on Jun 21# Onapsis Security Advisory 2022-0007: Directory Traversal vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0) ## Impact on Business Exposing the contents of a directory can lead to a disclosure of useful information for the attacker to devise exploits, such as creation times of files or […]
• Onapsis Security Advisory 2022-0006: Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0) Giugno 21, 2022
  Posted by Onapsis Research via Fulldisclosure on Jun 21# Onapsis Security Advisory 2022-0006: Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0) ## Impact on Business Running unnecessary services, like a jetty webserver, may lead to increased surface area for an attack and also it unnecessarily exposes underlying vulnerabilities. ## Advisory Information - […]
• Onapsis Security Advisory 2022-0005: Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpad Giugno 21, 2022
  Posted by Onapsis Research via Fulldisclosure on Jun 21# Onapsis Security Advisory 2022-0005: Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpad ## Impact on Business Impact depends on the victim's privileges. In most cases, a successful attack allows an attacker to hijack a session, or force the victim to perform undesired requests in the SAP […]