Condividi

RSS

Piu’ articoli…

• HTTP/3, tutto quello che c’è da sapere del protocollo di ultima versione
• Machine learning e cybersecurity: Applicazioni UEBA e sicurezza
• Logic Bomb: cosa sono e come prevenirle
• Pass the hash: come guadagnare accesso senza la password
• Ransomware e NAS: un rischio che non si considera
• Monitoring SIEM: le best practice
• Cyber Threat Hunting: a caccia di minacce per la sicurezza
• Ethical hacking: difendere sapendo come attaccare

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (12)
• ownCloud (7)
• Privacy (7)
• Secure Online Desktop (14)
• Security (8)
  • Ethical Phishing (3)
  • SOCaaS (13)
    • SIEM (5)
    • UEBA (4)
  • Vulnerabilita' (82)
• Web Hosting (15)

Tags

CSIRT

• Vulnerabilità in prodotti Cisco non più supportati (EOL) (AL01/210408/CSIRT-ITA) Aprile 8, 2021
  Cisco ha reso nota una vulnerabilità critica che interessa alcuni suoi prodotti end-of-life, per i quali consiglia la dismissione.
• Phishing a tema Aruba (AL01/210407/CSIRT-ITA) Aprile 7, 2021
  Rilevata una pagina di phishing finalizzata al furto delle credenziali di accesso al portale di gestione dei servizi Aruba.
• Campagna malspam diffonde il trojan Poulight (AL02/210406/CSIRT-ITA) Aprile 6, 2021
  È stata recentemente rilevata una campagna malspam finalizzata a diffondere il trojan Poulight, programmato per raccogliere il maggior numero di informazioni sulla macchina infetta.
• Risolta vulnerabilità critica in VMware (AL01/2100406/CSIRT-ITA) Aprile 6, 2021
  VMware ha pubblicato un bollettino di sicurezza contenente aggiornamenti per sanare una vulnerabilità con gravità “critica” nella soluzione Carbon Black Cloud Workload.
• La Settimana Cibernetica del 4 aprile 2021 Aprile 5, 2021
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 29 marzo al 4 aprile 2021.
• Aggiornamenti di sicurezza per Chrome (AL02/210402/CSIRT-ITA) Aprile 2, 2021
  Google ha rilasciato una nuova versione del browser Chrome per sanare 8 vulnerabilità, alcune delle quali di gravità “alta”.
• Risolte vulnerabilità su Zimbra (AL01/210402/CSIRT-ITA) Aprile 2, 2021
  Rilasciati aggiornamenti per sanare 4 vulnerabilità riscontrate nel software Zimbra, di cui una con gravità “critica”.
• Campagna malevola diffonde Remcos (BL01/210401/CSIRT-ITA) Aprile 1, 2021
  Il tool legittimo Remcos viene diffuso per scopi malevoli tramite un file Excel armato di macro.
• Risolte vulnerabilità OpenSSL su prodotti Cisco (AL02/210331/CSIRT-ITA) Marzo 31, 2021
  Cisco ha pubblicato un bollettino di sicurezza contenente aggiornamenti per sanare le recenti vulnerabilità di OpenSSL che interessano alcuni prodotti Cisco.
• Risolte vulnerabilità su VMware (AL01/210331/CSIRT-ITA) Marzo 31, 2021
  VMware ha pubblicato un bollettino di sicurezza contenente aggiornamenti per sanare 2 vulnerabilità con gravità “critica”.

Dark Reading:

• Zoom Joins Microsoft Teams on List of Enterprise Tools Hacked at Pwn2Own Aprile 8, 2021
  White-hat hacking event shows yet again why there's no such thing as foolproof security against modern attacks.
• Fraudsters Use HTML Legos to Evade Detection in Phishing Attack Aprile 8, 2021
  Criminals stitch pieces of HTML together and hide them in JavaScript files, researchers report.
• 600K Payment Card Records Leaked After Swarmshop Breach Aprile 8, 2021
  A leaked database also contains the nicknames, hashed passwords, contact details, and activity history of Swarmshop admins, sellers, and buyers.
• Handcuffs Over AI: Solving Security Challenges With Law Enforcement Aprile 8, 2021
  We've tried everything else ... now it's time to make the prospect of getting caught -- and punished -- a real deterrent to cybercrime.
• SecOps and DevOps: From Cooperation to Automation Aprile 7, 2021
  Omdia Principal Analyst Eric Parizo discusses the major obstacles SecOps organizations face as they seek to build ties with DevOps teams, and offers a programmatic approach to help create a path toward DevSecOps.
• Did 4 Major Ransomware Groups Truly Form a Cartel? Aprile 7, 2021
  An analysis of well-known extortion groups and their cryptocurrency transactions reveals the answer.
• Voice-Changing Software Found on APT Attackers' Server Aprile 7, 2021
  Security researchers believe the presence of Morph Vox Pro could indicate APT-C-23 has new plans for their phishing campaigns.
• Cring Ransomware Used in Attacks on European Industrial Firms Aprile 7, 2021
  Attackers exploited a vulnerability in Fortigate VPN servers to gain access to target networks, researchers report.
• Fortune 500 Security Shows Progress and Pitfalls Aprile 7, 2021
  Fortune 500 companies have improved on email security and vulnerability disclosure programs but struggle in asset management and high-risk services.
• Rethinking Cyberattack Response: Prevention & Preparedness Aprile 7, 2021
  The SolarWinds incident is the starkest reminder yet that complacency can exact a terrible price.

Full Disclosure

• Backdoor.Win32.Small.n / Unauthenticated Remote Command Execution (SYSTEM) Aprile 8, 2021
  Posted by malvuln on Apr 08Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/fb24c3509180f463c9deaf2ee6705062.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Small.n Vulnerability: Unauthenticated Remote Command Execution (SYSTEM) Description: The backdoor malware listens on TCP Port 1337, upon successful connection we get handed a remote shell from the infected host with SYSTEM...
• [SYSS-2020-032] Open Redirect in Tableau Server (CVE-2021-1629) Aprile 8, 2021
  Posted by Vladimir Bostanov on Apr 08Advisory ID: SYSS-2020-032 Product: Tableau Server Manufacturer: Tableau Software, LLC, a Salesforce Company Affected Version(s): 2019.4-2019.4.17, 2020.1-2020.1.13, 2020.2-2020.2.10, 2020.3-2020.3.6, 2020.4-2020.4.2 Tested Version(s): 2020.2.1 (20202.20.0525.1210) 64-bit Windows Vulnerability Type: URL Redirection to Untrusted Site (CWE-601) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2020-07-29 Solution Date:...
• Backdoor.Win32.Hupigon.das / Unauthenticated Open Proxy Aprile 8, 2021
  Posted by malvuln on Apr 08Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/7afe56286039faf56d4184c476683340.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.das Vulnerability: Unauthenticated Open Proxy Description: The malware drops an hidden executable named "winserv.com" under Windows dir, which accepts TCP connections on port 8080. Afterwards, it connects to a...
• Trojan.Win32.Hotkeychick.d / Insecure Permissions Aprile 8, 2021
  Posted by malvuln on Apr 08Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/aff493ed1f98ed05c360b462192d2853.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Win32.Hotkeychick.d Vulnerability: Insecure Permissions Description: creates an insecure dir named "Sniperscan" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the...
• Trojan-Downloader.Win32.Genome.qiw / Insecure Permissions Aprile 8, 2021
  Posted by malvuln on Apr 08Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/5cddc4647fb1c59f5dc7f414ada7fad4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Downloader.Win32.Genome.qiw Vulnerability: Insecure Permissions Description: Genome.qiw creates an insecure dir named "tmp" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can...
• Trojan-Downloader.Win32.Genome.omht / Insecure Permissions Aprile 8, 2021
  Posted by malvuln on Apr 08Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/01055838361f534ab596b56a19c70fef.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Downloader.Win32.Genome.omht Vulnerability: Insecure Permissions Description: Genome.omht creates an insecure dir named "wjmd97" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can...
• Trojan.Win32.Hosts2.yqf / Insecure Permissions Aprile 8, 2021
  Posted by malvuln on Apr 08Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/274a6e846c5a4a2b3281198556e5568b.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Win32.Hosts2.yqf Vulnerability: Insecure Permissions Description: Hosts2.yqf creates an insecure dir named "mlekaocYUmaae" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can...
• usd20210005: Privileged File Write in Check Point Identity Agent < R81.018.0000 Aprile 8, 2021
  Posted by Responsible Disclosure via Fulldisclosure on Apr 08### Advisory: Privileged File Write Description =========== The Check Point Identity Agent allows low privileged users to write files to protected locations of the file system. Details ======= Advisory ID: usd-2021-0005 Product: Check Point Identity Agent Affected Version: < R81.018.0000 Vulnerability Type: Symlink Vulnerability Security Risk: High […]
• CVE-2021-26709 - Multiple Pre-Auth Stack Buffer Overflow in D-Link DSL-320B-D1 ADSL Modem Aprile 8, 2021
  Posted by Gabriele Gristina on Apr 08Multiple Pre-Auth Stack Buffer Overflow in D-Link DSL-320B-D1 ADSL Modem ======== < Table of Contents > ========================================= 0. Overview 1. Details 2. Solution 3. Disclosure Timeline 4. Thanks & Acknowledgements 5. References 6. Credits 7. Legal Notices ======== < 0. Overview > =============================================== Release Date: 7 March 2021 Revision: […]
• SEC Consult SA-20210407-0 :: Arbitrary File Upload and Bypassing .htaccess Rules in Monospace Directus Headless CMS Aprile 7, 2021
  Posted by SEC Consult Vulnerability Lab on Apr 07SEC Consult Vulnerability Lab Security Advisory < 20210407-0 > ======================================================================= title: Arbitrary File Upload and Bypassing .htaccess Rules product: Monospace Directus Headless CMS vulnerable version: < v8.8.2 fixed version: v8.8.2, v9 is not affected because of different architecture CVE number: CVE-2021-29641 impact: High...