Aggregator

Cybersecurity jobs available right now: November 20, 2024

Help Net Security
1 week 2 days ago

Application Security Engineer ENOC | UAE | On-site – View job details As an Application Security Engineer, you will establish and maintain DLP policies to prevent unauthorized access, transmission, or disclosure of sensitive data, focusing on both on-premises and cloud environments. Design, implement, and manage CASB solutions to control and monitor access to cloud applications and safeguard data across cloud services. Application Security Engineer Intellias | Poland | Remote – View job details As an … More →

The post Cybersecurity jobs available right now: November 20, 2024 appeared first on Help Net Security.

Anamarija Pogorelec

CVE-2024-50210 | Linux Kernel up to 6.12-rc4 posix-clock pc_clock_settime reference count

Vuldb Updates
1 week 2 days ago
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12-rc4. This affects the function pc_clock_settime of the component posix-clock. The manipulation leads to improper update of reference count. This vulnerability is uniquely identified as CVE-2024-50210. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-27532 | bytecodealliance wasm-micro-runtime 06df58f block_type_get_result_types null pointer dereference (Issue 3130)

Vuldb Updates
1 week 2 days ago
A vulnerability classified as problematic has been found in bytecodealliance wasm-micro-runtime 06df58f. This affects the function block_type_get_result_types. The manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2024-27532. The attack can only be done within the local network. There is no exploit available.
vuldb.com

CVE-2021-35473 | LemonLDAP::NG up to 2.0.11 OAuth2 session expiration (ID 2549)

Vuldb Updates
1 week 2 days ago
A vulnerability classified as problematic was found in LemonLDAP::NG up to 2.0.11. This vulnerability affects unknown code of the component OAuth2 Handler. The manipulation leads to session expiration. This vulnerability was named CVE-2021-35473. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-46613 | WeeChat up to 4.4.1 core/core-string.c integer overflow (ID 2178)

Vuldb Updates
1 week 2 days ago
A vulnerability, which was classified as problematic, has been found in WeeChat up to 4.4.1. This issue affects the function string_free_split_shared /string_free_split/string_free_split_command/string_free_split_tags of the file core/core-string.c. The manipulation leads to integer overflow. The identification of this vulnerability is CVE-2024-46613. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-48939 | Paxton Net2 6.07 SR1 API License improper authorization

Vuldb Updates
1 week 2 days ago
A vulnerability was found in Paxton Net2 6.07 SR1. It has been classified as problematic. This affects an unknown part of the component API License Handler. The manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2024-48939. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

Oracle Warns of Agile PLM Vulnerability Currently Under Active Exploitation

The Hackers News
1 week 2 days ago
Oracle is warning that a high-severity security flaw impacting the Agile Product Lifecycle Management (PLM) Framework has been exploited in the wild. The vulnerability, tracked as CVE-2024-21287 (CVSS score: 7.5), could be exploited sans authentication to leak sensitive information. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network
The Hacker News

LastPass 发现虚假支持中心试图窃取客户数据

嘶吼
1 week 2 days ago

LastPass 发现，诈骗者正在为其 Chrome 扩展程序撰写评论，以宣传虚假的客户支持电话号码。

其实电话号码背后是更大的阴谋，旨在诱骗呼叫者让诈骗者可以远程访问他们的计算机。

LastPass 是一款流行的密码管理器，它利用 LastPass Chrome 扩展来生成、保存、管理和自动填充网站密码。威胁者试图通过使用虚假的 LastPass 客户支持号码留下 5 星级评论来瞄准该公司的大量用户群。

这些评论敦促遇到任何应用程序问题的用户拨打相关热线以联系 LastPass 在线客户服务，该服务与供应商无关。

Chrome 网上应用店中的欺诈性评论

相反，接听电话的骗子会冒充 LastPass 并将个人引导至“dghelp[.]top”网站，他们必须在其中输入代码才能下载远程支持程序。

虚假支持网站

拨打虚假支持号码的人会有人询问他们遇到的问题，然后询问他们是否试图通过计算机或移动设备访问 LastPass 以及他们使用的操作系统等一系列问题。然后，他们将被引导至 dghelp[.]top 网站，而威胁者仍保持在线状态，并试图让潜在受害者与该网站互动，从而暴露他们的数据。

研究人员发现，在此页面上输入代码将下载 ConnectWise ScreenConnect 代理 [VirusTotal]，该代理将使诈骗者能够完全访问某人的计算机。

由 ConnectWise 签署的支持代理

从那里，一名威胁者可以让呼叫者继续提问。与此同时，另一个诈骗者利用ScreenConnect在后台安装其他程序进行无人值守的远程访问、窃取数据，或者窃取计算机中的数据。ScreenConnect 客户端将通过 molatorimax[.]icu 和 n9back366[.]stream 与攻击者控制的服务器建立连接。

在隐藏在 Cloudflare 后面之前，这两个网站之前都曾与乌克兰的 IP 地址相关联。提醒 LastPass 用户切勿与任何人（甚至合法的客户支持人员）共享其主密码，因为这将导致对 LastPass 保管库中存储的所有密码和数据的私人访问。

与更大的诈骗活动相关

与虚假 LastPass 支持中心相关的电话号码其实与一场规模大得多的活动有关。该电话号码 805-206-2892 也被发现被宣传为许多其他公司的支持号码，包括 Amazon、Adobe、Facebook、Hulu、YouTube TV、Peakcock TV、Verizon、Netflix、Roku、PayPal、Squarespace、Grammarly、 iCloud、Ticketmaster 和第一资本。

作为 PayPal 和 iCloud 支持号码进行推广

这些虚假的支持号码不仅会发布到 Chrome 扩展程序评论中，还会发布到允许任何人创建内容的网站上，例如公司论坛和 Reddit。虽然其中许多帖子在创建后就被删除了，但其他帖子仍然可用，并且全天都会创建新帖子。

胡金鱼

Managed ad