This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \evil.com/path. This vulnerability is only exploitable if an….
The Taiwanese computer manufacturer Acer has been reportedly hit with a ransomware attack, with hackers demanding $50 million from the company – one of the largest ransom demand to date. According to Bleeping Computer, the culprit behind the attack is believed to be the REvil ransomware gang. The group announced the breach on their leak…
Even as Microsoft expanded patches for the so-called PrintNightmare vulnerability for Windows 10 version 1607, Windows Server 2012, and Windows Server 2016, it has come to light that the fix for the remote code execution exploit in the Windows Print Spooler service can be bypassed in certain scenarios, effectively defeating the security protections and permitting…
A malicious Xcode project known as XcodeSpy is targeting iOS devs in a supply-chain attack to install a macOS backdoor on the developer’s computer. Xcode is a free application development environment created by Apple that allows developers to create applications that run on macOS, iOS, tvOS, and watchOS. Like other development environments, it is common…
Breach Notification , Cybercrime , Fraud Management & Cybercrime Malaysia Airlines, Singapore Airlines, Finnair, Air New Zealand Confirm Breaches Prajeet Nair (@prajeetspeaks) • March 5, 2021 Photo: Malaysia Airlines An aviation IT company that says it serves 90% of the world’s airlines has been breached in what appears to be a coordinated supply…
Cybercrime , Data Loss Prevention (DLP) , Endpoint Security 1.5 Million Facebook Passwords Among Leaked Data; Raccoon Infostealer Suspected Jeremy Kirk (jeremy_kirk) • June 10, 2021 A control panel for the Raccoon infostealer botnet, where subscribers can browse data stolen from compromised computers (Source: Hold Security) There’s such a surfeit of stolen data…
Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Governance & Risk Management 16 Critical Infrastructure Sectors Especially Off Limits – Or Else, President Warns Doug Olenick (DougOlenick) • June 16, 2021 U.S. President Joe Biden At their Geneva summit meeting Wednesday, U.S. President Joe Biden told Russian President Vladimir Putin that…
