#web

KrebsOnSecurity recently heard from a reader whose boss's email account got phished and was used to trick one of the company's customers into sending a large payment to scammers. An investigation into the attacker's infrastructure points to a long-running Nigerian cybercrime group that is actively targeting established companies in the transportation and aviation industries.

Security flaws in Airportr, a door-to-door luggage checking service used by 10 airlines, let hackers access user data and even gain privileges that would have let them redirect or steal luggage.

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed five vulnerabilities in Bloomberg Comdb2.   Comdb2 is an open source, high-availability database developed by Bloomberg. It supports features such as clustering, transactions, snapshots, and isolation. The implementation of the database utilizes optimistic locking for concurrent operation. The vulnerabilities

Cybercrime forum XSS is back online on its mirror and dark web domains just one day after seizure and admin arrest, but questions about its full return remain unanswered.

With more platforms and governments asking for age verification, we look at the options and the implications.

Lower rates for creating unique passwords, buying items from known websites, and using protection software leave iPhone users at risk to online scams.

Brave browser now blocks Microsoft Recall by default, preventing screenshots and protecting users’ browsing history on Windows 11.

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion PKS Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Honeywell reports these vulnerabilities affect the following: Experion PKS: All releases prior to R520.2 TCU9 Hot Fix 1 Experion PKS: All releases prior to R530 TCU3 Hot Fix 1 3.2 Vulnerability Overview 3.2.1 Use of Uninitialized Variable CWE-457 The Honeywell Experion PKS contains an uninitialized variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnera...

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Network Thermostat Equipment: X-Series WiFi thermostats Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain full administrative access to the device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Network Thermostat product is affected: X-Series WiFi thermostats: Versions v4.5 up to but not including v4.6 X-Series WiFi thermostats: Versions v9.6 up to but not including v9.46 X-Series WiFi thermostats: Versions v10.1 up to but not including v10.29 X-Series WiFi thermostats: Versions v11.1 up to but not including v11.5 3.2 Vulnerability Overview 3.2.1 Missing Authentication for Critical Function CWE-306 The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the Local Area Network or from the...

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.0 ATTENTION: Exploitable from a local network Vendor: Mitsubishi Electric Equipment: CNC Series Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute malicious code by getting setup-launcher to load a malicious DLL. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Mitsubishi Electric CNC Series are affected: NC Designer2: All versions NC Designer: All versions NC Configurator2: All versions NC Analyzer2: All versions NC Analyzer: All versions NC Explorer: All versions NC Monitor2: All versions NC Monitor: All versions NC Trainer2: "AB" and prior NC Trainer2 plus: "AB" and prior NC Trainer: All versions NC Trainer plus: All versions NC Visualizer: All versions Remote Monitor Tool: All versions MS Configurator: All versions Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224): All versions Mitsubishi Electric ...