Archive for the ‘Uncategorized’ Category

CVE-2021-46097

Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log
Source: NIST
CVE-2021-46097

CVE-2021-46377

There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser
Source: NIST
CVE-2021-46377

CVE-2021-46102

From version 0.2.14 to 0.2.16 for Solana rBPF, function “relocate” in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable “addr” via “addr = (sym.st_value + refd_pa) as u64”;
Source: NIST
CVE-2021-46102

Florida Considers Deepfake Ban

Florida Considers Deepfake Ban

Florida is seeking to outlaw the malicious distribution of sexually explicit images without the subject’s consent. 


New legislation advanced in the Florida Senate Criminal Justice Committee on Tuesday aims to curb the unauthorized digital trafficking of real and deepfake lewd content and establish new regulations around revenge porn.


Senate Bill 1798, introduced by senator Lauren Book, would prohibit someone from knowingly, willfully and maliciously disseminating deepfake sexually explicit images without the permission of the individual(s) pictured. 


It would also criminalize the theft of sexually explicit images from an individual’s phone or digital device with the intent to distribute or benefit from them in some way.  


Additionally, the legislation renames “child pornography” as “child sexual abuse material” to underline that all visual depictions of sexually explicit conduct involving a minor constitute abuse and exploitation. 


Senator Brook said: “This bill will transform the way the state of Florida prosecutes and enforces ‘cyber trafficking,’ where images are uploaded to the darkest corners of the internet for people to buy, sell, trade, and use however else they see fit.”


Brook, whose own childhood was marred by six years of sexual abuse at the hands of her nanny, was also victimized in adulthood when nude photos of her were stolen. The senator became aware of the theft only when a cyber-criminal threatened to expose the images unless she paid a ransom. 


An investigation into the theft revealed that the images had been traded on the internet since 2010. Discussions about the images online included requests for content showing Brook being raped, killed and tortured. 


“Horrifically, once these images are online, they never truly go away,” said Brook. 


“It’s time to give victims some hope and bad actors a reason to think twice.”


The new bill also seeks to allow victims of this form of cybercrime to be entitled to seek civil damages up to $10,000.


Speaking on Tuesday after SB 1798 won the Committee’s approval, Brook said: “Today is an excellent first step at updating our laws to reflect the added layers of terror and victimization that are emerging due to the digital world we live in.”


Source: Infosecurity
Florida Considers Deepfake Ban

IFSEC Seeks Security Pros for New Survey on Physical Access Control

Take part in an IFSEC Global survey to better understand the state of access control in 2022.
Source: DarkReading
IFSEC Seeks Security Pros for New Survey on Physical Access Control

Data Breach at Drug Screening Lab

Data Breach at Drug Screening Lab

A configuration error has caused a prolonged data breach at a Florida County’s drug screening laboratory. 


The security incident occurred at St. Lucie County’s Drug Screening Lab (SLC Lab), which supplies drug testing services for employment, court cases and other purposes.


In a statement released January 20 2022, County leaders said that a misconfiguration detected in the lab’s website portal had inadvertently made some of the portal users’ personal data accessible for more than four years.


“Upon learning of this issue, SLC Lab corrected the misconfiguration and immediately launched an investigation in consultation with outside cybersecurity professionals who regularly investigate and analyze these types of incidents,” said the officials. 


“SLC Lab devoted considerable time and effort to determine what information may have been accessible to unauthorized users.”


A digital forensic investigation was launched to determine what data had been exposed by mistake. 


The County said: “SLC Lab discovered on December 28 2021 that the website portal misconfiguration allowed for data to be accessible to certain portal users between June 2 2017 and October 13 2021.”


Data exposed in the incident included full names and one or more of the following: Social Security numbers, dates of birth and limited lab test type and result information.


“To date, SLC Lab is not aware of any reports of identity fraud or improper use of any information as a direct result of this incident,” said the County. 


On January 20, the lab began notifying affected individuals of the security incident by letter and encouraging them to enroll in complimentary credit monitoring services. County leaders did not state how many residents of St. Lucie County may have had their data compromised.


St. Lucie County spokesman Erick Gill told WPTV that the mistake impacted no other data in the care of the county. 


“SLC Lab is committed to maintaining the privacy of personal information in its possession and has taken many precautions to safeguard it,” said Gill. 


He added: “SLC Lab continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains.”



Source: Infosecurity
Data Breach at Drug Screening Lab

Hacker Flags Flaw in Swiss Railway System

Hacker Flags Flaw in Swiss Railway System

An anonymous hacker has raised the alarm after discovering a vulnerability impacting Switzerland’s national railway system.


The flaw allowed the hacker to gain access to personal data belonging to around 500,000 individuals who had purchased tickets to ride on Swiss Federal Railways (SFR).


After detecting a weak spot in SFR’s Swiss Card system, the hacker reported it to the Rundschau show, which airs on Swiss public television, SRF.


Information left vulnerable by the flaw included travelers’ names, dates of birth, the number of first- and second-class tickets they purchased, places of departure and final destinations.


Speaking to the Rundschau program, the hacker said that anyone could have easily viewed the data as no specialist IT knowledge was needed to exploit the flaw. 


“The sensitive data was practically public on the internet,” said the hacker. 


The security breach was reported to Switzerland’s Federal Data Protection Commissioner. 


According to Swiss news site Swiss Info, the data compromised by the hacker was never made public and has since been secured by SFR. 


The hacker said that their motivation in exploiting the flaw was to expose its existence in the hope of averting a potentially malicious cyber-attack. 


“This is a huge meltdown for Swiss Railways,” Otto Hostettler, an author and journalist specializing in cybercrime, told the Rundschau program. 


“Such data can be sold in hacker forums on the dark web. In the wrong hands, it would have great potential for abuse.”


Cyber-criminals have been known to target the Swiss rail industry. In May 2020, hackers stole data from Swiss train manufacturer Stadler Rail and demanded a payment of $6m in Bitcoin for its return.


Following the attack, Stadler released a statement saying that it “is not and has never been willing to make payments to blackmailers and has not entered into negotiations.”


In response to Stadler’s rebuff, the cyber-thieves published images of some of the stolen files on the internet. A message accompanying the images stated that the criminals had swiped no fewer than 10,000 documents from the train maker. 


The company said it had backups of all the data compromised in the attack. 



Source: Infosecurity
Hacker Flags Flaw in Swiss Railway System

With Cloud the Norm, Insiders Are Everywhere — and Pose Greater Risk

After companies accelerated their adoption of cloud infrastructure, remote workers are now insiders and pose significant risks, and costs, to companies.
Source: DarkReading
With Cloud the Norm, Insiders Are Everywhere — and Pose Greater Risk

CVE-2021-46065

A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
Source: NIST
CVE-2021-46065

CVE-2021-46088

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the “Zabbix Admin” role is able to run custom shell script on the application server in the context of the application user.
Source: NIST
CVE-2021-46088