Vue lecture

Il y a de nouveaux articles disponibles, cliquez pour rafraîchir la page.

SinoTrack GPS Devices Vulnerable to Remote Vehicle Control via Default Passwords

Two security vulnerabilities have been disclosed in SinoTrack GPS devices that could be exploited to control certain remote functions on connected vehicles and even track their locations. "Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface," the U.S. Cybersecurity and Infrastructure

How to Build a Lean Security Model: 5 Lessons from River Island

In today’s security landscape, budgets are tight, attack surfaces are sprawling, and new threats emerge daily. Maintaining a strong security posture under these circumstances without a large team or budget can be a real challenge. Yet lean security models are not only possible - they can be highly effective. River Island, one of the UK’s leading fashion retailers, offers a powerful

Les attaques DDoS entrent dans une nouvelle ère et le secteur financier est en première ligne

Selon FS-ISAC et Akamai, en 2024, les institutions financières ont subi une vague sans précédent d’attaques DDoS, de plus en plus complexes, ciblées et difficiles à contrer. Dans leur rapport conjoint « From Nuisance to Strategic Threat », les deux acteurs révèlent comment ces menaces mettent à l’épreuve la résilience opérationnelle, ébranlent la confiance des […]

The post Les attaques DDoS entrent dans une nouvelle ère et le secteur financier est en première ligne first appeared on UnderNews.

Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero-Day Exploited in the Wild

Microsoft has released patches to fix 67 security flaws, including one zero-day bug in Web Distributed Authoring and Versioning (WebDAV) that it said has come under active exploitation in the wild. Of the 67 vulnerabilities, 11 are rated Critical and 56 are rated Important in severity. This includes 26 remote code execution flaws, 17 information disclosure flaws, and 14 privilege escalation

35% des sites de voyages en France exposent le public à la fraude par courriel

Le départ en vacances se rapproche, et depuis mi-mai, de faux sites imitant des plateformes majeures piègent les internautes, subtilisant identifiants et données personnelles des voyageurs. Dans ce contexte, Proofpoint dévoile aujourd’hui une nouvelle étude révélant que 35 % des 20 principaux sites de voyage en ligne en France n’implémentent pas les mesures de cybersécurité […]

The post 35% des sites de voyages en France exposent le public à la fraude par courriel first appeared on UnderNews.

JFrog identifie un package malveillant sur PyPI ciblant les utilisateurs de Chimera Sandbox Notebook Service

Les équipes de sécurité de JFrog ont récemment découvert et signalé un package malveillant, nommé chimera-sandbox-extensions, mis en ligne sur PyPI par un utilisateur se faisant appeler chimerai. Pour rappel, Chimera Sandbox fournit l’infrastructure essentielle aux ingénieurs en machine learning et aux data scientists pour concevoir et tester rapidement des modèles de langage (LLM). Tribune […]

The post JFrog identifie un package malveillant sur PyPI ciblant les utilisateurs de Chimera Sandbox Notebook Service first appeared on UnderNews.

Adobe Releases Patch Fixing 254 Vulnerabilities, Closing High-Severity Security Gaps

Adobe on Tuesday pushed security updates to address a total of 254 security flaws impacting its software products, a majority of which affect Experience Manager (AEM). Of the 254 flaws, 225 reside in AEM, impacting AEM Cloud Service (CS) as well as all versions prior to and including 6.5.22. The issues have been resolved in AEM Cloud Service Release 2025.5 and version 6.5.23. "Successful

Researchers Uncover 20+ Configuration Risks, Including Five CVEs, in Salesforce Industry Cloud

Cybersecurity researchers have uncovered over 20 configuration-related risks affecting Salesforce Industry Cloud (aka Salesforce Industries), exposing sensitive data to unauthorized internal and external parties. The weaknesses affect various components like FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions. "Low-code platforms such as

FIN6 Uses AWS-Hosted Fake Resumes on LinkedIn to Deliver More_eggs Malware

The financially motivated threat actor known as FIN6 has been observed leveraging fake resumes hosted on Amazon Web Services (AWS) infrastructure to deliver a malware family called More_eggs. "By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to malware," the

Rust-based Myth Stealer Malware Spread via Fake Gaming Sites Targets Chrome, Firefox Users

Cybersecurity researchers have shed light on a previously undocumented Rust-based information stealer called Myth Stealer that's being propagated via fraudulent gaming websites. "Upon execution, the malware displays a fake window to appear legitimate while simultaneously decrypting and executing malicious code in the background," Trellix security researchers Niranjan Hegde, Vasantha Lakshmanan

❌