Please consider updating your browser. Some parts of the website may not function as intended.

Millions of Connected Cameras Open to Eavesdropping on IoT Camera Feeds

IoT Camera

A supply-chain component contains a critical impact vulnerability that allows a remote attacker to eavesdrop on IoT camera feeds. CVE-2021-32934 has a CVSS score of 9.1, it was introduced through ThroughTek, a component that is commonplace in CCTV systems along with other connected camera devices such as baby monitors. ThroughTek’s point-to-point (P2P) software development kit […]

New Kubernetes Malware Backdoors Clusters via Windows Containers

windows containers

A malware strain has been at large for over a year, which was observed to compromise Kubernetes Clusters clearing the way for a backdoor, giving the attacker persistent access. Kubernetes was originally developed by Google and is currently maintained by the Cloud Native Computing Foundation. It is an open-source system that helps automate the deployment, […]

NoSQL Injection Attacks Expose Rocket Chat Servers to Remote Code Execution

Rocket chat servers

Two vulnerabilities in the Rocket Chat (RC) application make it possible for attackers to achieve remote code execution on the server hosting them. RC is a popular open-source messaging platform for enterprise customers. Customers include Lloyd’s, Lockheed Martin and the University of California. RC utilises the MongoDB database, which uses NoSQL to store its data. […]

“Wormhole” Proof of Concept Released for Wormable Windows HTTP Vulnerability

Windows HTTP Vulnerability

A proof of concept (PoC) script was released exploiting a critical vulnerability in the latest version of Windows 10 and Windows Server additions. The vulnerability, tracked as CVE-2021-31166 was found in the HTTP Protocol Stack (HTTP.sys), used by the Windows Information (IIS) webserver. The Windows HTTP vulnerability has wormable properties, meaning it is self-propagating, unlike […]

“Sapped” Critical Vulnerabilities are Exploited in SAP Applications

Cyber security firm, Onapsis, has warned of 6 critical vulnerabilities being actively exploited in the wild. The researchers recorded more than 300 successful attacks between mid-2020 and April 2021. SAP systems are used by many organisations for managing critical business processes, including product life-cycle management, customer relationship management, enterprise resource planning and supply chain management. […]

“Offroad” Vulnerable Dell Drivers Endangers Millions of Systems

dell drivers

Older Dell users should be aware of a vulnerable driver that has been pushed out to consumer and enterprise computers for the last 12 years. The multiple vulnerabilities could lead to privilege escalation. Millions of Dell desktops, laptops and tablets received the vulnerable driver through BIOS updates. The 5 vulnerabilities tracked as CVE-2021-21551 discovered in […]

Password Manager Hacked to Deploy Malware on Customer Systems

password manager

A currently unidentified threat actor has compromised the update mechanism of Passwordstate, a password manager application primarily catering to enterprise customers, and has deployed malware on its user’s devices. Click Studios, the firm behind Passwordstate, has notified 29,000 customers via email, according to communications obtained by a Polish tech news site. The malware was live […]

120 Compromised Advertisement Servers Put Millions of Internet Users at Risk

advertisement servers

An ongoing “malvertising” campaign dubbed “Tag Barnakle” was identified as the breach point of more than 120 Advertisement servers over the past year. The threat actors aim to inject code to host Adware that redirects users to domains under threat actors’ control, exposing them to more malware. The adversaries behind the Tag Barnakle campaign are […]

Shut Down the 5 Deadliest Web Application Attack Vectors

Web Application Attack Vectors

Web applications are an essential component of any modern business. They can help convey the company vision, advertise services and deliver content to customers. Regardless of their use, they are a necessity to make oneself or a business known to the world. However, as beneficial as they can be, they can also be a double-edged […]

FBI & CISA Warning – FortiOS Vulnerabilities are Actively Exploited

FortiOS Vulnerabilities

APT’s exploit Fortinet FortiOS vulnerabilities to compromise systems belonging to government and commercial entities, warn US agencies. Threat actors are scanning for three high severity vulnerabilities that have not been patched. CVE-2018-13379, CVE-2020-12812 and, CVE-2019-5591 are actively being exploited. Each of these vulnerabilities is public and the vendor issued patches, but unless IT administrators apply […]

Risk Crew