Details Disclosed for GitHub Pages Flaws That Earned Researchers $35,000
GitHub Pages is a service that individuals and organizations can use to host websites. The sites can be hosted on a custom domain or the github.io domain, and the code for the website is taken directly from a private or public GitHub repository. The pages themselves can also be private or public. Over the weekend,…
Adobe Patches Code Execution Flaws in Connect, Creative Cloud, Framemaker
In the Creative Cloud desktop application, Adobe fixed three flaws rated critical, including arbitrary file overwrite and OS command injection issues that can lead to code execution, and an improper input validation issue that can be exploited for privilege escalation. In its Connect product, the company addressed one critical input validation issue that can result…
Information Disclosure, XSS Vulnerabilities Patched in Drupal
The most serious of the flaws is CVE-2020-13668, a critical XSS issue affecting Drupal 8 and 9. It’s worth noting that Drupal uses the NIST Common Misuse Scoring System to determine security risk levels and critical is the second highest level, after highly critical. The issue is a reflected XSS and exploitation is only possible…
COVID-19 affects web traffic and attack trends
There have been significant changes in web attack and traffic trends as a result of COVID-19, according to Imperva. The monthly report also revealed that the Cyber Threat Index remains at a ‘high’ level and the financial services sector has been suffering the most from cross-scripting site (XSS) attacks, and a continued increase in attacks…
Most credential abuse attacks against the financial sector targeted APIs
From May 2019 and continuing on until the end of the year, there was a dramatic shift by criminals who started targeting APIs, in an effort to bypass security controls. According to data from Akamai, up to 75% of all credential abuse attacks against the financial services industry targeted APIs directly. According to the report’s…
Yahoo Pays Out $10,000 Bounty for Critical Mail Flaw
A researcher has earned $10,000 for finding a critical Yahoo! Mail vulnerability that could have been exploited simply by getting the targeted user to open a specially crafted email. Nearly one year ago, Jouko Pynnönen of Finland-based software company Klikki Oy discovered a stored cross-site scripting (XSS) vulnerability in the web version of the Yahoo!…