Lack of Visibility: The Challenge of Protecting Websites from Third-Party Scripts

Lack of Visibility: The Challenge of Protecting Websites from Third-Party Scripts,

Third-party apps such as Google Analytics, Meta Pixel, HotJar, and JQuery have become critical tools for businesses to optimize their website performance and services for a global audience. However, as their importance has grown, so has the threat of cyber incidents involving unmanaged third-party apps and open-source tools. Online businesses increasingly struggle to maintain complete visibility

,

Third-party apps such as Google Analytics, Meta Pixel, HotJar, and JQuery have become critical tools for businesses to optimize their website performance and services for a global audience. However, as their importance has grown, so has the threat of cyber incidents involving unmanaged third-party apps and open-source tools. Online businesses increasingly struggle to maintain complete visibility

, ,
https://thehackernews.com/2023/05/lack-of-visibility-challenge-of.html

Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Compromised

Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Compromised,

PHP software package repository Packagist revealed that an « attacker » gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date.
« The attacker forked each of the packages and replaced the package description in composer.json with their own message but did not otherwise make any malicious changes, » Packagist’s Nils Adermann said

,

PHP software package repository Packagist revealed that an « attacker » gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date.
« The attacker forked each of the packages and replaced the package description in composer.json with their own message but did not otherwise make any malicious changes, » Packagist’s Nils Adermann said

, ,
https://thehackernews.com/2023/05/packagist-repository-hacked-over-dozen.html

Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads

Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads,

A new Android subscription malware named Fleckpe has been unearthed on the Google Play Store, amassing more than 620,000 downloads in total since 2022.
Kaspersky, which identified 11 apps on the official app storefront, said the malware masqueraded as legitimate photo editing apps, camera, and smartphone wallpaper packs. The apps have since been taken down.
The operation primarily targets users

,

A new Android subscription malware named Fleckpe has been unearthed on the Google Play Store, amassing more than 620,000 downloads in total since 2022.
Kaspersky, which identified 11 apps on the official app storefront, said the malware masqueraded as legitimate photo editing apps, camera, and smartphone wallpaper packs. The apps have since been taken down.
The operation primarily targets users

, ,
https://thehackernews.com/2023/05/fleckpe-android-malware-sneaks-onto.html

Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model

Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model,

Cisco has warned of a critical security flaw in SPA112 2-Port Phone Adapters that it said could be exploited by a remote attacker to execute arbitrary code on affected devices.
The issue, tracked as CVE-2023-20126, is rated 9.8 out of a maximum of 10 on the CVSS scoring system. The company credited Catalpa of DBappSecurity for reporting the shortcoming.
The product in question makes it possible

,

Cisco has warned of a critical security flaw in SPA112 2-Port Phone Adapters that it said could be exploited by a remote attacker to execute arbitrary code on affected devices.
The issue, tracked as CVE-2023-20126, is rated 9.8 out of a maximum of 10 on the CVSS scoring system. The company credited Catalpa of DBappSecurity for reporting the shortcoming.
The product in question makes it possible

, ,
https://thehackernews.com/2023/05/cisco-warns-of-vulnerability-in-popular.html

Attention, un redoutable malware s’attaque aux gestionnaires de mots de passe

Attention, un redoutable malware s’attaque aux gestionnaires de mots de passe,

malware mots passe

Le malware ViperSoftX est de retour. Cette nouvelle version du malware, encore plus redoutable, ne cherche pas uniquement à voler les cryptomonnaies des utilisateurs. Elle tente aussi de s’emparer des données de leurs gestionnaires de mots de passe.

,

malware mots passe

Le malware ViperSoftX est de retour. Cette nouvelle version du malware, encore plus redoutable, ne cherche pas uniquement à voler les cryptomonnaies des utilisateurs. Elle tente aussi de s’emparer des données de leurs gestionnaires de mots de passe.

, ,
https://www.01net.com/actualites/attention-redoutable-malware-attaque-gestionnaire-mots-passe.html

Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service

Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service,

Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services.
This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal, according to Israeli cloud security firm Ermetic.
« 

,

Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services.
This includes two server-side request forgery (SSRF) flaws and one instance of unrestricted file upload functionality in the API Management developer portal, according to Israeli cloud security firm Ermetic.
« 

, ,
https://thehackernews.com/2023/05/researchers-discover-3-vulnerabilities.html

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection,

Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections.
Tracked as CVE-2023-27350 (CVSS score: 9.8), the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges.
While the flaw was patched by the

,

Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections.
Tracked as CVE-2023-27350 (CVSS score: 9.8), the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges.
While the flaw was patched by the

, ,
https://thehackernews.com/2023/05/researchers-uncover-new-exploit-for.html

Why the Things You Don’t Know about the Dark Web May Be Your Biggest Cybersecurity Threat

Why the Things You Don’t Know about the Dark Web May Be Your Biggest Cybersecurity Threat

,

IT and cybersecurity teams are so inundated with security notifications and alerts within their own systems, it’s difficult to monitor external malicious environments – which only makes them that much more threatening. 
In March, a high-profile data breach hit national headlines when personally identifiable information connected to hundreds of lawmakers and staff was leaked on the dark web. The

,

IT and cybersecurity teams are so inundated with security notifications and alerts within their own systems, it’s difficult to monitor external malicious environments – which only makes them that much more threatening. 
In March, a high-profile data breach hit national headlines when personally identifiable information connected to hundreds of lawmakers and staff was leaked on the dark web. The

, ,
https://thehackernews.com/2023/05/why-things-you-dont-know-about-dark-web.html

Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia

Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia,

Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks.
« Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet, » Guy Rosen, chief information

,

Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks.
« Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links, downloading malware or sharing personal information across the internet, » Guy Rosen, chief information

, ,
https://thehackernews.com/2023/05/meta-uncovers-massive-social-media.html

Mot de passe : ces 4 hacks prouvent qu’un bon code est essentiel

Mot de passe : ces 4 hacks prouvent qu’un bon code est essentiel,

cadenas securite mot de passe

Choisir un bon mot de passe est une étape importante pour sécuriser un compte en ligne. Malheureusement, trop de personnes optent encore pour un code d’accès faible, très facile à deviner pour les attaquants. Ces quatre affaires de piratages illustrent pourtant l’importance d’un mot de passe bien sécurisé…

,

cadenas securite mot de passe

Choisir un bon mot de passe est une étape importante pour sécuriser un compte en ligne. Malheureusement, trop de personnes optent encore pour un code d’accès faible, très facile à deviner pour les attaquants. Ces quatre affaires de piratages illustrent pourtant l’importance d’un mot de passe bien sécurisé…

, ,
https://www.01net.com/actualites/mot-passe-trois-hacks-bon-code-esssentiel.html