#microsoft

The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.

Backdoor.Win32.RemServ.d malware suffers from a remote command execution vulnerability.

Designation recognizes highest caliber of information security.

A recently discovered cyber espionage group dubbed Worok has been found hiding malware in seemingly innocuous image files, corroborating a crucial link in the threat actor's infection chain. Czech cybersecurity firm Avast said the purpose of the PNG files is to conceal a payload that's used to facilitate information theft. "What is noteworthy is data collection from victims' machines using

Military veterans tend to have the kind of skills that would make them effective cybersecurity professionals, but making the transition is not that easy.

IOTransfer version 4 suffers from an unquoted service path vulnerability.

Microsoft on Thursday attributed the recent spate of ransomware incidents targeting transportation and logistics sectors in Ukraine and Poland to a threat cluster that shares overlaps with the Russian state-sponsored Sandworm group. The attacks, which were disclosed by the tech giant last month, involved a strain of previously undocumented malware called Prestige and is said to have taken place

By Deeba Ahmed Dubbed StrelaStealer, the malware is being distributed through malicious email attachments and targets Spanish-speaking people. This is a post from HackRead.com Read the original post: StrelaStealer Malware Hijacking Outlook and Thunderbird Accounts

Welcome to this week’s edition of the Threat Source newsletter. Tuesday was an absolute hammer for the infosec community. Not only did we have the US elections but we had Emotet returning and a regular Microsoft Tuesday release. That release always leads me to think about the bug