article thumbnail

Yandex security team caught admin selling access to users’ inboxes

Security Affairs

Russian internet and search company Yandex discloses a data breach, a system administrator was selling access to thousands of user mailboxes. “An internal investigation revealed that an employee had been providing unauthorized access to users’ mailboxes for personal gain. Pierluigi Paganini.

Access 353
article thumbnail

Russia-linked hackers actively exploit CVE-2020-4006 VMware flaw, NSA warns

Security Affairs

Last week, the company finally released security updates to fix the CVE-2020-4006 zero-day flaw in Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. Affected versions are: VMware Workspace One Access 20.10 (Linux) VMware Workspace One Access 20.01 (Linux) VMware Identity Manager 3.3.1

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

FBI and CISA published a new advisory on AvosLocker ransomware

Security Affairs

AvosLocker affiliates use legitimate software and open-source remote system administration tools to compromise the victims’ networks. Threat actors were also observed uploading and use custom webshells to enable network access [T1505.003].

article thumbnail

Critical flaw in VMware Cloud Director allows hackers to take over company infrastructure

Security Affairs

The vulnerability could potentially allow an authenticated attacker to gain access to corporate network, access to sensitive data, and control private clouds within an entire infrastructure. The flaw can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface, and API access. x before 10.0.0.2,

Cloud 327
article thumbnail

Cisco fixes a static default credential issue in Smart Software Manager tool

Security Affairs

The types of fixed vulnerabilities include remote access and code execution, elevation of privilege, denial of service, and cross-site request forgeries. “The vulnerability is due to a system account that has a default and static password and is not under the control of the system administrator.”

article thumbnail

Hackers are targeting Soliton FileZen file-sharing servers

Security Affairs

The attacks are part of a large-scale campaign that also resulted in unauthorized access to a Soliton file shared storage used by the Japanese Prime Minister’s Cabinet Office staff. The vendor recommended changing system administrator account, reset access control, and installing the latest available version. and V5.0.3.

article thumbnail

Possible Chinese Hackers Exploit Microsoft Exchange 0-Days

Data Breach Today

No Patch Yet Available Although Exploitation Requires Authenticated Access Hackers, possibly Chinese, are exploiting Microsoft Exchange zero-day vulnerabilities to apparently implant backdoors and steal credentials. The computing giant says it doesn't yet have a patch, telling systems administrators to instead implement workarounds.