Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome

Administered by:

Server stats:

5.4K
active users

techhub.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#cisco

22 posts16 participants4 posts today
Public
Opalsec :verified:

Staying ahead means staying informed, right? Here's our latest wrap of the day's Cyber News:

🗞️ opalsec.io/daily-news-update-t

If you're short on time, here’s a quick whip-around of the top 3 stories of note:

🕵️‍♂️ Hunters Ransomware Rethink: Is the heat getting too much? Hunters International leadership reportedly told affiliates ransomware is now too "risky," planning a shift to pure data theft/extortion under a "World Leaks" banner. While their current status is murky, this potential pivot away from encryption echoes moves by other groups and highlights how defensive pressures are forcing attacker evolution – something we all need to track.

📧 White House OpSec Woes: Remember that recent White House Signal mishap? Well, now the same National Security Adviser is reportedly facing heat for using personal Gmail for sensitive (if unclassified) government discussions, raising serious OpSec and compliance alarms. It's a potent reminder for us all: even seemingly benign comms on personal platforms can create significant risks, and basic security hygiene is non-negotiable, especially when sensitive info is involved.

📞 Verizon API Call Log Leak: Here’s a worrying find: a simple API flaw in Verizon's Call Filter app exposed the incoming call history of potentially all their wireless customers to each other. Technically, it was a textbook case of broken object-level authorization – the API didn't check if the user's token matched the phone number whose logs were requested in a header. This highlights the critical need for robust API authorization checks and the significant privacy impact even call metadata can have.

Have a read of the full newsletter, and sign up to get all the details straight to your inbox each day:

📨 opalsec.io/daily-news-update-t

Opalsec · Daily News Update: Thursday, April 3, 2025 (Australia/Melbourne)Hunters International's transition to Data Extortion model could indicate the "impose cost" offensive targeting Ransomware is paying off. Trump Administration uses commercial email for sensitive military discussions. Verizon API flaw allowed unrestricted access to customer call history.
#CyberSecurity#InfoSec#ThreatIntel
Public
AAKL

New.

Cisco Meraki MX and Z Series AnyConnect VPN Denial of Service Vulnerability sec.cloudapps.cisco.com/securi

Cisco Enterprise Chat and Email Denial of Service Vulnerability sec.cloudapps.cisco.com/securi

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerabilities sec.cloudapps.cisco.com/securi

Posted yesterday. Critical: Cisco Smart Licensing Utility Vulnerabilities sec.cloudapps.cisco.com/securi @TalosSecurity #cybersecurity #infosec #Cisco

CiscoCisco Security Advisory: Cisco Meraki MX and Z Series AnyConnect VPN Denial of Service VulnerabilityA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause a denial of service (DoS) condition in the Cisco AnyConnect service on an affected device. To exploit this vulnerability, the attacker must have valid VPN user credentials on the affected device. This vulnerability exists because a variable is not initialized when an SSL VPN session is established. An attacker could exploit this vulnerability by supplying crafted attributes while establishing an SSL VPN session with an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to restart, resulting in the failure of the established SSL VPN sessions and forcing remote users to initiate a new VPN connection and reauthenticate. A sustained attack could prevent new SSL VPN connections from being established. Note: When the attack traffic stops, the Cisco AnyConnect VPN server recovers without manual intervention. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vNRpDvfb
Public
AAKL

Just updated.

Cisco: Webex for BroadWorks Credential Exposure Vulnerability sec.cloudapps.cisco.com/securi #Cisco #cybersecurity #infosec

CiscoCisco Security Advisory: Cisco Webex for BroadWorks Credential Exposure VulnerabilityA low-severity vulnerability in Cisco Webex for BroadWorks Release 45.2 could allow an unauthenticated, remote attacker to access data and credentials if unsecure transport is configured for SIP communication. This vulnerability is due to the exposure of sensitive information in the SIP headers. A related issue could allow an authenticated user to access credentials in plain text in the client and server logs.  A malicious actor could exploit this vulnerability and the related issue to access data and credentials and impersonate the user. A configuration change to fix this vulnerability and the related issue has been pushed to Cisco Webex for BroadWorks. Cisco recommends that customers restart their Cisco Webex application to apply the configuration changes. There is a workaround that addresses this vulnerability and the related issue. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-credexp-xMN85y6
ExploreLive feeds
About