NEWS

Something is always happening, get the updates.

What to Know About The Jamaica Data Protection Act

Cuba ransomware group hitting US organizations

St Vincent and the Grenadines embracing CariSECURE

St Vincent’s Police Moving to New Computer information System for Crime

Jamaica’s Auditor General cites security weaknesses in gov’t software

Caribbean States are Working Together to Tackle Cybercrime

Jamaica’s government close to establishing ICT Authority

Microsoft digital certificates used to sign malware by ransomware group Cuba

Information Regarding Cyber-Security Incident Speculative and Inaccurate

TOOLS

Software to help you assess and secure your organisation’s systems.

Zykeys Wireless Tool – Zykeys demonstrates how default wireless settings are derived on some models of ZyXEL routers.

Zorp Proxy Firewall Suite 3.9.5 – Zorp is a proxy firewall suite

ZyXEL Godmode Backdoor Account Scanner – zyHell is a perl script that scans for the ZyXEL godmode backdoor account.

Zeek 4.2.0 – Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

wbscan.tar.gz – zipp0.c but enhanced to scan for wingates

Zone-H Multithreaded Poster – Zone-H posting utility that is multi-threaded.

yersinia-0.5.5.tar.gz – Yersinia implements several attacks for the following protocols: Spanning Tree (STP), Cisco Discovery (CDP), Dynamic Host Configuration (DHCP), Hot Standby Router (HSRP), Dynamic Trunking (DTP), 802.1q and VLAN Trunking (VTP), helping a pen-tester with different tasks.

yersinia-0.5.5.1.tgz – Yersinia implements several attacks for the following protocols: Spanning Tree (STP), Cisco Discovery (CDP), Dynamic Host Configuration (DHCP), Hot Standby Router (HSRP), Dynamic Trunking (DTP), 802.1q and VLAN Trunking (VTP), helping a pen-tester with different tasks.

yersinia-0.5.6.tar.gz – Yersinia implements several attacks for the following protocols: Spanning Tree (STP), Cisco Discovery (CDP), Dynamic Host Configuration (DHCP), Hot Standby Router (HSRP), Dynamic Trunking (DTP), 802.1q and VLAN Trunking (VTP), helping a pen-tester with different tasks.

VULNERABILITIES

Weaknesses, flaws, or errors that can be exploited by threats.

CVE-2020-27212 – STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect acce

CVE-2020-27216 – In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 1

CVE-2020-27194 – An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_m

CVE-2020-27207 – Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlci

CVE-2020-27208 – The flash read-out protection (RDP) level is not enforced during the devi

CVE-2020-27181 – A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix

CVE-2020-27196 – An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2

CVE-2020-27199 – The Magic Home Pro application 1.5.1 for Android allows Authentication By

CVE-2020-2720 – Vulnerability in the Oracle FLEXCUBE Investor Servicing product of Oracle

EXPLOITS

Code that takes advantage of a security vulnerability or flaw. 

Croogo CMS 1.3.4 – Multiple HTML Injection Vulnerabilities – Perl webapps Exploit

Check_MK 1.2.8p25 – Information Disclosure – Python webapps Exploit

CAMALEON CMS 2.4 – Cross-Site Scripting – Ruby webapps Exploit

Codiad 2.8.4 – Remote Code Execution (Authenticated) (4) – Multiple webapps Exploit

CMDBuild 3.3.2 – ‘Multiple’ Cross Site Scripting (XSS) – Multiple webapps Exploit

BeyondTrust Remote Support 6.0 – Reflected Cross-Site Scripting (XSS) (Unauthenticated) – Multiple webapps Exploit

EZDatabaseRemote 2.0 – PHP Script Code Execution – PHP webapps Exploit

Blitar Tourism 1.0 – Authentication Bypass SQLi – Multiple webapps Exploit

Chevereto 3.17.1 – Cross Site Scripting (Stored) – Multiple webapps Exploit

RESEARCH

Published research from across the cyber security and privacy industry.

Research – z4ck-book_final.pdf

Research – ZCsocksChainWin.txt

Research – Zero Day Zen Garden: Windows Exploits Development – Part 5

Research – zk-blind.txt

Research – YAML Deserialization Attack In Python

Research – ZoneAlarm Denial Of Service

Research – YSTS 11th Edition Call For Papers

Research – YSTS 2019 Call For Papers

Research – YSTS 3.0 Call For Papers

ADVISORIES

Notices from vendors letting customers know they have identified a security vulnerability in their product.

Red Hat Security Advisory 2022-0181-05

SAP Enterprise Portal XSLT Injection

Gentoo Linux Security Advisory 202201-01

Red Hat Security Advisory 2022-0288-02

Red Hat Security Advisory 2022-0303-02

SAP Enterprise Portal Open Redirect

Red Hat Security Advisory 2022-0306-02

Red Hat Security Advisory 2022-0294-04

SAP Enterprise Portal RunContentCreation Cross Site Scripting

COMMUNITIES

Articles from our Community of Caribbean people.

Meet Renee Osbourne

Congratulations to Racquel Bailey from Jamaica on passing CompTIA Security+

Congratulations to Renee Osbourne on passing CompTIA Security+

Meet Glen Henry from Jamaica

Meet Siobhan Wilson from Jamaica

Meet Kwailan Bridgewater from Trinidad and Tobago

Week 36 – What’s happening in InfoSec – by Rishauna Gunning

Week 35 – What’s happening in InfoSec – by Tavian Hall

Dwayne K. Smith’s Security+ exam pass and review

DATA PRIVACY

Data privacy activities happening around the world.

• Data Privacy

What to Know About The Jamaica Data Protection Act

• Data Privacy
• Other

St Vincent and the Grenadines embracing CariSECURE

• Data Privacy

Jamaica’s Gov’t Looking to Finalize Data Protection Act Regulations

• Data Privacy

Data privacy is important

• Data Privacy

Jamaica’s gov’t looking to finalise Data Protection law

Popular

RANDOM

G5 Cyber Security

August 1, 2022

• Cyber Security

Tech companies are raising their game (and pants) post-Snowden

G5 Cyber Security

March 4, 2022

• CVEs

CVE-2017-10337 – Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospit

G5 Cyber Security

March 13, 2022

• Exploits

Microsoft Windows 95/98/NT 4.0 – ‘autorun.inf’ Code Execution – Windows local Exploit

G5 Cyber Security

March 9, 2022

• Advisories

Secunia Security Advisory 24083

G5 Cyber Security

August 1, 2022

• Cyber Security

AT&T Wiretapping Case Headed for Hearing