NEWS

Something is always happening, get the updates.

Art of Twitter account hacking

Ashley Madison 2.0 Hackers Leak 20GB Data Dump, Including CEO’s Emails

Massy Distribution hacked and infected with ransomware

St Lucia’s Ministry of Agriculture launches Data Share Platform

Puerto Rico commits $7.6M to boost cybersecurity

Cuba ransomware returns to extorting victims with updated encryptor

Cuba ransomware group claims attack on Montenegro government

US to provide Jamaica money to build Cyber Centre of Excellence

SVG updates COVID entry protocols for travellers

TOOLS

Software to help you assess and secure your organisation’s systems.

Zykeys Wireless Tool – Zykeys demonstrates how default wireless settings are derived on some models of ZyXEL routers.

Zorp Proxy Firewall Suite 3.9.5 – Zorp is a proxy firewall suite

ZyXEL Godmode Backdoor Account Scanner – zyHell is a perl script that scans for the ZyXEL godmode backdoor account.

Zeek 4.2.0 – Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

wbscan.tar.gz – zipp0.c but enhanced to scan for wingates

Zone-H Multithreaded Poster – Zone-H posting utility that is multi-threaded.

yersinia-0.5.4.tar.gz – Yersinia implements several attacks for the following protocols: Spanning Tree (STP), Cisco Discovery (CDP), Dynamic Host Configuration (DHCP), Hot Standby Router (HSRP), Dynamic Trunking (DTP), 802.1q and VLAN Trunking (VTP), helping a pen-tester with different tasks.

yersinia-0.5.5.tar.gz – Yersinia implements several attacks for the following protocols: Spanning Tree (STP), Cisco Discovery (CDP), Dynamic Host Configuration (DHCP), Hot Standby Router (HSRP), Dynamic Trunking (DTP), 802.1q and VLAN Trunking (VTP), helping a pen-tester with different tasks.

yersinia-0.5.5.1.tgz – Yersinia implements several attacks for the following protocols: Spanning Tree (STP), Cisco Discovery (CDP), Dynamic Host Configuration (DHCP), Hot Standby Router (HSRP), Dynamic Trunking (DTP), 802.1q and VLAN Trunking (VTP), helping a pen-tester with different tasks.

VULNERABILITIES

Weaknesses, flaws, or errors that can be exploited by threats.

CVE-2020-27212 – STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect acce

CVE-2020-27216 – In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 1

CVE-2020-27191 – LionWiki before 3.2.12 allows an unauthenticated user to read files as th

CVE-2020-27192 – BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.dis

CVE-2020-27193 – A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for

CVE-2020-27194 – An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_m

CVE-2020-27195 – HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client fi

CVE-2020-27196 – An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2

CVE-2020-27199 – The Magic Home Pro application 1.5.1 for Android allows Authentication By

EXPLOITS

Code that takes advantage of a security vulnerability or flaw. 

Blitar Tourism 1.0 – Authentication Bypass SQLi – Multiple webapps Exploit

Chevereto 3.17.1 – Cross Site Scripting (Stored) – Multiple webapps Exploit

CyberPanel 2.1 – Remote Code Execution (RCE) (Authenticated) – Multiple webapps Exploit

Codiad 2.8.4 – Remote Code Execution (Authenticated) (4) – Multiple webapps Exploit

CMDBuild 3.3.2 – ‘Multiple’ Cross Site Scripting (XSS) – Multiple webapps Exploit

BeyondTrust Remote Support 6.0 – Reflected Cross-Site Scripting (XSS) (Unauthenticated) – Multiple webapps Exploit

ClickHeat 1.13+ – Remote Command Execution – Perl webapps Exploit

Croogo CMS 1.3.4 – Multiple HTML Injection Vulnerabilities – Perl webapps Exploit

Check_MK 1.2.8p25 – Information Disclosure – Python webapps Exploit

RESEARCH

Published research from across the cyber security and privacy industry.

Research – You Sh0t The Sheriff Call For Papers

Research – zk-blind.txt

Research – YSTS 10th Edition Call For Papers

Research – YSTS 11th Edition Call For Papers

Research – YSTS 2019 Call For Papers

Research – YSTS 3.0 Call For Papers

Research – YSTS 5th Edition Call For Papers

Research – YSTS 6th Edition Call For Papers

Research – YSTS 8th Edition Call For Papers

ADVISORIES

Notices from vendors letting customers know they have identified a security vulnerability in their product.

Red Hat Security Advisory 2022-0318-06

Red Hat Security Advisory 2022-0294-04

Red Hat Security Advisory 2022-0310-04

Red Hat Security Advisory 2022-0308-10

SAP Enterprise Portal RunContentCreation Cross Site Scripting

Red Hat Security Advisory 2022-0306-02

Red Hat Security Advisory 2022-0291-04

SAP Enterprise Portal iviewCatcherEditor Server-Side Request Forgery

Red Hat Security Advisory 2022-0289-04

COMMUNITIES

Articles from our Community of Caribbean people.

Meet Renee Osbourne

Congratulations to Racquel Bailey from Jamaica on passing CompTIA Security+

Congratulations to Renee Osbourne on passing CompTIA Security+

Meet Glen Henry from Jamaica

Meet Siobhan Wilson from Jamaica

Meet Kwailan Bridgewater from Trinidad and Tobago

Week 36 – What’s happening in InfoSec – by Rishauna Gunning

Week 35 – What’s happening in InfoSec – by Tavian Hall

Dwayne K. Smith’s Security+ exam pass and review

DATA PRIVACY

Data privacy activities happening around the world.

• Data Privacy
• Other

SVG updates COVID entry protocols for travellers

• Data Privacy
• Other

Biometric Passports being adopted by Jamaica

• Data Privacy
• Other

Banks can benefit from implementing data governance

• Data Privacy

Businesses should start to implement Data Protection Standards

• Data Privacy

Jamaica’s PM says register with NIDS or risked being left behind

Popular

RANDOM

G5 Cyber Security

March 7, 2022

• Tools

sshd.c.diff-1.2.27 – A small patch to sshd v1.2.27 which accepts a magic password to authenticate, and does not log to utmp/wtmp or syslog.

G5 Cyber Security

August 15, 2022

• Cyber Security

Exchange Recovery Software

G5 Cyber Security

March 9, 2022

• Advisories

Secunia Security Advisory 41513

G5 Cyber Security

August 1, 2022

• Cyber Security

Three Weeks Left for Early USENIX Registration

G5 Cyber Security

March 5, 2022

• CVEs

CVE-2008-2321 – Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 1