Attribution and the nation-state malware market
One of the more interesting sessions at the recent Black Hat conference in Las Vegas centred on the issue of trying to verify attribution, when criminals and nation-states alike can buy certifications that seemingly point to their activity originating in another geography.  What tools are there for pin-pointing the true origin of an attack?

Enterprise Vulnerabilities

From DHS/US-CERT's National Vulnerability Database

PUBLISHED:

2023-05-26

Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.



PUBLISHED:

2023-05-26

Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...



PUBLISHED:

2023-05-26

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...



PUBLISHED:

2023-05-26

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didnâ€™t fix it when clicking save. This issue was...



PUBLISHED:

2023-05-26