Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
5 IT Practices That Put Enterprises at Risk
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
10/10/2017 | 4:42:50 PM
Re: VERY INTEREEESTING!!!
@REISEN: It's been a while, but I seem to remember that if you del'd or deltree'd a file or directory, it was still in memory until you turned off the computer or rebooted -- and could be undeleted as such. Is my memory mistaken?

(Or perhaps that was only in a later version?)
REISEN1955
REISEN1955,
User Rank: Ninja
10/5/2017 | 10:42:41 AM
Re: VERY INTEREEESTING!!!
Server - not really on subject. Anybody who remembers NOVELL and DOS.  Avon in Suffern NY was a client of Microage of Mahwah and one day the CNE admin left his desk for coffee - terminal on, admin rights and a user wlaked by, thought he could use DELTREE to clean off some folders on his assigned F drive ... which he did, sitting at the admin console on the ROOT DRIVE OF THE NOVELL SERVER.

DELLTREE did what it was told to do and wiped the server off the face of the earth in 5 seconds.,

They were glad for backups.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
10/3/2017 | 5:36:47 PM
Re: VERY INTEREEESTING!!!
> Local Admin right should NEVER be granted

Reminds me of a colleague telling me about an organization he went into where -- because they were out of workstations -- they let the temp use the main server for his computer!

That was quickly changed once AIM and ICQ and a bunch of games were found downloaded on the server.
PVDB
PVDB,
User Rank: Apprentice
10/3/2017 | 11:59:10 AM
Chapeau bas!
Great, really great article - respect to the form and substance.

I really appreciate your effort - big thanks.

 

pb
REISEN1955
REISEN1955,
User Rank: Ninja
10/2/2017 | 10:51:37 AM
VERY INTEREEESTING!!!
To quote old Arte Joohnson on LAUGH IN.  Actually good stuff.  There was a horrendous hack open on HP Officejet printers that involved a long google search string and would display internal web page of ANY officejet printer around the world!!   IP address displayed too - open door for a hacker.  Local Admin right should NEVER be granted - closes down local app installatoin.    Updates and PATCHES are also mandatory. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-44960
PUBLISHED: 2022-12-02
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
CVE-2022-44961
PUBLISHED: 2022-12-02
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVE-2022-44962
PUBLISHED: 2022-12-02
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.
CVE-2022-44944
PUBLISHED: 2022-12-02
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t...
CVE-2022-44945
PUBLISHED: 2022-12-02
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.