Researchers Detail 8 Vulnerabilities in Azure HDInsight Analytics Service

More details have emerged about a set of now-patched cross-site scripting (XSS) flaws in the Microsoft Azure HDInsight open-source analytics service that could be weaponized by a threat actor to carry out malicious activities.
"The identified vulnerabilities consisted of six stored XSS and two reflected XSS vulnerabilities, each of which could be exploited to perform unauthorized actions,

https://thehackernews.com/2023/09/resear...es-in.html

Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints

Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster.
The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact all Kubernetes environments with Windows nodes. Fixes for the vulnerabilities were released on August

https://thehackernews.com/2023/09/alert-...ities.html

Ford Motor Company Fund Invests $2.3M to Address Hunger in Detroit, Louisville and O

Ford Motor Company Fund, the philanthropic arm of Ford Motor Company, announced today a $2.3 million investment in mobility solutions focused on expanding access to fresh food in cities where Ford has manufacturing plants.


https://media.ford.com/content/fordmedia...detro.html

Overcoming the Rising Threat of Session Hijacking

Passkeys and multifactor authentication aren't enough for combating infostealer malware, which can exfiltrate corporate data before anyone knows an attack happened.

https://www.darkreading.com/vulnerabilit...-hijacking

Attackers Abuse Google Looker Studio to Evade DMARC, Email Security

Cyberattackers are tapping the legitimacy of the Web-based data-visualization tool in a campaign aimed at stealing credentials and defrauding hundreds of business users.

https://www.darkreading.com/endpoint/phi...l-security

Navigating Rwanda's New Data Protection Law

As the law's October 2023 transition deadline approaches, it's critical for organizations doing business in Rwanda to understand its requirements and implications.

https://www.darkreading.com/dr-global/na...ection-law

Iranian APT Hits US Aviation Org via ManageEngine, Fortinet Bugs

Known security vulnerabilities in the enterprise products allowed unauthorized access through a public-facing application, US Cyber Command said.

https://www.darkreading.com/dr-global/ir...tinet-bugs

'Steal-It' Campaign Uses OnlyFans Models as Lures

Custom PowerShell scripts are being deployed against geofenced targets in Australia, Belgium, and Poland to exfiltrate data.

https://www.darkreading.com/application-...dels-lures

Being Flexible Can Improve Your Security Posture

Changing your approach when you realize you could be more efficient pays dividends, especially in six areas of your cybersecurity program.

https://www.darkreading.com/edge-article...ty-posture

Iran's Charming Kitten Pounces on Israeli Exchange Servers

Archrivals face off in the cyber plane, as opportunistic hackers prey on the unpatched and generally negligent.

https://www.darkreading.com/dr-global/ir...ge-servers