๐Ÿ›ก Cybersecurity & Privacy ๐Ÿ›ก - News
25.8K subscribers
89.2K links
๐Ÿ—ž The finest daily news on cybersecurity and privacy.

๐Ÿ”” Daily releases.

๐Ÿ’ป Is your online life secure?

๐Ÿ“ฉ lalilolalo.dev@gmail.com
Download Telegram
ATENTIONโ€ผ New - CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.

๐Ÿ“– Read

via "National Vulnerability Database".
ATENTIONโ€ผ New - CVE-2012-6277

Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for Domino before 8.1.1, Symantec Messaging Gateway before 10.0.1, Symantec Data Loss Prevention (DLP) before 11.6.1, IBM Notes 8.5.x, IBM Lotus Domino 8.5.x before 8.5.3 FP4, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, related to "a number of underlying issues" in which "some of these cases demonstrated memory corruption with attacker-controlled input and could be exploited to run arbitrary code."

๐Ÿ“– Read

via "National Vulnerability Database".
ATENTIONโ€ผ New - CVE-2012-0844

Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.

๐Ÿ“– Read

via "National Vulnerability Database".
ATENTIONโ€ผ New - CVE-2012-0828

Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BMP).

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ” MGM Hotel breach highlights need for sophisticated cloud security ๐Ÿ”

Cybercriminals posted the information of more than 10 million customers on a hacker forum a year after the initial attack on a cloud server.

๐Ÿ“– Read

via "Security on TechRepublic".
โŒ Active Attacks Target Popular Duplicator WordPress Plugin โŒ

When patched last week, the bug affected at least 1 million websites. Zero-day exploits were going on then.

๐Ÿ“– Read

via "Threatpost".
๐Ÿ” 5 best practices for IIoT project success ๐Ÿ”

Based on years of pilot projects and proofs-of-concept, the Industrial Internet Consortium has detailed the best-practices organizations can use to ensure successful deployments.

๐Ÿ“– Read

via "Security on TechRepublic".
โŒ Lawsuit Claims Google Collects Minorsโ€™ Locations, Browsing History โŒ

A new lawsuit alleges that Googleโ€™s G Suite for Education program covertly collects data from students, violating both COPPA and other data privacy regulations.

๐Ÿ“– Read

via "Threatpost".
ATENTIONโ€ผ New - CVE-2012-1093

The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package installation.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ•ด Emotet Malware Rears Its Ugly Head Again ๐Ÿ•ด

A resurgence in Emotet malware may make it one of the most pervasive security threats of 2020.

๐Ÿ“– Read

via "Dark Reading: ".
๐Ÿ•ด All About SASE: What It Is, Why It's Here, How to Use It ๐Ÿ•ด

Secure Access Service Edge is a new name for a known and growing architecture designed to strengthen security in cloud environments.

๐Ÿ“– Read

via "Dark Reading: ".
๐Ÿ›  Wapiti Web Application Vulnerability Scanner 3.0.3 ๐Ÿ› 

Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities.

๐Ÿ“– Go!

via "Security Tool Files โ‰ˆ Packet Storm".
โš  Monday review โ€“ the hot 25 stories of the week โš 

From malware attacks to malicious browser extensions - and everything in between. It's your weekly security roundup.

๐Ÿ“– Read

via "Naked Security".
โš  Apple chops Safariโ€™s TLS certificate validity down to one year โš 

From 1 September 2020, Safari will no longer trust SSL/TLS certificates with more than a year on the clock.

๐Ÿ“– Read

via "Naked Security".
๐Ÿ•ด 7 Tips to Improve Your Employees' Mobile Security ๐Ÿ•ด

Security experts discuss the threats putting mobile devices at risk and how businesses can better defend against them.

๐Ÿ“– Read

via "Dark Reading: ".
โš  Google purges 600 Android apps for โ€œdisruptiveโ€ pop-up ads โš 

These apps plunk ads in front of us when we're trying to do something else, often leading to inadvertent ad clicks and much cursing.

๐Ÿ“– Read

via "Naked Security".
๐Ÿ” 16 best practices for improving cybersecurity ๐Ÿ”

Cisco's 2020 CISO Benchmark Study links a robust patch policy and collaboration to smaller data breaches.

๐Ÿ“– Read

via "Security on TechRepublic".
๐Ÿ” The good, the bad, and the scary from Experian's data breach report ๐Ÿ”

Many security teams don't update response plans on a regular basis but complying with GDPR is getting easier.

๐Ÿ“– Read

via "Security on TechRepublic".
๐Ÿ” Three things CISOs need to do differently in 2020 ๐Ÿ”

Security leaders need to connect their work to broader business goals and create a culture of learning to attract talent.

๐Ÿ“– Read

via "Security on TechRepublic".