πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ” 5G and IoT security: Why cybersecurity experts are sounding an alarm πŸ”

Without regulation and strong proactive measures, 5G networks remain vulnerable to cyberattacks, and the responsibility falls on businesses and governments.

πŸ“– Read

via "Security on TechRepublic".
⚠ Facebook sues data analytics firm OneAudience over malicious SDK ⚠

Facebook says OneAudience paid developers to install its social-media-profile-looting SDK into their apps to get marketing data for clients.

πŸ“– Read

via "Naked Security".
⚠ Fresh phish! Stripe scam baked and delivered in under an hour ⚠

Less than an hour after the crooks registered their scamming domain, the phishing attack was under way.

πŸ“– Read

via "Naked Security".
⚠ Ironpie robot vacuum can suck up your privacy ⚠

You might want to unplug this not-so-smart robot: researchers found they can watch video streams piped out from its security camera.

πŸ“– Read

via "Naked Security".
⚠ Let’s Encrypt issues one billionth free certificate ⚠

Thanks to this flood of free certificates, the web is a lot more encrypted than it was a few years ago.

πŸ“– Read

via "Naked Security".
πŸ•΄ What Disney+ Can Teach Businesses About Customer Security πŸ•΄

Businesses must prioritize customer protection by taking on some of the responsibility to prevent credential stuffing attacks through multipronged authentication and identity management.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2018-17058

An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of ProductEdit.aspx. An authenticated attacker may bypass the frontend filename validation and upload an arbitrary file via FileUploader.aspx.cs in FileUploader.aspx by using empty w and h parameters. This file may contain arbitrary aspx code that may be executed by accessing /Jec/ProductImages/<number>/<filename>. Accessing the file once uploaded does not require authentication.

πŸ“– Read

via "National Vulnerability Database".
❌ Walgreens Mobile App Leaks Prescription Data ❌

A security error in the Walgreens mobile app may have leaked customers' full names, prescriptions and shipping addresses.

πŸ“– Read

via "Threatpost".
πŸ•΄ Name That Toon: Holy Cow! πŸ•΄

Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.

πŸ“– Read

via "Dark Reading: ".
πŸ” Morphisec is using the Windows 10 transition to help companies boost security πŸ”

Morphisec combines the anti-virus protection in the new Microsoft OS with its own defenses against malware.

πŸ“– Read

via "Security on TechRepublic".
❌ TrickBot Adds ActiveX Control, Hides Dropper in Images ❌

The tricky trojan has evolved again, to stay a step ahead of defenders.

πŸ“– Read

via "Threatpost".
πŸ•΄ Tesla, SpaceX Parts Manufacturer Suffers Data Breach πŸ•΄

Visser Precision has confirmed a security incident likely caused by the data-stealing DoppelPaymer ransomware.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2019-12183

Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-12580

An issue was discovered in IDM UltraEdit through 24.10.0.32. To exploit the vulnerability, on unpatched Windows systems, an attacker could include in the same directory as the affected executable a DLL using the name of a Windows DLL. This DLL must be preloaded by the executable (for example, "ntmarta.dll"). When the installer EXE is executed by the user, the DLL located in the EXE's current directory will be loaded instead of the Windows DLL, allowing the attacker to run arbitrary code on the affected system.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-1583

Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.

πŸ“– Read

via "National Vulnerability Database".
❌ RSAC: Keeping Smart Cities Safe From Hacks ❌

As cities grow more connected, municipal operators must deal with new risks like ransomware, IoT hacks and more.

πŸ“– Read

via "Threatpost".
πŸ” Companies Increasingly Complacent Around Data Breach Preparedness πŸ”

Ponemon Institute's annual data breach readiness survey suggests the increased adoption of security technologies but the continuation of problems, like spear phishing attacks.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
ATENTIONβ€Ό New - CVE-2019-14892

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-14384

The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-11675

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".