🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
Variant of Paradise Ransomware Targets Office IQY Files

Threat actors can easily infiltrate networks because attacks evade detection by typical security protections.

📖 Read

via "Threatpost".
Watch out for Office 365 and G Suite scams, FBI warns businesses

The FBI has warned users of Microsoft Office 365 and Google G Suite hosted email about Business Email Compromise (BEC) scams.

📖 Read

via "Naked Security".
🕴 Over 80% of Medical Imaging Devices Run on Outdated Operating Systems 🕴

New data on live Internet of Things devices in healthcare and other organizations shines a light on security risks.

📖 Read

via "Dark Reading: ".
🕴 How Network Metadata Can Transform Compromise Assessment 🕴

Listen more closely and your network's metadata will surrender insights the bad guys counted on keeping secret

📖 Read

via "Dark Reading: ".
ATENTION New - CVE-2019-10065

An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search result screens to disclose information from internal FAQ articles, a different vulnerability than CVE-2019-9753.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2018-18894

Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2018-14502

controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.

📖 Read

via "National Vulnerability Database".
🔐 Intel's data center CPUs vulnerability could lead to "devastating" attacks 🔐

Security researchers found vulnerabilities that can affect multi-tenant environments such as public clouds or shared enterprise workloads.

📖 Read

via "Security on TechRepublic".
🕴 What Should I Do About Vulnerabilities Without Fixes? 🕴

With better tools that identify potential threats even before developers address them, a new problem has arisen.

📖 Read

via "Dark Reading: ".
ATENTION New - CVE-2017-10992

In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvokerServlet, aka PSRT110461.

📖 Read

via "National Vulnerability Database".
🔏 HHS Finalizes New Health Data Rules To Improve Data Governance 🔏

The U.S. Department of Health and Human Services finalized two new rules designed to give patients better control over their data.

📖 Read

via "Subscriber Blog RSS Feed ".
🕴 Paradise Ransomware Variant Hides in Office IQY Files 🕴

The uncommon Internet Query file format lets attacks slip past defenses to effectively break into target networks.

📖 Read

via "Dark Reading: ".
🕴 3 Tips to Stay Secure When You Lose an Employee 🕴

Whether they leave for a better job or get fired, and whether they mean to cause problems or do so out of ignorance, ex-workers can pose a threat to your company.

📖 Read

via "Dark Reading: ".
High-Severity Flaws Plague Intel Graphics Drivers

Intel patched six high-severity flaws in its graphics drivers, as well as other vulnerabilities in its NUC firmware, and a load value injection vulnerability that could allow attackers to steal sensitive data.

📖 Read

via "Threatpost".
Firefox Bug Opens iPhone AirPods to Third-Party Snooping

Mozilla Foundation snuffs out bugs with the introduction of Firefox 74 and ESR 68.6.

📖 Read

via "Threatpost".
ATENTION New - CVE-2012-1096

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2012-1094

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.

📖 Read

via "National Vulnerability Database".
🕴 Bitsight and Microsoft Disrupt Necurs Botnet 🕴

But roughly 2 million infected systems remain in the wild, and infected systems could be reactivated at any time.

📖 Read

via "Dark Reading: ".
🕴 Microsoft Patches Over 100 Vulnerabilities 🕴

Patch Tuesday features several remote code execution flaws in Microsoft Word.

📖 Read

via "Dark Reading: ".
Popular ThemeREX WordPress Plugin Opens Websites to RCE

The bug has been under active attack as a zero-day.

📖 Read

via "Threatpost".
🕴 Researchers Develop New Side-Channel Attacks on Intel CPUs 🕴

Load Value Injection (LVI) takes advantage of speculative execution processes just like Meltdown and Spectre, say security researchers from Bitdefender and several universities.

📖 Read

via "Dark Reading: ".