πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Active Directory Attacks Hit the Mainstream πŸ•΄

Understanding the limitations of authentication protocols, especially as enterprises link authentication to cloud services to Active Directory, is essential for security teams in the modern federated enterprise.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2019-3945

Web server running on Parrot ANAFI can be crashed due to the SDK command "Common_CurrentDateTime" being sent to control service with larger than expected date length.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-3944

Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-3942

Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-11106

NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Zoom’s Privacy Problems Snowball as Two Zero Days Uncovered πŸ”

Amid increased scrutiny from researchers and privacy activists, two new zero days in the teleconferencing app surfaced on Wednesday.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
❌ Coronavirus β€˜Financial Relief’ Phishing Attacks Spike ❌

A spate of phishing attacks have promised financial relief due to the coronavirus pandemic - but in reality swiped victims' credentials, payment card data and more.

πŸ“– Read

via "Threatpost".
πŸ•΄ Why All Employees Are Responsible for Company Cybersecurity πŸ•΄

It's not just the IT and security team's responsibility to keep data safe -- every member of the team needs to be involved.

πŸ“– Read

via "Dark Reading: ".
πŸ” COVID-19 pandemic impact pushing smart home voice control devices to predicted 30% growth πŸ”

Global shipments of smart home speakers will increase this year due to fear of coronavirus germs, according to ABI Research.

πŸ“– Read

via "Security on TechRepublic".
❌ Wiper Malware Called β€œCoronavirus” Spreads Among Windows Victims ❌

Like NotPetya, it overwrites the master boot record to render computers "trashed."

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2019-9163

The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-11254

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Attackers Leverage Excel File Encryption to Deliver Malware πŸ•΄

Technique involves saving malicious Excel file as "read-only" and tricking users into opening it, Mimecast says.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-11802

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).

πŸ“– Read

via "National Vulnerability Database".
⚠ COVID-19 forces browser makers to continue supporting TLS 1.0 ⚠

In one of the strangest stories of the year, the COVID-19 virus has halted plans by major browsers to drop support for the aging and insecure Transport Layer Security (TLS) 1.0 and 1.1 protocols.

πŸ“– Read

via "Naked Security".
⚠ Phone carriers must authenticate calls to fight robocalls, says FCC ⚠

The FCC has given voice carriers until June 2021 to implement technology it says will stop the robocall plague that's driving us all insane.

πŸ“– Read

via "Naked Security".
πŸ•΄ Vulnerability Researchers Focus on Zoom App's Security πŸ•΄

With videoconferencing's rise as an essential tool for remote work comes a downside: more security scrutiny, which has turned up a number of security weaknesses.

πŸ“– Read

via "Dark Reading: ".
❌ Emerging MakeFrame Skimmer from Magecart Sets Sights on SMBs ❌

Attacks using a brand-new card-harvesting code is targeting small- to medium-sized businesses, claiming 19 sites so far.

πŸ“– Read

via "Threatpost".
❌ 44M Digital Wallet Items Exposed in Key Ring Cloud Misconfig ❌

Millions of IDs, charge cards, loyalty cards, gift cards, medical marijuana ID cards and personal information was left exposed to the open internet.

πŸ“– Read

via "Threatpost".
πŸ•΄ Best Practices to Manage Third-Party Cyber-Risk Today πŸ•΄

Bold new thinking is needed to solve the rapidly evolving challenge of third-party risk management.

πŸ“– Read

via "Dark Reading: ".