πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2019-9163

The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-11254

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Attackers Leverage Excel File Encryption to Deliver Malware πŸ•΄

Technique involves saving malicious Excel file as "read-only" and tricking users into opening it, Mimecast says.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2019-17564

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-11802

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).

πŸ“– Read

via "National Vulnerability Database".
⚠ COVID-19 forces browser makers to continue supporting TLS 1.0 ⚠

In one of the strangest stories of the year, the COVID-19 virus has halted plans by major browsers to drop support for the aging and insecure Transport Layer Security (TLS) 1.0 and 1.1 protocols.

πŸ“– Read

via "Naked Security".
⚠ Phone carriers must authenticate calls to fight robocalls, says FCC ⚠

The FCC has given voice carriers until June 2021 to implement technology it says will stop the robocall plague that's driving us all insane.

πŸ“– Read

via "Naked Security".
πŸ•΄ Vulnerability Researchers Focus on Zoom App's Security πŸ•΄

With videoconferencing's rise as an essential tool for remote work comes a downside: more security scrutiny, which has turned up a number of security weaknesses.

πŸ“– Read

via "Dark Reading: ".
❌ Emerging MakeFrame Skimmer from Magecart Sets Sights on SMBs ❌

Attacks using a brand-new card-harvesting code is targeting small- to medium-sized businesses, claiming 19 sites so far.

πŸ“– Read

via "Threatpost".
❌ 44M Digital Wallet Items Exposed in Key Ring Cloud Misconfig ❌

Millions of IDs, charge cards, loyalty cards, gift cards, medical marijuana ID cards and personal information was left exposed to the open internet.

πŸ“– Read

via "Threatpost".
πŸ•΄ Best Practices to Manage Third-Party Cyber-Risk Today πŸ•΄

Bold new thinking is needed to solve the rapidly evolving challenge of third-party risk management.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ New Magecart Skimmer Infects 19 Victim Websites πŸ•΄

MakeFrame, named for its ability to make iframes for skimming payment data, is attributed to Magecart Group 7.

πŸ“– Read

via "Dark Reading: ".
⚠ S2 Ep33: Ransomware on sale, dark web disaster, dead drops and pillow forts – Naked Security Podcast ⚠

Listen to the latest episode now!

πŸ“– Read

via "Naked Security".
❌ In COVID-19 Scam Scramble, Cybercrooks Recycle Phishing Kits ❌

Old phishing kits are being pressed into service to keep up with the unprecedented volume of new scams that exploit the pandemic.

πŸ“– Read

via "Threatpost".
πŸ” Most consumers worry about online privacy but many are unsure how to protect it πŸ”

People have taken actions to better protect their information but feel they need to do more, according to a survey from NortonLifeLock.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Targeted cyberattacks surpass mass attacks for 2019 πŸ”

Cybercriminals are increasingly directing targeted attacks at specific organizations or individuals, says security provider Positive Technologies.

πŸ“– Read

via "Security on TechRepublic".
⚠ Don’t get locked out of your own website – update this WordPress plugin now! ⚠

In theory, crooks could mess up your site so vistors can't see your content, then lock you out so you can't jump in and fix it.

πŸ“– Read

via "Naked Security".
ATENTIONβ€Ό New - CVE-2019-7014

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-7013

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
❌ Zoom Removes Data-Mining LinkedIn Feature ❌

The feature, criticized for "undisclosed data-mining," is only the latest privacy faux pas for Zoom this month.

πŸ“– Read

via "Threatpost".
πŸ•΄ Name That Toon: The Devil You Know? πŸ•΄

Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.

πŸ“– Read

via "Dark Reading: ".