πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2019-18871

A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-18870

A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-18869

Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-18866

Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Zoom Acquires Keybase, Plans for End-to-End Encrypted Chats πŸ•΄

The company's first acquisition to date is part of a 90-day plan to improve security in its video communications platform.

πŸ“– Read

via "Dark Reading: ".
❌ Zoom Beefs Up End-to-End Encryption to Thwart β€˜Zoombombers’ ❌

As the company continues to battle security woes, it has acquired Keybase to boost security and privacy. A full cryptographic draft architecture will be available on May 22.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2019-18864

/server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Web and network perimeter vulnerabilities slightly lower than 2019 πŸ”

Yet, even with a 30% decline, web applications are still at risk and new scan targets have more vulnerabilities than others, according to a new Acunetix report.

πŸ“– Read

via "Security on TechRepublic".
πŸ” U.S., UK Govt: APT Groups Targeting Healthcare Orgs πŸ”

It seems as if there are alerts almost daily now around how bad actors are leveraging the ongoing coronavirus (COVID-19) pandemic to target end users.The latest came this week after agencies from two countries, the U.S. and the U.K. warned about how advanced persistent threat (APT) groups are using the pandemic to their advantage. 

πŸ“– Read

via "Subscriber Blog RSS Feed ".
πŸ•΄ Now More Than Ever? Securing the Software Life Cycle πŸ•΄

The more things change, the more they stay the same. That's true for software security, even in these turbulent times.

πŸ“– Read

via "Dark Reading: ".
❌ Cisco Fixes High-Severity Flaws In Firepower Security Software, ASA ❌

Cisco has fixed 12 high-severity flaws in its Adaptive Security Appliance software and Firepower Threat Defense software.

πŸ“– Read

via "Threatpost".
πŸ•΄ Mac RAT Rides 2FA App Onto Systems πŸ•΄

The new macOS remote access Trojan from the Lazarus Group uses a two-factor authentication app as its delivery mechanism.

πŸ“– Read

via "Dark Reading: ".
πŸ” How to properly secure sysctl on Linux πŸ”

Protecting your Linux servers against SYN attacks and IP spoofing isn't nearly as hard you think. Jack Wallen shows you how.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2019-19164

dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.

πŸ“– Read

via "National Vulnerability Database".
❌ Blue Mockingbird Monero-Mining Campaign Exploits Web Apps ❌

The cybercriminals are using a deserialization vulnerability, CVE-2019-18935, to achieve remote code execution before moving laterally through the enterprise.

πŸ“– Read

via "Threatpost".
πŸ•΄ Microsoft Identity VP Shares How and Why to Ditch Passwords πŸ•΄

Passwords are on their way out, says Joy Chik, who offers guidance for businesses hoping to shift away from them.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Malicious Bots Infiltrate Online Food Delivery πŸ•΄

With grocery delivery in higher demand than ever, new add-ons have emerged to secure slots for consumers, presenting a new pathway for bad bots to wreak havoc.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Cyber Subterfuge and Curious Sharks Threaten the World's Subsea Fiber-Optics Cables πŸ•΄

Malware, spies and hackers, plus erosion and sharks, threaten fiber-optics that transmit almost all the world's data

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2015-7946

Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2014-1423

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2012-0953

A race condition was discovered in the Linux drivers for Nvidia graphics which allowed an attacker to exfiltrate kernel memory to userspace. This issue was fixed in version 295.53.

πŸ“– Read

via "National Vulnerability Database".