πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2020-0116

In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-151330809

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-0115

In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-8.0Android ID: A-150038428

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-0114

In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147606347

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-0113

In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9Android ID: A-150944913

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-5735

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-5732

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2019-5731

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Employees Stream Entertainment on Enterprise Systems During Pandemic πŸ•΄

Employees aren't limiting use of their work computers to business purposes while working from home.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Rate of Ransomware Attacks in Healthcare Slows in H1 2020 πŸ•΄

But lull is unlikely to continue for long, some security experts say.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Misconfigured Databases Targeted Hours After Deployment πŸ•΄

Researchers left a poorly configured database open on the Internet to learn who would connect to it and what they would steal.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ When Your Biggest Security and Privacy Threats Come From the Ones You Love πŸ•΄

Research examines the risks and design challenges of accounting for privacy threats in intimate relationships.

πŸ“– Read

via "Dark Reading: ".
⚠ Microsoft squishes 129 bugs with Patch Tuesday updates ⚠

Patch Tuesday was this week and software giant Microsoft released patches to fix 129 CVEs, 11 of which are rated critical.

πŸ“– Read

via "Naked Security".
⚠ Bitcoin scammers take YouTube channels for a SpaceX ride ⚠

Multiple hijacked YouTube accounts impersonated Elon Musk's Space X channel in a Bitcoin scheme that ripped off a total of more than $163,000.

πŸ“– Read

via "Naked Security".
πŸ” Report: Working from home is the new normal, but cybersecurity isn't keeping up πŸ”

COVID-19 has completely changed the work world, but many organizations have seemingly failed to realize that security risks are changing as well, a new report finds.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How Google is combatting coronavirus-related cyberthreats πŸ”

The search giant is relying on artificial intelligence as threats that exploit COVID-19 increase in the UK, India, and Brazil.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ What COVID-19 Teaches Us About Social Engineering πŸ•΄

Unless we do something proactively, social engineering's impact is expected to keep getting worse as people's reliance on technology increases and as more of us are forced to work from home.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Attack Surface Area Larger Than Most Businesses Believe πŸ•΄

Workers are not the only outside-the-perimeter security risk. Companies have a variety of vulnerable Internet-facing resources exposing their business to risk, study finds.

πŸ“– Read

via "Dark Reading: ".
πŸ” Apple's Face ID: Cheat sheet πŸ”

If you're using an Apple mobile device manufactured since 2017, it has likely ditched Touch ID in favor of Face ID. Here's what you need to know about the latest Apple biometric security product.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ 'Highly Active' APT Group Targeting Microsoft Office, Outlook πŸ•΄

The Gamaredon group has ramped up activity in recent months and makes no effort to stay under the radar, researchers report.

πŸ“– Read

via "Dark Reading: ".
πŸ” Why coronavirus contact tracing apps face privacy and security challenges πŸ”

The apps have to balance the goal of greater accuracy vs. respecting the privacy of their users, according to Check Point Research.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2020-0136

In multiple locations of Parcel.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-120078455

πŸ“– Read

via "National Vulnerability Database".