πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2019-10096

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12371

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.

πŸ“– Read

via "National Vulnerability Database".
❌ Joker Android Malware Dupes Its Way Back Onto Google Play ❌

A new variant of the Joker malware has hoodwinked its way onto the Google Play marketplace yet again, in 11 Android apps that were recently removed.

πŸ“– Read

via "Threatpost".
πŸ•΄ Name That Toon: Tough Times, Tough Measures πŸ•΄

Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.

πŸ“– Read

via "Dark Reading: ".
πŸ” 2,500 of FBI's Counterintelligence Cases Linked to China πŸ”

The Federal Bureau of Investigation’s Director Christopher Wray discussed the Chinese Communist Party's vast influence on U.S. intellectual property, the financial sector, and democracy in a talk this week.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
πŸ” How to enable Canonical Livepatch from the command line πŸ”

If you have Ubuntu Servers in your data center, you should consider adding Canonical Livepatch to keep them up to date with kernel security patches.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Microsoft warns organizations of consent phishing attacks πŸ”

In this type of phishing campaign, attackers trick people into giving a malicious app consent to access sensitive data, says Microsoft.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Fight Phishing with Intention πŸ•΄

Phishing exercises have become a staple, but it helps to be as clear as possible on exactly why you're doing them.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ 56% of Large Companies Handle 1,000+ Security Alerts Each Day πŸ•΄

For 70% of IT security professionals, the volume of security alerts has doubled in the past five years, researchers report.

πŸ“– Read

via "Dark Reading: ".
πŸ” Highest-paying tech jobs: Where to find them πŸ”

Find out what tech jobs and skills are most in-demand and where the positions are located.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How to detect network abuse with Wireshark πŸ”

With a few quick clicks, you can detect network abuse with Wireshark. Jack Wallen shows you how.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How expired domain names can redirect you to malicious websites πŸ”

Pages for inactive domain names can be exploited by cybercriminals to take you to malicious sites, says Kaspersky.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2020-10756

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

πŸ“– Read

via "National Vulnerability Database".
❌ Zoom Zero-Day Allows RCE, Patch on the Way ❌

Researchers said that the issue is only exploitable on Windows 7 and earlier.

πŸ“– Read

via "Threatpost".
πŸ•΄ When WAFs Go Wrong πŸ•΄

Web application firewalls are increasingly disappointing enterprises today. Here's why.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2019-17638

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.).

πŸ“– Read

via "National Vulnerability Database".
❌ Microsoft Warns on OAuth Attacks Against Cloud App Users ❌

Application-based attacks that use the passwordless "log in with..." feature common to cloud services are on the rise.

πŸ“– Read

via "Threatpost".
πŸ•΄ 'Joker' Android Malware Pulls Another Trick to Land on Google's Play Store πŸ•΄

Authors of the malware, which signs up mobile users for premium services, are repeatedly finding ways to bypass app review checks.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Omdia Research Launches Page On Dark Reading πŸ•΄

Data and insight from a leading cybersecurity research and analysis team will broaden the information available to security professionals and technology vendors.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Up Close with Evilnum, the APT Group Behind the Malware πŸ•΄

The group behind Evilnum malware, which continues to target financial institutions, appears to be testing new techniques.

πŸ“– Read

via "Dark Reading: ".