πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ How Ransomware Threats Are Evolving & How to Spot Them πŸ•΄

A series of new reports explains how ransomware attackers are changing techniques and how organizations can spot stealthy criminals.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2020-13522

An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18112

Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Pen Testers Who Got Arrested Doing Their Jobs Tell All πŸ•΄

Coalfire's Gary De Mercurio and Justin Wynn share the details of their physical penetration-testing engagement gone wrong, as well as recommendations for protecting all red teamers.

πŸ“– Read

via "Dark Reading: ".
❌ A Cyber β€˜Vigilante’ is Sabotaging Emotet’s Return ❌

During Black Hat USA 2020, Threatpost talks to Sherrod DeGrippo, with Proofpoint, about Emotet's recent return -and how a cyber vigilante is attempting to thwart the malware's comeback.

πŸ“– Read

via "Threatpost".
πŸ•΄ DDoS Attacks Doubled in Q2 Compared with Prior Quarter πŸ•΄

Most attacks were small, but the big ones got bigger than ever, Cloudflare says.

πŸ“– Read

via "Dark Reading: ".
πŸ” COVID-19 highlights need for business and security leaders to work together to prevent cyberattacks πŸ”

New Tenable study says 94% of organizations experienced a business-impacting cyberattack or compromise within the past 12 months; 46% weathered five or more attacks.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Why Confidential Computing Is a Game Changer πŸ•΄

Confidential Computing is a transformational technology that should be part of every enterprise cloud deployment. It's time to start unlocking the possibilities together.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Microsoft Paid $13.7M in Bug Bounty Rewards in 2019-2020 πŸ•΄

The 2019-2020 program year awarded 327 security researchers through 15 bounty programs, with a largest reward of $200,000.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Cybersecurity Budget Rose in 2019, Uncertainty Prevails in 2020 πŸ•΄

Budgets rise as IT complexity continued to challenge companies, with identity and access management technology an increasingly common focus.

πŸ“– Read

via "Dark Reading: ".
❌ NSA Warns Smartphones Leak Location Data ❌

The agency known for its own questionable surveillance activity advised how mobile users can limit others’ ability to track where they are.

πŸ“– Read

via "Threatpost".
❌ Microsoft Teams Patch Bypass Allows RCE ❌

An attacker can hide amidst legitimate traffic in the application's update function.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2020-14347

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-14344

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-13921

**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-13819

Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.

πŸ“– Read

via "National Vulnerability Database".
❌ High-Severity Android RCE Flaw Fixed in August Security Update ❌

Google addressed high-severity and critical flaws tied to 54 CVEs in this month's Android security bulletin.

πŸ“– Read

via "Threatpost".
πŸ•΄ Microsoft Teams Vulnerable to Patch Workaround, Researchers Report πŸ•΄

Attackers could work around an earlier patch and use Microsoft Teams Updater to download binaries and payloads.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ CISA Offers Tool for Career Navigation πŸ•΄

The new Cyber Career Pathways Tool helps individuals understand the roles in cybersecurity and how to prepare for them.

πŸ“– Read

via "Dark Reading: ".