πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ” How to limit file upload size on NGINX to mitigate DoS attack πŸ”

If you have an NGINX site that must allow users to upload files, try this configuration to help prevent possible Denial-of-Service attacks.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Friday Five: 8/7 Edition πŸ”

Telstra suffers a DoS attack, the hackers behind last month's Twitter breach are arrested, and an NSA advisory warns mobile users about the dangers of location data - catch up on the week's news with the Friday Five.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
ATENTIONβ€Ό New - CVE-2020-11993

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-11985

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-11984

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-11852

DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command.

πŸ“– Read

via "National Vulnerability Database".
❌ Have I Been Pwned Set to Go Open-Source ❌

Fully opening the door to allow people to contribute to – and notably, tinker with – the code for the data-breach information service will be an entirely next-level effort, according to founder Troy Hunt.

πŸ“– Read

via "Threatpost".
πŸ•΄ 400+ Qualcomm Chip Vulnerabilities Threaten Millions of Android Phones πŸ•΄

Security researchers found hundreds of pieces of vulnerable code in the Qualcomm Snapdragon chips powering Android phones.

πŸ“– Read

via "Dark Reading: ".
❌ Attackers Horn in on MFA Bypass Options for Account Takeovers ❌

Legacy applications don't support modern authentication -- and cybercriminals know this.

πŸ“– Read

via "Threatpost".
πŸ•΄ Hacking the PLC via Its Engineering Software πŸ•΄

Researcher will demonstrate at DEF CON an emerging threat to industrial control networks.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Reddit Attack Defaces Dozens of Channels πŸ•΄

The attack has defaced the channels with images and content supporting Donald Trump.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2020-13376

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie.

πŸ“– Read

via "National Vulnerability Database".
❌ Qualcomm Bugs Open 40 Percent of Android Handsets to Attack ❌

Researchers identified serious flaws in Qualcomm’s Snapdragon SoC and the Hexagon architecture that impacts nearly half of Android handsets.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2019-7005

A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gain sensitive information. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 through 11.0.4.2.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Digital Clones Could Cause Problems for Identity Systems πŸ•΄

Three fundamental technologies -- chatbots, audio fakes, and deepfake videos -- have improved to the point that creating digital, real-time clones of people is merely a matter of integrating the systems.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2019-19704

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12781

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12780

A security misconfiguration exists in Combodo iTop, which can expose sensitive information.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12779

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12778

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12777

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.

πŸ“– Read

via "National Vulnerability Database".