πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2020-11579

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-10720

A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Evilnum APT Group Employs New Python RAT πŸ•΄

The PyVil remote access Trojan enables attackers to exfiltrate data, perform keylogging, take screenshots, and deploy tools for credential theft.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Facebook Announces Formal Vulnerability Disclosure Policy for Third-Party Bugs πŸ•΄

The social media giant has also launched a new website for sharing information on WhatsApp security.

πŸ“– Read

via "Dark Reading: ".
πŸ” How project managers can help companies better navigate security risks from COVID-19 πŸ”

Social distancing and remote working during COVID-19 have increased cybersecurity risks for companies worldwide, increasing the need for project managers to work on more security-related efforts.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2019-11928

An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ The Hidden Costs of Losing Security Talent πŸ•΄

One person's exit can set off a chain of costly events.

πŸ“– Read

via "Dark Reading: ".
❌ India Blocks High-Profile Chinese Apps on Political, Privacy Concerns ❌

Technology minister bans, Baidu, WeChat Work, AliPay and 115 others for capturing using data and transmitting it to servers outside of the country without authorization.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2020-12248

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12247

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-11493

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.

πŸ“– Read

via "National Vulnerability Database".
❌ WhatsApp Discloses 6 Bugs via Dedicated Security Site ❌

The company also committed to more transparency about app flaws, with an advisory page aimed at keeping the community better informed of security vulnerabilities.

πŸ“– Read

via "Threatpost".
πŸ” Friday Five 9/4 πŸ”

Owning an "OG" email account, lessons from the Garmin ransomware attack, and Emotet's new 'Red Dawn' attachment - catch up on the week’s news with the Friday Five.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
⚠ Phishing tricks – the Top Ten Treacheries of 2020 ⚠

Here's the Top Ten - or perhaps we mean The Worst Ten. How many would you fall for?

πŸ“– Read

via "Naked Security".
πŸ•΄ The Hidden Security Risks of Business Applications πŸ•΄

Today's enterprises depend on mission-critical applications to keep them productive, help better serve customers, and keep up with demand. It's important that they also know the risks.

πŸ“– Read

via "Dark Reading: ".
πŸ” Phishing attack baits victims by promising access to quarantined emails πŸ”

This campaign tries to steal account credentials by convincing users that their email service has quarantined three messages, says Cofense.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2019-3881

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

πŸ“– Read

via "National Vulnerability Database".
❌ Attackers Steal Outlook Credentials Via Overlay Screens on Legitimate Sites ❌

A phishing campaign uses overlay screens and email 'quarantine' policies to steal targets' Microsoft Outlook credentials.

πŸ“– Read

via "Threatpost".
πŸ•΄ Strategic Cyber Warfare Heats Up πŸ•΄

It's "anything goes," according to renowned hacker the Grugq, who drew a bright line between cyberwar and cyber warfare at this week's virtual Disclosure Conference.

πŸ“– Read

via "Dark Reading: ".
πŸ” New Python-based trojan targets financial tech firms to steal sensitive data πŸ”

Dubbed PyVil, the new remote access trojan goes after passwords, documents, browser cookies, and email credentials, says Cybereason.

πŸ“– Read

via "Security on TechRepublic".
❌ Facebook Debuts Third-Party Vulnerability Disclosure Policy ❌

If the social-media behemoth finds a bug in another platform's code, the project has 90 days to remediate before Facebook goes public.

πŸ“– Read

via "Threatpost".