🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
ATENTION New - CVE-2019-15974

A vulnerability in the web interface of Cisco Managed Services Accelerator (MSX) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious web page. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15969

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script or HTML code in the context of the interface, which could allow the attacker to gain access to sensitive, browser-based information.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15963

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the web-based management interface of the affected software. The vulnerability is due to insufficient protection of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by accessing the interface and viewing restricted portions of the software configuration. A successful exploit could allow the attacker to gain access to sensitive information or conduct further attacks.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15959

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15957

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system. When processed, the commands will be executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by providing malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as the root user.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15289

Multiple vulnerabilities in the video service of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted traffic to the video service of an affected endpoint. A successful exploit could allow the attacker to cause the video service to crash, resulting in a DoS condition on an affected device.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15287

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15285

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-15283

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

📖 Read

via "National Vulnerability Database".
🕴 12 Bare-Minimum Benchmarks for AppSec Initiatives 🕴

The newly published Building Security in Maturity Model provides the software security basics organizations should cover to keep up with their peers.

📖 Read

via "Dark Reading: ".
🕴 7 Non-Technical Skills Threat Analysts Should Master to Keep Their Jobs 🕴

It's not just technical expertise and certifications that enable analysts to build long-term careers in cybersecurity.

📖 Read

via "Dark Reading: ".
🔐 Experts discuss ways IT can maximize budget amid COVID-19 shrinkage 🔐

With revenue down, CIOs are rearranging their technology spending to prioritize return to office needs and security, executives say.

📖 Read

via "Security on TechRepublic".
🔐 FBI warns of cybercriminals spreading false info about 2020 election results 🔐

Bad actors could create or change websites and social media content to discredit this year's electoral process, cautions the FBI and CISA.

📖 Read

via "Security on TechRepublic".
🔐 How rogue TikTok accounts are promoting malicious mobile apps 🔐

The accounts are pushing games, wallpaper, and other apps designed to deploy adware scams toward iOS and Android users, says Avast.

📖 Read

via "Security on TechRepublic".
OldGremlin Ransomware Group Bedevils Russian Orgs

The cybercriminal group has plagued firms with ransomware, sent via spear phishing emails with COVID-19 lures, since March.

📖 Read

via "Threatpost".
🕴 FBI, DHS Warn of 'Likely' Disinformation Campaigns About Election Results 🕴

Nation-state actors and cybercriminals could wage cyberattacks and spread false information about the integrity of the election results while officials certify the final vote counts.

📖 Read

via "Dark Reading: ".
CISA: LokiBot Stealer Storms Into a Resurgence

The trojan has seen a big spike in activity since August, the Feds are warning.

📖 Read

via "Threatpost".
Critical Industrial Flaws Pose Patching Headache For Manufacturers

When it comes to patching critical flaws, industrial firms face various challenges - with some needing to shut down entire factories in order to apply updates.

📖 Read

via "Threatpost".
🔐 How to combat cyber threats amid the shift to remote working 🔐

Some 85% of CISOs surveyed by Netwrix revealed that they sacrificed cybersecurity to quickly set up employees to work remotely.

📖 Read

via "Security on TechRepublic".
🕴 Making the Case for Medical Device Cybersecurity 🕴

With an increasing number of Internet-connected medical devices in use to manage diabetes, protection against a variety of wireless network attacks could very well be a matter of life and death for patients.

📖 Read

via "Dark Reading: ".
🕴 My Journey Toward SAP Security 🕴

When applications are critical to the business's core functions, the CISO and their staff better get the security right.

📖 Read

via "Dark Reading: ".