πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Why Web Browser Padlocks Shouldn’t Be Trusted ❌

Popular β€˜safe browsing’ padlocks are now passe as a majority of bad guys also use them.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-5132 β€Ό

SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. When the users publicly display their organizationΓƒΒ’Γ’β€šΒ¬Γ’β€žΒ’s internal domain names in the SSL-VPN authentication page, an attacker with knowledge of internal domain names can potentially take advantage of this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Attacker Dwell Time: Ransomware's Most Important Metric πŸ•΄

How to bolster security defenses by zeroing in on the length of time an interloper remains undetected inside your network

πŸ“– Read

via "Dark Reading".
❌ Microsoft Exchange Servers Still Open to Actively Exploited Flaw ❌

Despite Microsoft issuing patches almost eight months ago, 61 percent of Exchange servers are still vulnerable.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-15731 β€Ό

An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-17098 β€Ό

Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions.

πŸ“– Read

via "National Vulnerability Database".
🦿 The state of security and the evolving role of CISOs in a pandemic 🦿

Cybersecurity leaders discuss business resiliency and identity challenges during a session at VMworld 2020.

πŸ“– Read

via "Tech Republic".
❌ Facebook Small Business Grants Spark Identity-Theft Scam ❌

The cybercrooks spread the COVID-19 relief scam via Telegram and WhatsApp, and ultimately harvest account credentials and even pics of IDs.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-4629 β€Ό

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.

πŸ“– Read

via "National Vulnerability Database".
🦿 Account takeover fraud rates skyrocketed 282% over last year 🦿

ATO is the weapon of choice for fraudsters leading up to the holiday shopping season, new data from Sift shows, and consumers place account security burden on businesses.

πŸ“– Read

via "Tech Republic".
πŸ•΄ COVID-19 Creates Opening for OT Security Reform πŸ•΄

Operations technology was once considered low risk, at least until the virus came along and re-arranged the threat landscape.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Phishing Attack Targets Microsoft 365 Users With Netflix & Amazon Lures πŸ•΄

Cyberattacker TA2552 primarily targets Spanish speakers with messages that leverage a narrow range of themes and popular brands.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-12506 β€Ό

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version FW03 and prior versions. WAGO 750-823 version FW03 and prior versions. WAGO 750-832/xxx-xxx version FW03 and prior versions. WAGO 750-862 version FW03 and prior versions. WAGO 750-891 version FW03 and prior versions. WAGO 750-890/xxx-xxx version FW03 and prior versions.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-12505 β€Ό

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 version FW07 and prior versions. WAGO 750-831/xxx-xxx version FW07 and prior versions. WAGO 750-882 version FW07 and prior versions. WAGO 750-885/xxx-xxx version FW07 and prior versions. WAGO 750-889 version FW07 and prior versions.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Insider Stole Yacht IP via USB, Company Alleges πŸ”

The latest industrial espionage case involves theft at a yacht manufacturer by a now ex-employee.

πŸ“– Read

via "Digital Guardian".
❌ Android Spyware Variant Snoops on WhatsApp, Telegram Messages ❌

The Android malware comes from threat group APT-C-23, also known as Two-Tailed Scorpion and Desert Scorpion.

πŸ“– Read

via "Threat Post".
πŸ•΄ A Guide to the NIST Cybersecurity Framework πŸ•΄

With cybersecurity threats growing exponentially, it has never been more important to put together an efficient cyber-risk management policy, and NIST's framework can help.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2019-20921 β€Ό

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-21523 β€Ό

A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: <#assign test="freemarker.template.utility.Execute"?new()> ${test("touch /tmp/freemarkerPwned")}

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-21527 β€Ό

There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delete any files on the system through directory traversal.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-21244 β€Ό

An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.

πŸ“– Read

via "National Vulnerability Database".