πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ New HP Bug Bounty Program Targets Vulns in Printer Cartridges πŸ•΄

White-hat hackers will receive $10,000 for each security bug they discover plus a base fee, under this invitation-only initiative.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Singapore Asks Big Cybersecurity Questions to Improve National Defense πŸ•΄

An executive from Singapore's Cyber Security Agency examines the role of security in a nation increasingly dependent on technology.

πŸ“– Read

via "Dark Reading".
🦿 Cybersecurity best practices: An open letter to end users 🦿

In an effort to make IT pros' jobs easier, Jack Wallen offers cybersecurity tips to end users--in particular, what not to do to keep company networks, equipment, and data secure.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-5787 β€Ό

Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk via the admin/services/packages/remove action.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-5786 β€Ό

Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-9486 β€Ό

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26524 β€Ό

CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26538 β€Ό

An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory.

πŸ“– Read

via "National Vulnerability Database".
⚠ Serious Security: Phishing without links – when phishers bring along their own web pages ⚠

How do you "check the URL before you click" if the web page you're visiting is already on your own computer?

πŸ“– Read

via "Naked Security".
β€Ό CVE-2020-7737 β€Ό

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7736 β€Ό

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-8110 β€Ό

A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched from uninitialized memory. This can lead to denial-of-service. This issue affects: Bitdefender Engines version 7.84897 and prior versions.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Friday Five 10/2 πŸ”

A legal right to work from home, insensitive phishing, and election disinformation - catch up on the week's news with the Friday Five!

πŸ“– Read

via "Digital Guardian".
❌ 305 CVEs and Counting: Bug-Hunting Stories From a Security Engineer ❌

Larry Cashdollar, senior security response engineer at Akamai, talks about the craziest stories he's faced, reporting CVEs since 1994.

πŸ“– Read

via "Threat Post".
πŸ•΄ Truncated URLs Look to Make Big Dent in Phishing πŸ•΄

The approach is a long time in coming and will test the premise that users can more easily detect a suspicious domain from the name alone.

πŸ“– Read

via "Dark Reading".
🦿 Report: Despite more cyberthreats during COVID-19, most businesses confident about cybersecurity 🦿

Remote working and phishing attacks spiked during the coronavirus pandemic, but organizations believe they're on track with their cybersecurity plans, according to a new report from CompTIA.

πŸ“– Read

via "Tech Republic".
πŸ•΄ 3 Months for the Cybercrime Books πŸ•΄

From July through September, US law enforcement handed down major indictments or sanctions against foreign threat groups at least six times.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-25623 β€Ό

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used.

πŸ“– Read

via "National Vulnerability Database".
❌ Years-Long β€˜SilentFade’ Attack Drained Facebook Victims of $4M ❌

Facebook detailed an ad-fraud cyberattack that's been ongoing since 2016, stealing Facebook credentials and browser cookies.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-7069 β€Ό

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

πŸ“– Read

via "National Vulnerability Database".
❌ LatAm Banking Trojans Collaborate in Never-Before-Seen Effort ❌

Eleven different malware families are coordinating on distribution, features, geo-targeting and more.

πŸ“– Read

via "Threat Post".