πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-5389 β€Ό

Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerability. Authenticated low privileged OMIMSCC users may be able to retrieve sensitive information from the logs.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-13344 β€Ό

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

πŸ“– Read

via "National Vulnerability Database".
🦿 Security pros: Cyber threats to industrial enterprises increase due to pandemic 🦿

86% polled said their organization made cybersecurity a priority during the COVID-19 crisis and implemented appropriate training for remote workers, according to a report.

πŸ“– Read

via "Tech Republic".
⚠ Naked Security Podcast – we’re back for Series 3! ⚠

Join us weekly for the Naked Security Podcast - back for Series 3 and available wherever good podcasts are found!

πŸ“– Read

via "Naked Security".
πŸ›  Zeek 3.2.2 πŸ› 

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyber-infrastructure. Zeek's user community includes major universities, research labs, supercomputing centers, and open-science communities. This is the source code release.

πŸ“– Read

via "Packet Storm Security".
⚠ 8 tips to tighten up your work-from-home network ⚠

You don't have to be an IT guru to beef up your cybersecurity at home. Sometimes it's enough to ask yourself, "Which bits can I turn off?"

πŸ“– Read

via "Naked Security".
❌ Cisco Fixes High-Severity Webex, Security Camera Flaws ❌

Three high-severity flaws exist in Cisco's Webex video conferencing system, Cisco’s Video Surveillance 8000 Series IP Cameras and Identity Services Engine.

πŸ“– Read

via "Threat Post".
🦿 How SMBs can better protect their data from cyberattacks 🦿

SMBs compromised by an effective cyberattack can not only lose data and suffer financially but go out of business entirely, says Infrascale.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Scale Up Threat Hunting to Skill Up Analysts πŸ•΄

Security operation centers need to move beyond the simplicity of good and bad software to having levels of "badness," as well as better defining what is good. Here's why.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-10816 β€Ό

Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet.

πŸ“– Read

via "National Vulnerability Database".
πŸ” What is HIPAA Compliance? πŸ”

Learn about the Health Insurance Portability and Accountability Act (HIPAA) and the requirements for HIPAA compliance in Data Protection 101, our series on the fundamentals of information security.

πŸ“– Read

via "Digital Guardian".
🦿 Cloud and remote work support strengthened US market performance 🦿

The IT outlook for 2021, top trends and guidance as the enterprise prepares for "the next normal," according to a new report from IDC.

πŸ“– Read

via "Tech Republic".
❌ RAINBOWMIX Apps in Google Play Serve Up Millions of Ad Fraud Victims ❌

Collectively, 240 fraudulent Android apps -- masquerading as retro game emulators -- account for 14 million installs.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-9048 β€Ό

A vulnerability in victor Web Client versions up to and including v5.4.1 could allow a remote unauthenticated attacker to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Cyberattacks Up, But Companies (Mostly) Succeed in Securing Remote Workforce πŸ•΄

Despite fears that the burgeoning population of remote workers would lead to breaches, companies have held their own, a survey of threat analysts finds.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-15241 β€Ό

TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-15242 β€Ό

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.

πŸ“– Read

via "National Vulnerability Database".
🦿 COVID-19 budgets, data security, and automation are concerns of IT leaders and staff 🦿

Dueling surveys from Kaseya showed that IT department leaders share their underlings' worries about security and productivity.

πŸ“– Read

via "Tech Republic".
🦿 Password managers: A cheat sheet for professionals 🦿

The sheer number of passwords the average person has can lead to confusion and tons of password retrieval emails. Simplify and secure your digital life by learning about password managers.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-15243 β€Ό

Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have installed and activated the Web API plugin. Users of Smartstore 4.0.0 and 4.0.1 must merge their repository with 4.0.x or overwrite the file SmartStore.Web.Framework in the */bin* directory of the deployed shop with this file. As a workaround without updating uninstall the Web API plugin to close this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26162 β€Ό

Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.

πŸ“– Read

via "National Vulnerability Database".