πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Critical Zerologon Flaw Exploited in TA505 Attacks πŸ•΄

Microsoft reports a new campaign leveraging the critical Zerologon vulnerability just days after nation-state group Mercury was seen using the flaw.

πŸ“– Read

via "Dark Reading".
πŸ” 10/9 Friday Five πŸ”

Antitrust reforms, biometic data collection, and DHS malware warnings - catch up on all the week's news with the Friday Five!

πŸ“– Read

via "Digital Guardian".
❌ Fitbit Spyware Steals Personal Data via Watch Face ❌

Immersive Labs Researcher takes advantage of lax Fitbit privacy controls to build a malicious spyware watch face.

πŸ“– Read

via "Threat Post".
πŸ•΄ Apple Pays Bug Bounty to Enterprise Network Researchers πŸ•΄

So far, the company has doled out $288,000 to five researchers who, in three months, found 55 vulnerabilities in its corporate infrastructure.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Latest Version of MalLocker Android Ransomware Packs New Tricks πŸ•΄

Like most such mobile malware, the new one doesn't encrypt data but attempts to make an infected system impossible to use, Microsoft says.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-26935 β€Ό

An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26947 β€Ό

monero-wallet-gui in Monero GUI 0.17.0.1 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users to gain privileges via a Trojan horse library in the current working directory.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26948 β€Ό

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-14184 β€Ό

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-5141 β€Ό

A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.

πŸ“– Read

via "National Vulnerability Database".
⚠ S3 Ep1: Ransomware – is it really OK to pay? – Naked Security Podcast ⚠

Our podcast is back for Series 3 - here's Episode 1!

πŸ“– Read

via "Naked Security".
⚠ Naked Security Live – Cybersecurity tips for your own network ⚠

Here's the latest Naked Security Live video - enjoy (and please share with your friends)!

πŸ“– Read

via "Naked Security".
❌ Ransomware Attackers Buy Network Access in Cyberattack Shortcut ❌

Network access to various industries is being offered in underground forums at as little as $300 a pop - and researchers warn that ransomware groups like Maze and NetWalker could be buying in.

πŸ“– Read

via "Threat Post".
πŸ•΄ How to Pinpoint Rogue IoT Devices on Your Network πŸ•΄

Researchers explain how security practitioners can recognize when a seemingly benign device could be malicious.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Security Officers, Are Your Employers Practicing Good Habits from Home? πŸ•΄

Even if you can't see your employees in the office, they still need to be reminded that criminals are always trying to spot a weak link in the chain.

πŸ“– Read

via "Dark Reading".
πŸ•΄ A 7-Step Cybersecurity Plan for Healthcare Organizations πŸ•΄

With National Cybersecurity Awareness Month shining a spotlight on the healthcare industry, security pros share best practices for those charged with protecting these essential organizations.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-4772 β€Ό

An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 189150.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-4773 β€Ό

A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no impact to remainder of web application. IBM X-Force ID: 189151.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-9108 β€Ό

HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause the process reboot.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-4689 β€Ό

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696.

πŸ“– Read

via "National Vulnerability Database".