πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts ❌

Companies that use Broadvoice's cloud-based VoIP platform may find their patients, customers, suppliers and partners to be impacted by a massive data exposure.

πŸ“– Read

via "Threat Post".
❌ Zoom Rolls Out End-to-End Encryption After Setbacks ❌

After backlash over false marketing around its encryption policies, Zoom will finally roll out end-to-end encryption next week.

πŸ“– Read

via "Threat Post".
🦿 Survey: 53% of young cybersecurity professionals fear replacement by automation 🦿

Cybersecurity professionals largely embrace automation, but half of younger employees worry that technology could make their roles obsolete, according to a new survey by Exabeam.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-6107 β€Ό

An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can provide a malicious file to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-6105 β€Ό

An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Overcoming the Challenge of Shorter Certificate Lifespans πŸ•΄

We could be in the middle of a major transition to shorter and shorter certificate life spans, which has significant implications for how IT organizations manage certificates across the enterprise.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2019-12411 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-13939 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Proposed Modifications to the CCPA Issued πŸ”

Potential modifications to the CCPA include would change β€œDo Not Sell My Personal Information” requests and how companies provide notice when they collect information offline.

πŸ“– Read

via "Digital Guardian".
πŸ•΄ Barnes & Noble Warns Customers About Data Breach πŸ•΄

Famed bookseller says non-financial data was exposed in a new attack.

πŸ“– Read

via "Dark Reading".
πŸ›  GRR 3.4.2.4 πŸ› 

GRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR consists of 2 parts: client and server. GRR client is deployed on systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. "Work" means running a specific action: downloading file, listing a directory, etc. GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.

πŸ“– Read

via "Packet Storm Security".
πŸ•΄ Twitter Hack Analysis Drives Calls for Greater Security Regulation πŸ•΄

New York's Department of Financial Services calls for more cybersecurity regulation at social media firms following the "jarringly easy" Twitter breach.

πŸ“– Read

via "Dark Reading".
❌ FIFA 21 Blockbuster Release Gives Fraudsters an Open Field for Theft ❌

In-game features of the just-released FIFA 21 title give scammers easy access its vast audience.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-12503 β€Ό

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.

πŸ“– Read

via "National Vulnerability Database".
❌ Critical Magento Holes Open Online Shops to Code Execution ❌

Adobe says the two critical flaws (CVE-2020-24407 and CVE-2020-24400) could allow arbitrary code execution as well as read or write access to the database.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2019-17640 β€Ό

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ US Indicts Members of Transnational Money-Laundering Organization πŸ•΄

Members of the QQAAZZ group helped cybercriminals conceal origins of stolen funds, DoJ alleges.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-14185 β€Ό

Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource. The affected versions are before 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before version 8.12.2.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27173 β€Ό

In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source (i.e., standard input). This behavior cannot be reproduced from the guest side. When no rate limiting is in place, the host can be subject to memory pressure, impacting all other VMs running on the same host.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27163 β€Ό

phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27176 β€Ό

Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it can also be considered an issue in the design of the "source code mode" feature, which parses HTML even though HTML support is not one of the primary advertised roles of the product.

πŸ“– Read

via "National Vulnerability Database".