🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
Overlay Malware Targets Windows Users with a DLL Hijack Twist

Brazilians are warned of a new Vizom malware masquerading as video conferencing and browser software.

📖 Read

via "Threat Post".
GravityRAT Comes Back to Earth with Android, macOS Spyware

The espionage tool masquerades as legitimate applications and robs victims blind of their data.

📖 Read

via "Threat Post".
🕴 Trickbot, Phishing, Ransomware & Elections 🕴

The botnet has taken some hits lately, but that doesn't mean the threat is over. Here are some steps you can take to keep it from your door.

📖 Read

via "Dark Reading".
CVE-2020-26891

AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/m.login.recaptcha or /_matrix/client/r0/auth/m.login.terms Synapse 974923.

📖 Read

via "National Vulnerability Database".
🦿 State-sponsored hackers and ransomware gangs are diversifying tactics to inflict more harm 🦿

The groups have been using off-the-shelf tooling and open source penetration testing tools at unprecedented scale, according to Accenture's 2020 Cyber Threatscape Report.

📖 Read

via "Tech Republic".
🦿 Why ransomware has become such a huge problem for businesses 🦿

Ransomware has evolved into a significant threat for all types of organizations. How and why is it such a pervasive issue, and how can organizations better defend themselves against it?

📖 Read

via "Tech Republic".
🔏 DOJ Charges 14 Members of QQAAZZ in International Cybercrime Conspiracy 🔏

The latest international law enforcement takedown involves a money laundering ring responsible for doing the dirty work of cybercriminals.

📖 Read

via "Digital Guardian".
Rapper Scams $1.2M in COVID-19 Relief, Gloats with ‘EDD’ Video

"Nuke Bizzle" faces 22 years in prison after brazenly bragging about an identity-theft campaign in his music video, "EDD."

📖 Read

via "Threat Post".
CVE-2020-7156

A faultinfo_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-7193

A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-24649

A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-24647

A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-7145

A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-7153

A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-16160

GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_Decompress(). Parsing malicious input can result in a crash.

📖 Read

via "National Vulnerability Database".
CVE-2020-24651

A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
CVE-2020-7159

A customtemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

📖 Read

via "National Vulnerability Database".
🕴 Microsoft Tops Q3 List of Most-Impersonated Brands 🕴

The technology sector was also the most likely targeted industry for brand phishing attacks, according to Check Point's latest report on brand phishing.

📖 Read

via "Dark Reading".
🕴 GravityRAT Spyware Targets Android & MacOS in India 🕴

The Trojan once used in attacks against Windows systems has been transformed into a multiplatform tool targeting macOS and Android.

📖 Read

via "Dark Reading".
CVE-2020-15262

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.

📖 Read

via "National Vulnerability Database".
CVE-2020-9263

HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with common privilege, successful exploit could cause code execution.

📖 Read

via "National Vulnerability Database".