πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-17355 β€Ό

Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (restart of agents) by crafting a malformed DHCP packet which leads to an incorrect route being installed.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27619 β€Ό

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27620 β€Ό

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.

πŸ“– Read

via "National Vulnerability Database".
⚠ Time for a mobile privacy reset? ⚠

Can you remember which permissions you gave to what apps, and why? Nor can we... time for a reset!

πŸ“– Read

via "Naked Security".
πŸ•΄ Implementing Proactive Cyber Controls in OT: Myths vs. Reality πŸ•΄

Debunking the myths surrounding the implementation of proactive cyber controls in operational technology.

πŸ“– Read

via "Dark Reading".
❌ Feds: Iran Behind β€˜Proud Boys’ Email Attacks on Democratic Voters ❌

Messages that threaten people to β€˜vote for Trump or else’ are part of foreign adversaries’ attempts to interfere with the Nov. 3 election, according to feds.

πŸ“– Read

via "Threat Post".
πŸ•΄ Need for 'Guardrails' in Cloud-Native Applications Intensifies πŸ•΄

With more organizations shifting to cloud services in the pandemic, experts say the traditionally manual process of securing them will be replaced by automated tools in 2021 and beyond.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-27642 β€Ό

A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27638 β€Ό

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

πŸ“– Read

via "National Vulnerability Database".
🦿 1Password for Linux desktop app now available in beta 🦿

A full Linux version of the popular password manager is expected early next year.

πŸ“– Read

via "Tech Republic".
πŸ•΄ McAfee Raises $740M in Second IPO πŸ•΄

The security software giant and its investors sold 37 million shares priced at $20 each, putting McAfee's value around $8.6 billion.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-26650 β€Ό

AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27646 β€Ό

Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.

πŸ“– Read

via "National Vulnerability Database".
❌ Chrome 86 Aims to Bar Abusive Notification Content ❌

Google said Chrome 86 will automatically block malicious notifications that may be used for phishing or malware.

πŸ“– Read

via "Threat Post".
❌ Facebook, News and XSS Underpin Complex Browser Locker Attack ❌

A sophisticated β€œbrowser locker” campaign is spreading via Facebook, ultimately pushing a tech-support scam. The effort is more advanced than most, because it involves exploiting a cross-site scripting (XSS) vulnerability on a popular news site, researchers said. Browser lockers are a type of redirection attack where web surfers will click on a site, only to […]

πŸ“– Read

via "Threat Post".
πŸ•΄ To Err Is Human: Misconfigurations & Employee Neglect Are a Fact of Life πŸ•΄

The cyber kill chain is only as strong as its weakest link, so organizations should reinforce that link with a properly equipped dedicated security team.

πŸ“– Read

via "Dark Reading".
πŸ” Former Employee Breached Company Payroll Data πŸ”

Before resigning, the employee stole company data and created a "superuser" account that let him access the network after he left.

πŸ“– Read

via "Digital Guardian".
β€Ό CVE-2020-27195 β€Ό

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

πŸ“– Read

via "National Vulnerability Database".
❌ Researcher: I Hacked Trump’s Twitter by Guessing Password ❌

Trump’s weak Twitter password and lack of basic two-factor authentication protections made it shockingly simple to hack his account, Dutch security researcher Victor Gevers reported.  

πŸ“– Read

via "Threat Post".
πŸ•΄ 8 New and Hot Cybersecurity Certifications for 2020 πŸ•΄

While the usual security certs remain popular, interest in privacy skills and cloud experience are pushing new credentials into the market.

πŸ“– Read

via "Dark Reading".
πŸ•΄ WordPress Plug-in Updated in Rare Forced Action πŸ•΄

The Logonizer login security plug-in was automatically updated to patch a SQL injection vulnerability.

πŸ“– Read

via "Dark Reading".