πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Oracle Solaris Zero-Day Attack Revealed ❌

A threat actor is compromising telecommunications companies and targeted financial and professional consulting industries using an Oracle flaw.

πŸ“– Read

via "Threat Post".
🦿 WinZip Mac 8 Pro: Create backups and encrypt sensitive files 🦿

Mac users can do more than just compress files using WinZip Mac 8 Pro. The program also assists with creating backups and encrypting sensitive files, among other features.

πŸ“– Read

via "Tech Republic".
πŸ•΄ APT Groups Get Innovative -- and More Dangerous -- in 3Q πŸ•΄

In "curious" trend, more threat actors diversified their tool sets in third quarter than usual.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-26211 β€Ό

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Securing the 2020 Election: 'We're Not Out of the Woods Yet' πŸ•΄

Election Day brought instances of misinformation, robocalls, and technical glitches, but officials are more worried about coming days and weeks.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-27346 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
❌ Police to Livestream Ring Camera Footage of Mississippi Residents ❌

Pilot program again sparks privacy fears from ACLU as Amazon takes its partnership with law enforcement to the next level.

πŸ“– Read

via "Threat Post".
⚠ Another Chrome zero-day, this time on Android – check your version! ⚠

Another week, another Chrome zero-day, this time on your phone.

πŸ“– Read

via "Naked Security".
❌ Code42 Incydr Series: Why Most Companies Can’t Stop Departing Employee Data Theft ❌

According to Code42’s Data Exposure Report, 63% of employees say they brought data with them from their previous employer to their current employer.

πŸ“– Read

via "Threat Post".
πŸ•΄ CSA Moves to Redefine Cloud-Based Intelligence πŸ•΄

The new paradigm seeks to understand, integrate, and automate data workflows, and better yet, doesn't require significant investment or more personnel.

πŸ“– Read

via "Dark Reading".
πŸ›  Sifter 10.6m πŸ› 

Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.

πŸ“– Read

via "Packet Storm Security".
❌ VMware Issues Updated Fix For Critical ESXi Flaw ❌

A previous fix for the critical remote code execution bug was "incomplete," according to VMware.

πŸ“– Read

via "Threat Post".
❌ Toymaker Mattel Hit by Ransomware Attack ❌

Financial disclosure filings describe a ransomware attack that delivered a weak punch.

πŸ“– Read

via "Threat Post".
πŸ•΄ Containers for Data Analysis Are Rife With Vulnerabilities πŸ•΄

Old software components and the inclusion of unnecessary code created a massive attack surface area in containers for scientific analysis, researchers say.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-2314 β€Ό

Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Prepare for the Unexpected: Costs to Consider in Security Budgets πŸ•΄

Organizations that update business models to include cybersecurity as part of a strategic planning process may be able to better withstand unexpected disruptions.

πŸ“– Read

via "Dark Reading".
πŸ” Logistics Firm Claims Former Exec Took Secrets to Start New Firm πŸ”

This US logistics company claims a former board member stole company secrets to set up his own competitor.

πŸ“– Read

via "Digital Guardian".
β€Ό CVE-2020-22274 β€Ό

JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-22273 β€Ό

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings)

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-22276 β€Ό

WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-22278 β€Ό

phpMyAdmin through 5.0.2 allows CSV injection via Export Section

πŸ“– Read

via "National Vulnerability Database".