πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-26552 β€Ό

An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for access.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28914 β€Ό

An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26548 β€Ό

An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26216 β€Ό

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28130 β€Ό

An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root).

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Nearly Two Dozen AWS APIs Are Vulnerable to Abuse πŸ•΄

Attackers can conduct identity reconnaissance against an organization at leisure without being detected, Palo Alto Networks says.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-28183 β€Ό

SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28917 β€Ό

An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28915 β€Ό

A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.

πŸ“– Read

via "National Vulnerability Database".
❌ Firing of CISA Chief Christopher Krebs Widely Condemned ❌

President Trump fired US cybersecurity chief over Twitter Tuesday, an act widely condemned within the cybersecurity community.

πŸ“– Read

via "Threat Post".
🦿 Microsoft's new security chip takes PC protection to a higher level 🦿

Intel, AMD and Qualcomm will use the Microsoft-designed Pluton security processor from Xbox One and Azure Sphere in future SoCs to deliver better protection than a TPM.

πŸ“– Read

via "Tech Republic".
🦿 Zoom: These new features will prevent trolls and meeting-crashers 🦿

Zoom hosts can now pause a meeting while they remove a disruptive participant, and a new web-scanning tool will seek out compromised meeting links.

πŸ“– Read

via "Tech Republic".
🦿 "123456" tops list of most common passwords for 2020 🦿

People are still using very simple passwords, with many of them similar to the ones they used in 2019, according to NordPass.

πŸ“– Read

via "Tech Republic".
🦿 How to improve the security of your public cloud 🦿

Almost all the professionals who responded to a survey from BitGlass were concerned about the security of their public cloud apps and data.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Researchers Say They've Developed Fastest Open Source IDS/IPS πŸ•΄

With a five-processor core, "Pigasus" delivers the same performance as a system with between 100 and 700 cores, according to a team from Carnegie Mellon University's CyLab.

πŸ“– Read

via "Dark Reading".
⚠ Sophos 2021 Threat Report: Navigating cybersecurity in an uncertain world ⚠

Here's the latest Sophos Threat Report - learn what cybercriminals are up to on Windows, Linux, Android and more

πŸ“– Read

via "Naked Security".
πŸ•΄ How to Identify Cobalt Strike on Your Network πŸ•΄

Common antivirus systems frequently miss Cobalt Strike, a stealthy threat emulation toolkit admired by red teams and attackers alike.

πŸ“– Read

via "Dark Reading".
🦿 Security experts level criticism at Apple after Big Sur launch issues 🦿

Users took to social media to complain about slow systems with one report pointing to an OCSP responder as the culprit.

πŸ“– Read

via "Tech Republic".
🦿 66% of companies say it would take 5 or more days to fully recover from a ransomware attack ransom not paid 🦿

Veritas research finds data protection strategies are not keeping pace with the complexity of the attacks enterprises are facing.

πŸ“– Read

via "Tech Republic".
🦿 How remote working poses security risks for your organization 🦿

Companies are at greater risk due to phishing attacks, password sharing, and unsecured personal devices, says SailPoint.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-24723 β€Ό

Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1.

πŸ“– Read

via "National Vulnerability Database".