πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ Sophos 2021 Threat Report: Navigating cybersecurity in an uncertain world ⚠

Here's the latest Sophos Threat Report - learn what cybercriminals are up to on Windows, Linux, Android and more

πŸ“– Read

via "Naked Security".
πŸ•΄ How to Identify Cobalt Strike on Your Network πŸ•΄

Common antivirus systems frequently miss Cobalt Strike, a stealthy threat emulation toolkit admired by red teams and attackers alike.

πŸ“– Read

via "Dark Reading".
🦿 Security experts level criticism at Apple after Big Sur launch issues 🦿

Users took to social media to complain about slow systems with one report pointing to an OCSP responder as the culprit.

πŸ“– Read

via "Tech Republic".
🦿 66% of companies say it would take 5 or more days to fully recover from a ransomware attack ransom not paid 🦿

Veritas research finds data protection strategies are not keeping pace with the complexity of the attacks enterprises are facing.

πŸ“– Read

via "Tech Republic".
🦿 How remote working poses security risks for your organization 🦿

Companies are at greater risk due to phishing attacks, password sharing, and unsecured personal devices, says SailPoint.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-24723 β€Ό

Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7562 β€Ό

A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7564 β€Ό

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7563 β€Ό

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28361 β€Ό

Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module.

πŸ“– Read

via "National Vulnerability Database".
❌ Google Chrome 87 Closes High-Severity β€˜NAT Slipstreaming’ Hole ❌

Overall Google's Chrome 87 release fixed 33 security vulnerabilities.

πŸ“– Read

via "Threat Post".
πŸ•΄ As Businesses Move to Multicloud Approach, Ransomware Follows πŸ•΄

The average US company uses 16 cloud services, but only a third of IT professional believe their security measures have kept up with the change.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Trump Fires CISA Director Chris Krebs πŸ•΄

Christopher Krebs was fired via tweet shortly after the Cybersecurity and Infrastructure Security Agency called the 2020 election "the most secure in American history."

πŸ“– Read

via "Dark Reading".
🦿 Linux and open source: The biggest issue in 2020 🦿

This year was rough for all involved--even Linux and open source didn't come through unscathed. See what Jack Wallen considers to be the biggest issue for Linux in 2020.

πŸ“– Read

via "Tech Republic".
❌ Cisco Webex β€˜Ghost’ Flaw Opens Meetings to Snooping ❌

Cisco patched the Webex flaw, as well as three critical-severity vulnerabilities, in a slew of security updates on Wednesday.

πŸ“– Read

via "Threat Post".
πŸ•΄ Out With the Old Perimeter, in With the New Perimeters πŸ•΄

A confluence of trends and events has exploded the whole idea of "the perimeter." Now there are many perimeters, and businesses must adjust accordingly.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-26079 β€Ό

A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by logging in as an administrative user and crafting a call for user information. A successful exploit could allow the attacker to obtain hashes of user passwords on an affected device.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28362 β€Ό

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26076 β€Ό

A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive information. An attacker could exploit this vulnerability by sending crafted curl commands to an affected device. A successful exploit could allow the attacker to view sensitive database information on the affected device.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26097 β€Ό

** UNSUPPORTED WHEN ASSIGNED ** The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on the Internet, remote root access on the device is possible. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26075 β€Ό

A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. An attacker could exploit this vulnerability by crafting malicious API requests to the affected device. A successful exploit could allow the attacker to gain access to the back-end database of the affected device.

πŸ“– Read

via "National Vulnerability Database".