🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
CVE-2020-19667

Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.

📖 Read

via "National Vulnerability Database".
CVE-2020-7842

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users. This affects D'live set-top box AP(WF2429TB) v1.1.10.

📖 Read

via "National Vulnerability Database".
CVE-2020-28877

Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N.

📖 Read

via "National Vulnerability Database".
CVE-2020-19668

Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.

📖 Read

via "National Vulnerability Database".
CVE-2020-25839

NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.

📖 Read

via "National Vulnerability Database".
New Grelos Skimmer Variants Siphon Credit Card Data

Domains related to the new variant of the Grelos web skimmer have compromised dozens of websites so far.

📖 Read

via "Threat Post".
CVE-2020-28974

A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.

📖 Read

via "National Vulnerability Database".
CVE-2020-26236

In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login.

📖 Read

via "National Vulnerability Database".
🕴 How Industrial IoT Security Can Catch Up With OT/IT Convergence 🕴

Ransomware can easily make a connection between IT and OT already. How can blue teams do the same?

📖 Read

via "Dark Reading".
🕴 Facebook Messenger Flaw Enabled Spying on Android Callees 🕴

A critical flaw in Facebook Messenger on Android would let someone start an audio or video call without the victim's knowledge.

📖 Read

via "Dark Reading".
🕴 Security Pros Push for More Pervasive Threat Modeling 🕴

With the release of the "Threat Modeling Manifesto," a group of 16 security professionals hope to prompt more companies to consider the threats to software.

📖 Read

via "Dark Reading".
🦿 Study finds 31% of third-party vendors could cause significant damage to organizations if breached 🦿

Risk professionals relying on questionnaire-based assessments could be in for a rude awakening, according to Mastercard's RiskRecon and the Cyentia Institute.

📖 Read

via "Tech Republic".
VMware Fixes Critical Flaw in ESXi Hypervisor

The critical and important-severity flaws were found by a team at the China-based Tiunfu Cup hacking challenge.

📖 Read

via "Threat Post".
Good Heavens! 10M Impacted in Pray.com Data Exposure

The information exposed in a public cloud bucket included PII, church-donation information, photos and users' contact lists.

📖 Read

via "Threat Post".
Google Services Weaponized to Bypass Security in Phishing, BEC Campaigns

Attackers exploiting an array of Google Services, including Forms, Firebase, Docs and more to boost phishing and BEC campaigns.

📖 Read

via "Threat Post".
CVE-2020-4004

VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

📖 Read

via "National Vulnerability Database".
CVE-2020-28845

A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's portal thus leads to compromise admin's system.

📖 Read

via "National Vulnerability Database".
CVE-2020-20739

im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.

📖 Read

via "National Vulnerability Database".
CVE-2020-4005

VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004)

📖 Read

via "National Vulnerability Database".
CVE-2020-20740

PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().

📖 Read

via "National Vulnerability Database".
CVE-2020-5797

UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router.

📖 Read

via "National Vulnerability Database".