πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-7547 β€Ό

A CWE-284: Improper Access Control vulnerability exists in EcoStruxureΓ‚Βͺ and SmartStruxureΓ‚Βͺ Power Monitoring and SCADA Software (see security notification for version information) that could allow a user the ability to perform actions via the web interface at a higher privilege level.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-6880 β€Ό

A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statements, because the device does not properly filter parameters, successful use can obtain management rights. This affects: ZXV10 W908 all versions before MIPS_A_1022IPV6R3T6P7Y20.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Call Fraud Operator Ordered to Pay $9M to Victims πŸ•΄

Indian national will serve 20 years in prison for running a large call center fraud operation.

πŸ“– Read

via "Dark Reading".
πŸ•΄ The Cybersecurity Skills Gap: It Doesn't Have to Be This Way πŸ•΄

Once it becomes clear that off-the-shelf experts aren't realistic at scale, cultivating entry-level talent emerges as the only long-term solution -- not just for a hiring organization but for the field as a whole.

πŸ“– Read

via "Dark Reading".
πŸ” FBI Warns of BEC Scammers Using Email Forwarding πŸ”

The FBI says scammers are increasingly abusing forwarding rules on web-based email clients to hide their activity, opening the door for a Business Email Compromise (BEC) attack.

πŸ“– Read

via "Digital Guardian".
β€Ό CVE-2020-29315 β€Ό

ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-8539 β€Ό

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-11990 β€Ό

We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-16958 β€Ό

Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name.

πŸ“– Read

via "National Vulnerability Database".
❌ Cayman Islands Bank Records Exposed in Open Azure Blob ❌

An offshore Cayman Islands bank’s backups, covering a $500 million investment portfolio, were left unsecured and leaking personal banking information, passport data and even online banking PINs.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-28583 β€Ό

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version, build and patch information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28582 β€Ό

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal number of managed agents.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28575 β€Ό

A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target in order to exploit this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28573 β€Ό

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28576 β€Ό

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version and build information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28577 β€Ό

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.

πŸ“– Read

via "National Vulnerability Database".
❌ Android Messenger App Still Leaking Photos, Videos ❌

The GO SMS Pro app has been downloaded 100 million times; now, underground forums are actively sharing images stolen from GO SMS servers.

πŸ“– Read

via "Threat Post".
❌ Misconfigured Docker Servers Under Attack by Xanthe Malware ❌

The never-before-seen Xanthe cryptomining botnet has been targeting misconfigured Docker APIs.

πŸ“– Read

via "Threat Post".
πŸ•΄ SASE 101: Why All the Buzz? πŸ•΄

Wide area networking and network security services unite to provide secure, cloud-based connectivity for enterprises' remote employees -- and these days that means billions of workers.

πŸ“– Read

via "Dark Reading".
🦿 How to protect your personal data from being sold on the Dark Web 🦿

Cybercriminals can use stolen information for extortion, scams and phishing schemes, and the direct theft of money, says Kaspersky.

πŸ“– Read

via "Tech Republic".