πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
26.1K subscribers
89.3K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Hijacking a PLC Using its Own Network Features πŸ•΄

Researcher to show how attackers can exploit the built-in advanced connectivity functions in some Rockwell PLCs.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2016-10738

Zenbership v107 has CSRF via admin/cp-functions/event-add.php.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2016-10737

Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.

πŸ“– Read

via "National Vulnerability Database".
⚠ Police can’t compel biometric phone unlocking, rules judge ⚠

The landmark decision asserts the same legal protection for biometrics that we're given for passcodes.

πŸ“– Read

via "Naked Security".
⚠ Beware buying Fortnite’s V-Bucks, you could be funding organised crime ⚠

Credit card thieves are laundering money by purchasing the in-game currency V-Bucks, then selling it back at a discount to players.

πŸ“– Read

via "Naked Security".
⚠ Intel patches another security flaw in SGX technology ⚠

Of the six advisories Intel released last week, the most interesting is a flaw discovered in the company’s Software Guard Extensions (SGX).

πŸ“– Read

via "Naked Security".
⚠ Are you sure those WhatsApp messages are meant for you? ⚠

Abby Fuller got a shock when she logged into WhatsApp using a new telephone number. She found someone else’s messages waiting for her.

πŸ“– Read

via "Naked Security".
❌ VOIPO Database Exposes Millions of Texts, Call Logs ❌

VOIPO acknowledged that a development server had been accidentally left publicly accessible, and took the server offline.

πŸ“– Read

via "Threatpost | The first stop for security news".
❌ Magecart Returns with Advertising Library Tactic ❌

The threat group also has a new subsidiary, Magecart Group 12.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ” Top 10 app vulnerabilities: Unpatched plugins and extensions dominate πŸ”

Despite the existence of patches, the proliferation of unpatched installations are enticing targets for malicious actors, according to a WhiteHat report.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Triton/Trisis Attack Was More Widespread Than Publicly Known πŸ•΄

Signs of the attack first showed up two months before it was identified as a cyberattack, but they were mistaken for a pure equipment failure by Schneider Electric, security expert reveals at S4x19.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2016-9651 (chrome, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation)

A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

πŸ“– Read

via "National Vulnerability Database".
❌ Fortnite Hacked Via Insecure Single Sign-On ❌

Leaky Fortnite single sign-on mechanism could have allowed hackers to access game accounts.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ•΄ Are You Listening to Your Kill Chain? πŸ•΄

With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.

πŸ“– Read

via "Dark Reading: ".
❌ U.S. Issues Multiple Charges For 2016 SEC Hack ❌

The two were able to hack into the SEC's computer systems due to phishing attacks that stole credentials and spread malware.

πŸ“– Read

via "Threatpost | The first stop for security news".
πŸ” To stay competitive, MSSPs need to grow and evolve πŸ”

​Managed Security Service Providers can alleviate many of the headaches suffered by in-house security, but they need to remain nimble and focused to retain their edge.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Fortnite Players at Risk Via Epic Games Vulnerability πŸ•΄

Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2015-9280

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9279

MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9278

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2015-9277

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.

πŸ“– Read

via "National Vulnerability Database".