πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-35151 β€Ό

The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26277 β€Ό

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-29596 β€Ό

MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request.

πŸ“– Read

via "National Vulnerability Database".
❌ Patrick Wardle on Hackers Leveraging β€˜Powerful’ iOS Bugs in High-Level Attacks ❌

Noted Apple security expert Patrick Wardle discusses how cybercriminals are stepping up their game in targeting Apple users with new techniques and cyberattacks.

πŸ“– Read

via "Threat Post".
πŸ” What is NIST CSF? πŸ”

The National Institute of Standards and Technology's Cybersecurity Framework is designed to help organizations manage their security risk; in this blog we'll go over its requirements, penalties for failing to comply with it, and best practices.

πŸ“– Read

via "Digital Guardian".
🦿 How to combat future cyberattacks following the SolarWinds breach 🦿

How can and should governments respond to and better protect themselves from serious cyberattacks from hostile nations?

πŸ“– Read

via "Tech Republic".
πŸ•΄ Security as Code: How Repeatable Policy-Driven Deployment Improves Security πŸ•΄

The SaC approach lets users codify and enforce a secure state of application configuration deployment that limits risk.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-28460 β€Ό

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28448 β€Ό

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.

πŸ“– Read

via "National Vulnerability Database".
❌ Joker’s Stash Carding Site Taken Down, for Now ❌

The underground payment-card data broker saw its blockchain DNS sites taken offline after an apparent law-enforcement effort.

πŸ“– Read

via "Threat Post".
❌ Tech Giants Lend WhatsApp Support in Spyware Case Against NSO Group ❌

Google, Microsoft, Cisco Systems and others want appeals court to deny immunity to Israeli company for its alleged distribution of spyware and illegal cyber-surveillance activities.

πŸ“– Read

via "Threat Post".
πŸ•΄ Law Enforcement Disrupts VPN Services Enabling Cybercrime πŸ•΄

The United States and international partners shut down three bulletproof hosting services used to facilitate criminal activity.

πŸ“– Read

via "Dark Reading".
πŸ›  Sifter 11.2 πŸ› 

Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.

πŸ“– Read

via "Packet Storm Security".
⚠ Does a friend β€œneed money urgently”? Check your facts before paying out… ⚠

Don't get scammed by fake online requests to help a friend online. Check your facts first - here's why.

πŸ“– Read

via "Naked Security".
🦿 UK lawmakers propose law banning retail bots after PS5 fiasco 🦿

The legislation would both ban the resale of goods acquired using bots and the resale of tech products above the manufacturers' price.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2019-11782 β€Ό

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2018-15645 β€Ό

Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create arbitrary records via crafted payloads, which may allow privilege escalation.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2018-15633 β€Ό

Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-11784 β€Ό

Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users to obtain access to arbitrary messages in conversations they were not a party to.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2018-15641 β€Ό

Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-25106 β€Ό

Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.

πŸ“– Read

via "National Vulnerability Database".