🛡 Cybersecurity & Privacy 🛡 - News
25.9K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
CVE-2021-25769

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.

📖 Read

via "National Vulnerability Database".
CVE-2021-25772

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.

📖 Read

via "National Vulnerability Database".
CVE-2021-25758

In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to code execution.

📖 Read

via "National Vulnerability Database".
CVE-2021-25757

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

📖 Read

via "National Vulnerability Database".
CVE-2021-25768

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

📖 Read

via "National Vulnerability Database".
CVE-2020-27994

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.

📖 Read

via "National Vulnerability Database".
CVE-2020-35482

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.

📖 Read

via "National Vulnerability Database".
CVE-2021-25765

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.

📖 Read

via "National Vulnerability Database".
CVE-2020-27222

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because it sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshakes failure with TLS parameter mismatch. The server must be restarted to recover this. This allow clients to force a DoS.

📖 Read

via "National Vulnerability Database".
CVE-2021-25763

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

📖 Read

via "National Vulnerability Database".
CVE-2021-25761

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

📖 Read

via "National Vulnerability Database".
CVE-2020-25208

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

📖 Read

via "National Vulnerability Database".
CVE-2020-28653

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

📖 Read

via "National Vulnerability Database".
CVE-2020-2506

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to obtain control of a QNAP device. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

📖 Read

via "National Vulnerability Database".
🕴 SolarWinds Attackers Spent Months in Corporate Email System: Report 🕴

SolarWinds' CEO says evidence indicates attackers lurked in the company's Office 365 email system for months ahead of the attack.

📖 Read

via "Dark Reading".
🕴 An Observability Pipeline Could Save Your SecOps Team 🕴

Traditional monitoring approaches are proving brittle as security operations teams need better visibility into dynamic environments.

📖 Read

via "Dark Reading".
🦿 Account takeover attacks spiked in 2020, Kaspersky says 🦿

The surge gives further credence to the idea that cybercrime is less about tech know-how and more about social engineering, according to its fraud report.

📖 Read

via "Tech Republic".
🦿 How a global law enforcement effort took down the Emotet botnet 🦿

A joint effort across the US and Europe led to the disruption of Emotet and the arrest of two gang members, says Digital Shadows.

📖 Read

via "Tech Republic".
🔏 How to Protect Data and Defend Against State-Sponsored Hackers 🔏

NIST has released new tools for defenders to protect sensitive information and mitigate state-sponsored hackers.

📖 Read

via "Digital Guardian".
New Malware Hijacks Kubernetes Clusters to Mine Monero

Researchers warn that the Hildegard malware is part of 'one of the most complicated attacks targeting Kubernetes.'

📖 Read

via "Threat Post".
CVE-2020-9388

CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.

📖 Read

via "National Vulnerability Database".