πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-3294 β€Ό

CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-14391 β€Ό

A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-26917 β€Ό

** DISPUTED ** PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value. NOTE: the discoverer states "security mitigation may not be necessary as there is no evidence yet that these screen intercepts are actually transported away from the local host." NOTE: it is unclear whether there are any common use cases in which apinotifypath is controlled by an attacker.

πŸ“– Read

via "National Vulnerability Database".
❌ Hacker Tries to Poison Water Supply of Florida Town ❌

A threat actor remotely accessed the IT system of the water treatment facility of Oldsmar and raised the levels of sodium hydroxide in the water, an action that was quickly noticed and remediated.

πŸ“– Read

via "Threat Post".
🦿 Ransomware can be installed via ghost accounts 🦿

Active accounts for people who have left your organization can make exploitation easy, according to Sophos.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Iranian Cyber Groups Spying on Dissidents & Others of Interest to Government πŸ•΄

A new investigation of two known threat groups show cyber actors are spying on mobile devices and PCs belonging to targeted users around the world.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Fighting Fileless Malware, Part 2: Countermeasures πŸ•΄

Why do fileless attacks persist? Let's break down the strengths and weaknesses of the existing mitigations.

πŸ“– Read

via "Dark Reading".
πŸ•΄ SolarWinds Attack Reinforces Importance of Principle of Least Privilege πŸ•΄

Taking stock of least-privilege policies will go a long way toward hardening an organization's overall security posture.

πŸ“– Read

via "Dark Reading".
❌ Cyberpunk 2077 Publisher Hit with Hack, Threats and Ransomware ❌

CD Projekt Red was hit with a cyberattack, and the attackers are threatening to release source code for Witcher 3, corporate documents and more.

πŸ“– Read

via "Threat Post".
❌ Android Devices Hunted by LodaRAT Windows Malware ❌

The LodaRAT - known for targeting Windows devices - has been discovered also targeting Android devices in a new espionage campaign.

πŸ“– Read

via "Threat Post".
⚠ Beware of technical β€œexperts” bombarding you with bug reports ⚠

Beware pseudo-geeks bearing 'gifts'.

πŸ“– Read

via "Naked Security".
🦿 FBI, Secret Service investigating cyberattack on Florida water treatment plant 🦿

Local officials said someone took over their TeamViewer system and dangerously increased the levels of lye in the town's water.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-21146 β€Ό

Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27259 β€Ό

The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execute arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-4795 β€Ό

IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request. IBM X-Force ID: 189446.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27261 β€Ό

The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21147 β€Ό

Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-26676 β€Ό

gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-3394 β€Ό

Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious user for a local privilege escalation.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-27257 β€Ό

This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21142 β€Ό

Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

πŸ“– Read

via "National Vulnerability Database".