πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
26.2K subscribers
89.3K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-26192 β€Ό

Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. A non-admin user with either ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH may potentially exploit this vulnerability to read arbitrary data, tamper with system software or deny service to users. Note: no non-admin users or roles have these privileges by default.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26196 β€Ό

Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploit this vulnerability resulting in the ability to write data outside of the intended file system location.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21474 β€Ό

SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21479 β€Ό

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28870 β€Ό

In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28871 β€Ό

Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.

πŸ“– Read

via "National Vulnerability Database".
🦿 Hit block caller: 75% of Americans were targeted by scammers 🦿

While it's logical to assume seniors would be primary targets, a new report revealed that millennials were actually the most targeted demographic group of the more than 50 billion spam calls made in 2020.

πŸ“– Read

via "Tech Republic".
🦿 177% increase: Hackers grabbed 21.3 million healthcare records in the second half of 2020 🦿

A new breach analysis from CI Security found that cybercriminals are going after medical billing and insurance companies.

πŸ“– Read

via "Tech Republic".
❌ Supply-Chain Hack Breaches 35 Companies, Including PayPal, Microsoft, Apple ❌

Ethical hacker Alex Birsan developed a way to inject malicious code into open-source developer tools to exploit dependencies in organizations internal applications.

πŸ“– Read

via "Threat Post".
⚠ Patch now to stop hackers blindly crashing your Windows computers ⚠

Patch early, patch often. In fact, patch now if you haven't already. Here's why.

πŸ“– Read

via "Naked Security".
❌ The time for Insider Risk Management is now: Code42 2021 Data Exposure Report Reveals a Perfect Storm ❌

The Code42 2021 Data Exposure Report highlights the need to adopt a new approach to data security and invest in modern Insider Risk technology.

πŸ“– Read

via "Threat Post".
πŸ•΄ Multivector Attacks Demand Security Controls at the Messaging Level πŸ•΄

As a Google-identified attack reveals, security teams need to look beyond VPNs and network infrastructure to the channels where social engineering takes place.

πŸ“– Read

via "Dark Reading".
❌ Intel Squashes High-Severity Graphics Driver Flaws ❌

Intel is warning on security bugs across its graphics drivers, server boards, compute modules and modems.

πŸ“– Read

via "Threat Post".
🦿 Love is in the airβ€”and cybercriminals are taking advantage 🦿

Malicious Valentine's Day-themed phishing campaigns are up 29% from last year, according to Check Point Research.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-24837 β€Ό

An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-24838 β€Ό

An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27135 β€Ό

xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-29171 β€Ό

Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Zero Trust in the Real World πŸ•΄

Those who are committed to adopting the concept have the opportunity to make a larger business case for it across the organization, working with executive leaders to implement a zero-trust framework across the entire enterprise.

πŸ“– Read

via "Dark Reading".
🦿 Mozilla privacy report on dating apps singles out Grindr for serious security lapses 🦿

21 of the 24 dating apps examined were tagged with the "*Privacy Not Included" warning label.

πŸ“– Read

via "Tech Republic".
🦿 NordVPN puts the price tag of stolen streaming subscriptions at $38 million 🦿

Malware designed to steal log-in information saved in browsers has infected 16 million computers and swiped credentials for up to 174,800 accounts.

πŸ“– Read

via "Tech Republic".