πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
26.2K subscribers
89.3K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-28870 β€Ό

In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28871 β€Ό

Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.

πŸ“– Read

via "National Vulnerability Database".
🦿 Hit block caller: 75% of Americans were targeted by scammers 🦿

While it's logical to assume seniors would be primary targets, a new report revealed that millennials were actually the most targeted demographic group of the more than 50 billion spam calls made in 2020.

πŸ“– Read

via "Tech Republic".
🦿 177% increase: Hackers grabbed 21.3 million healthcare records in the second half of 2020 🦿

A new breach analysis from CI Security found that cybercriminals are going after medical billing and insurance companies.

πŸ“– Read

via "Tech Republic".
❌ Supply-Chain Hack Breaches 35 Companies, Including PayPal, Microsoft, Apple ❌

Ethical hacker Alex Birsan developed a way to inject malicious code into open-source developer tools to exploit dependencies in organizations internal applications.

πŸ“– Read

via "Threat Post".
⚠ Patch now to stop hackers blindly crashing your Windows computers ⚠

Patch early, patch often. In fact, patch now if you haven't already. Here's why.

πŸ“– Read

via "Naked Security".
❌ The time for Insider Risk Management is now: Code42 2021 Data Exposure Report Reveals a Perfect Storm ❌

The Code42 2021 Data Exposure Report highlights the need to adopt a new approach to data security and invest in modern Insider Risk technology.

πŸ“– Read

via "Threat Post".
πŸ•΄ Multivector Attacks Demand Security Controls at the Messaging Level πŸ•΄

As a Google-identified attack reveals, security teams need to look beyond VPNs and network infrastructure to the channels where social engineering takes place.

πŸ“– Read

via "Dark Reading".
❌ Intel Squashes High-Severity Graphics Driver Flaws ❌

Intel is warning on security bugs across its graphics drivers, server boards, compute modules and modems.

πŸ“– Read

via "Threat Post".
🦿 Love is in the airβ€”and cybercriminals are taking advantage 🦿

Malicious Valentine's Day-themed phishing campaigns are up 29% from last year, according to Check Point Research.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-24837 β€Ό

An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-24838 β€Ό

An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27135 β€Ό

xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted UTF-8 character sequence.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-29171 β€Ό

Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Zero Trust in the Real World πŸ•΄

Those who are committed to adopting the concept have the opportunity to make a larger business case for it across the organization, working with executive leaders to implement a zero-trust framework across the entire enterprise.

πŸ“– Read

via "Dark Reading".
🦿 Mozilla privacy report on dating apps singles out Grindr for serious security lapses 🦿

21 of the 24 dating apps examined were tagged with the "*Privacy Not Included" warning label.

πŸ“– Read

via "Tech Republic".
🦿 NordVPN puts the price tag of stolen streaming subscriptions at $38 million 🦿

Malware designed to steal log-in information saved in browsers has infected 16 million computers and swiped credentials for up to 174,800 accounts.

πŸ“– Read

via "Tech Republic".
❌ Hybrid, Older Users Most-Targeted by Gmail Attackers ❌

Researchers at Google and Stanford analyzed a 1.2 billion malicious emails to find out what makes users likely to get attacked. 2FA wasn't a big factor.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-0338 β€Ό

In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI settings. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-156260178

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-26299 β€Ό

ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands, for example, CWD and UPDR. When windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function. The issue is patched in version 4.4.0 (commit 457b859450a37cba10ff3c431eb4aa67771122e3).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-0326 β€Ό

In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525

πŸ“– Read

via "National Vulnerability Database".