πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-3396 β€Ό

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27374 β€Ό

VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve "Zugriff auf Inhalte der WebOffice Applikation."

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-36245 β€Ό

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Egregor Arrests a Blow, But Ransomware Will Likely Bounce Back πŸ•΄

Similar to previous ransomware takedowns, this disruption to the ransomware-as-a-service model will likely be short-lived, security experts say.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-9306 β€Ό

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-12878 β€Ό

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27138 β€Ό

The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-8625 β€Ό

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27097 β€Ό

The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Virginia Takes Different Tack Than California With Data Privacy Law πŸ•΄

Online businesses targeting Virginia consumers and have personal data of 100,000 consumers in the state must conform to the new statute.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Pro Tip: Say What You Know πŸ•΄

During the immediate period following a breach, it's vital to move fast - but not trip over yourself.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-35577 β€Ό

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-29664 β€Ό

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.

πŸ“– Read

via "National Vulnerability Database".
❌ Mac Malware Targets Apple’s In-House M1 Processor ❌

A malicious adware-distributing application specifically targets Apple's new M1 SoC, used in its newest-generation MacBook Air, MacBook Pro and Mac mini devices.

πŸ“– Read

via "Threat Post".
πŸ•΄ How to Run a Successful Penetration Test πŸ•΄

These seven tips will help ensure a penetration test improves your organization's overall security posture.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Data security accountability in an age of regular breaches πŸ•΄

As the number of vendors impacted by supply-chain breaches grows, one constant question remains: where exactly does accountability for data security lie, and what part do end users play in their own data breach protection?

πŸ“– Read

via "Dark Reading".
⚠ US names three North Koreans in laundry list of cybercrime charges ⚠

Trio alleged to have been at it for more than a decade, and to have made off with well over a billion dollars.

πŸ“– Read

via "Naked Security".
β€Ό CVE-2020-28496 β€Ό

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-20444 β€Ό

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196620.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-28499 β€Ό

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23341 β€Ό

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

πŸ“– Read

via "National Vulnerability Database".