🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
‼ CVE-2020-35592 ‼

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-26717 ‼

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3271 ‼

PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-36233 ‼

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-26906 ‼

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

📖 Read

via "National Vulnerability Database".
🕴 CrowdStrike Buys Log Management Startup Humio for $400M 🕴

CrowdStrike plans to use Humio's technology to continue building out its extended detection and response platform.

📖 Read

via "Dark Reading".
🕴 Microsoft Concludes Internal Investigation into Solorigate Breach 🕴

The software giant found no evidence that attackers gained extensive access to services or customer data.

📖 Read

via "Dark Reading".
‼ CVE-2021-26747 ‼

Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-26712 ‼

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.

📖 Read

via "National Vulnerability Database".
âš  S3 Ep20: Corporate megahacking, true love gone bad, and tax grabs [Podcast] âš 

Latest episode, listen now! (Includes special gardening safety section at no extra charge!)

📖 Read

via "Naked Security".
‼ CVE-2020-36247 ‼

Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-36251 ‼

ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-36249 ‼

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-24908 ‼

Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-26296 ‼

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-36250 ‼

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-36248 ‼

The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-36252 ‼

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3339 ‼

ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-10254 ‼

An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-10252 ‼

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authenticated attacker can interact with local services blindly (aka Blind SSRF) or conduct a Denial Of Service attack.

📖 Read

via "National Vulnerability Database".