πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ” NYDFS Issues Ransomware Prevention Guidance for Financial Services Firms πŸ”

The NYDFS has issued guidance for financial services companies on how to reduce the risk of ransomware attacks - like having a capable endpoint threat detection and response (EDR) solution in place.

πŸ“– Read

via "".
β€Ό CVE-2021-33676 β€Ό

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-33683 β€Ό

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ 4 Integrated Circuit Security Threats and How to Protect Against Them πŸ•΄

Little-understood threats involving the IC supply chain are putting organizations around the world at risk.

πŸ“– Read

via "Dark Reading".
🦿 These states saw the most hacks in 2020 🦿

A report uses FBI data to parse out state-by-state hacking data by the number of victims and total financial losses for every 100,000 residents.

πŸ“– Read

via "Tech Republic".
πŸ›  UFONet 1.7 πŸ› 

UFONet abuses OSI Layer 7-HTTP to create/manage 'zombies' and to conduct different attacks using GET/POST, multi-threading, proxies, origin spoofing methods, cache evasion techniques, etc.

πŸ“– Read

via "Packet Storm Security".
🦿 Personal data compromises up 38%, according to new cybersecurity report 🦿

The report parses out data by industry. Overall, healthcare topped the list, followed by financial services and manufacturing and utilities.

πŸ“– Read

via "Tech Republic".
⚠ Home delivery scams get smarter – don’t get caught out ⚠

We've said it before, and we'll say it again: don't be in too much of a hurry for those home deliveries you're expecting!

πŸ“– Read

via "Naked Security".
β€Ό CVE-2021-33211 β€Ό

A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-22781 β€Ό

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause a leak of SMTP credential used for mailbox authentication when an attacker can access a project file.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ 10 Mistakes Companies Make In Their Ransomware Responses πŸ•΄

Hit by ransomware? These missteps can take a bad scenario and make it even worse.

πŸ“– Read

via "Dark Reading".
❌ Trickbot Malware Rebounds with Virtual-Desktop Espionage Module ❌

The attackers have spruced up the 'vncDll' module used for spying on targets and stealing data.

πŸ“– Read

via "Threat Post".
🦿 IoT projects demand new skills from IT project managers 🦿

If you think regular IT project managers can run IoT projects, you might be miscalculating. Here's why.

πŸ“– Read

via "Tech Republic".
❌ Linux-Focused Cryptojacking Gang Tracked to Romania ❌

The gang is using a new brute-forcer – β€œDiicot brute” – to crack passwords on Linux-based machines with weak passwords.

πŸ“– Read

via "Threat Post".
πŸ•΄ Did the Cybersecurity Workforce Gap Distract Us From the Leak? πŸ•΄

Cyber games can play a critical role in re-engaging our workforce and addressing the employee retention crisis.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-29147 β€Ό

A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-36740 β€Ό

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

πŸ“– Read

via "National Vulnerability Database".
❌ Cryptominer Farm Rigged with 3,800 PS4s Busted in Ukraine ❌

Ukrainian cops seize PlayStation 4 consoles, graphics cards, processors and more in cryptomining sting involving alleged electricity theft.

πŸ“– Read

via "Threat Post".
🦿 Kaspersky: LuminousMoth spearphishing campaign hit 1,500 targets in Asia 🦿

Security researchers think HoneyMyte is behind the advanced persistent threat that has mostly targeted government entities.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-34514 β€Ό

Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31979, CVE-2021-33771.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-33746 β€Ό

Windows DNS Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33754, CVE-2021-33780, CVE-2021-34494, CVE-2021-34525.

πŸ“– Read

via "National Vulnerability Database".