πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Protecting Phones From Pegasus-Like Spyware Attacks ❌

Podcast: Can a new SIM card and prepaid service from an MVNO help? Former spyware insider, current mobile white hat hacker Adam Weinberg on how to block spyware attacks.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-36423 β€Ό

An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-29707 β€Ό

IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879.

πŸ“– Read

via "National Vulnerability Database".
🦿 US and allies finger China in Microsoft Exchange hack 🦿

The US has also blamed hackers working with China for ransomware attacks, extortion, crypto-jacking and other cybercrimes.

πŸ“– Read

via "Tech Republic".
❌ Ruthless Attackers Target Florida Condo Collapse Victims ❌

Hackers are stealing the identities of those lost in the condo-collapse tragedy.

πŸ“– Read

via "Threat Post".
πŸ•΄ NSO Group Spyware Used On Journalists & Activists Worldwide πŸ•΄

An investigation finds Pegasus spyware, intended for use on criminals and terrorists, has been used in targeted campaigns against others around the world.

πŸ“– Read

via "Dark Reading".
πŸ” What is HITECH Compliance? Understanding and Meeting HITECH Requirements πŸ”

Learn about the requirements for HITECH compliance and how to meet them in Data Protection 101, our series on the fundamentals of information security.

πŸ“– Read

via "".
β€Ό CVE-2020-20248 β€Ό

Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ How Gaming Attack Data Aids Defenders Across Industries πŸ•΄

Web application attacks against the video game industry quadrupled in 2020 compared to the previous year, but companies outside entertainment can learn from the data.

πŸ“– Read

via "Dark Reading".
πŸ•΄ US Accuses China of Using Criminal Hackers in Cyber Espionage Operations πŸ•΄

DOJ indicts four Chinese individuals for alleged role in attacks targeting intellectual property, trade secrets belonging to defense contractors, maritime companies, aircraft service firms, and others.

πŸ“– Read

via "Dark Reading".
🦿 How to activate virtualization-based security and core isolation in Windows 10 🦿

Give your PC a little extra security. HVCI and VBS are available in 64-bit versions of Windows 10, but you must turn them on manually. We show you how.

πŸ“– Read

via "Tech Republic".
❌ Unpatched iPhone Bug Allows Remote Device Takeover ❌

A format-string bug believed to be a low-risk denial-of-service issue turns out to be much nastier than expected.

πŸ“– Read

via "Threat Post".
πŸ•΄ Law Firm for Ford, Pfizer, Exxon Discloses Ransomware Attack πŸ•΄

Campbell Conroy & O'Neil reports the attack affected personal data including Social Security numbers, passport numbers, and payment card data for some individuals.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-34618 β€Ό

A remote denial of service (DoS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.4.x: All versions; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

πŸ“– Read

via "National Vulnerability Database".
❌ What’s Next for REvil’s Victims?  ❌

Podcast: Nothing, says a ransomware negotiator who has tips on staying out of the sad subset of victims left in the lurch, mid-negotiation, after REvil's servers went up in smoke.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-5321 β€Ό

Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input validation vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to spawn tasks with elevated privileges.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-29499 β€Ό

Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-26081 β€Ό

REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-26082 β€Ό

The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-25051 β€Ό

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-36979 β€Ό

Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).

πŸ“– Read

via "National Vulnerability Database".