πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-36979 β€Ό

Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-26095 β€Ό

The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27021 β€Ό

A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.

πŸ“– Read

via "National Vulnerability Database".
❌ MosaicLoader Malware Delivers Facebook Stealers, RATs ❌

The newly documented code is a full-service malware-delivery threat that's spreading indiscriminately globally through paid search ads.

πŸ“– Read

via "Threat Post".
🦿 Companies are losing the war against phishing as attacks increase in number and sophistication 🦿

A new report finds that 74% of companies have been the victim of phishing in the last year. Staff shortages, a lack of security training and an increase in mobile device usage for work are factors.

πŸ“– Read

via "Tech Republic".
❌ A New Security Paradigm: External Attack Surface Management ❌

Advanced EASM solutions are crucial to automating the discovery of the downstream third-party (or fourth-party, or fifth-party, etc.) IT infrastructures that your organization is exposed to, and may be vulnerable to attack, posing a critical risk for your organization.

πŸ“– Read

via "Threat Post".
❌ 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines ❌

The bug could allow cyberattackers to bypass security products, tamper with data and run code in kernel mode.

πŸ“– Read

via "Threat Post".
❌ Why Your Business Needs a Long-Term Remote Security Strategy ❌

Chris Hass, director of information security and research at Automox, discusses the future of work: A hybrid home/office model that will demand new security approaches.

πŸ“– Read

via "Threat Post".
⚠ Apple iPhone patches are out – no news if recent Wi-Fi bug is fixed ⚠

Remember that weird iPhone Wi-Fi bug from a week or so ago? Let's hope this update patches it!

πŸ“– Read

via "Naked Security".
β€Ό CVE-2020-15660 β€Ό

Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared request, lead to remote code execution.

πŸ“– Read

via "National Vulnerability Database".
🦿 Ransomware: International cooperation is needed to curb these cybersecurity threats, says expert 🦿

Ransomware knows no borders. An attorney with cybersecurity expertise suggests the only way to stop ransomware is for nations to create a global solution.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-32668 β€Ό

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.

πŸ“– Read

via "National Vulnerability Database".
❌ Law Firm to the Fortune 500 Breached with Ransomware ❌

Deep-pocketed clients' customers & suppliers could be in the attacker's net, with potential PII exposure from an A-list clientele such as Apple, Boeing and IBM.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-32767 β€Ό

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
🦿 Your iPhone and the Pegasus spyware hack: What you need to know 🦿

iPhones have been compromised by the NSO Group's Pegasus spyware. Should you be worried? That depends on who you ask.

πŸ“– Read

via "Tech Republic".
🦿 Top 5 things to know about supply chain attacks 🦿

Worried about supply chain attacks? Tom Merritt can help you understand your risk.

πŸ“– Read

via "Tech Republic".
❌ Researchers: NSO Group’s Pegasus Spyware Should Spark Bans, Apple Accountability ❌

Our roundtable of experts weighs in on implications for Apple and lawmakers in the wake of the bombshell report showing widespread surveillance of dissidents, journalists and others.

πŸ“– Read

via "Threat Post".
🦿 Top 5 things to know about supply chain attacks 🦿

Worried about supply chain attacks? Tom Merritt can help you understand your risk.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-25206 β€Ό

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.

πŸ“– Read

via "National Vulnerability Database".
🦿 Security experts: Consistency and security are key in creating vaccine passports 🦿

Countries and states have to agree on a consistent platform for vaccine passports in order to make them work effectively.

πŸ“– Read

via "Tech Republic".
🦿 Vaccine passports have to be consistent so that all countries can recognize them, expert says 🦿

This might create problems for those from poorer countries. Their countries may not have the resources to create vaccine passports that are readable everywhere.

πŸ“– Read

via "Tech Republic".