πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-34657 β€Ό

The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-22933 β€Ό

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-34658 β€Ό

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-0114 β€Ό

Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of privilege via local access.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-34656 β€Ό

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-34666 β€Ό

The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32827 β€Ό

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-37708 β€Ό

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21859 β€Ό

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The stri_box_read function is used when processing atoms using the 'stri' FOURCC code. An attacker can convince a user to open a video to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21860 β€Ό

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an improper memory allocation resulting in a heap-based buffer overflow that causes memory corruption. The FOURCC code, 'trik', is parsed by the function within the library. An attacker can convince a user to open a video to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-38608 β€Ό

Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32826 β€Ό

Proxyee-Down is open source proxy software. An attacker being able to provide an extension script (eg: through a MiTM attack or by hosting a malicious extension) may be able to run arbitrary commands on the system running Proxyee-Down. For more details including a PoC see the referenced GHSL-2021-053. As of the writing of this CVE there is currently no patched version.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21861 β€Ό

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. When processing the 'hdlr' FOURCC code, a specially crafted MPEG-4 input can cause an improper memory allocation resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
❌ How to Reduce Exchange Server Downtime in Case of a Disaster? ❌

Exchange downtime can have serious implications on businesses. Thus, it’s important to maintain backups and implement best practices for Exchange servers that can help restore the Exchange server when a disaster strikes with minimal impact and downtime.

πŸ“– Read

via "Threat Post".
❌ Apple: CSAM Image-Detection Backdoor β€˜Narrow’ in Scope ❌

Computing giant tries to reassure users that the tool won’t be used for mass surveillance.

πŸ“– Read

via "Threat Post".
❌ Terrorist Watchlist Exposed Online with Nearly 1.9M Records ❌

A researcher discovered a data cache from the FBI’s Terrorist Screening Center left online without a password or authentication requirement.

πŸ“– Read

via "Threat Post".
πŸ›  TOR Virtual Network Tunneling Tool 0.4.6.7 πŸ› 

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

πŸ“– Read

via "Packet Storm Security".
🦿 Top 5 tech annoyances 🦿

Tom Merritt tells us his top five annoyances in tech and why they are frustrating.

πŸ“– Read

via "Tech Republic".
🦿 The 5 most annoying things in technology 🦿

These five things are driving us crazy, says Tom Merritt. There's hope for some to get better.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-4706 β€Ό

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 187194.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-25956 β€Ό

In Ò€œDolibarrҀ� application, v3.3.beta1_20121221 to v13.0.2 have Ò€œModifyҀ� access for admin level users to change other userÒ€ℒs details but fails to validate already existing Ò€œLoginҀ� name, while renaming the user Ò€œLoginҀ�. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.

πŸ“– Read

via "National Vulnerability Database".