πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ How Ready Are You for a Ransomware Attack? ❌

Oliver Tavakoli, CTO at Vectra, lays out the different layers of ransomware defense all companies should implement.

πŸ“– Read

via "Threat Post".
❌ What’s Next for T-Mobile and Its Customers? – Podcast ❌

Hopefully not a hacked-up hairball of a β€œno can do” message when customers rush to change their PINs. In this episode: Corporate resilience vs. the opposite.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-18900 β€Ό

A heap-based buffer overflow in the libexe_io_handle_read_coff_optional_header function of libyal libexe before 20181128 allows attackers to execute arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18897 β€Ό

An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows attackers to cause a denial of service (DOS) or execute arbitrary code via a crafted pff file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18899 β€Ό

An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18898 β€Ό

A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.

πŸ“– Read

via "National Vulnerability Database".
🦿 How to protect your T-Mobile account in light of the latest data breach 🦿

In response to a breach that compromised the personal data of millions of subscribers, T-Mobile customers should change their password and PIN and set up two-step verification.

πŸ“– Read

via "Tech Republic".
❌ Nigerian Threat Actors Solicits Employees to Deploy Ransomware for Cut of Profits ❌

Campaign emails company insiders and initially offers 1 million in Bitcoin if they install DemonWare on an organization’s network.

πŸ“– Read

via "Threat Post".
πŸ›  OpenSSH 8.7p1 πŸ› 

This is a Linux/portable port of OpenBSD's excellent OpenSSH. OpenSSH is based on the last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms removed, all known security bugs fixed, new features reintroduced, and many other clean-ups.

πŸ“– Read

via "Packet Storm Security".
🦿 It's time to retire the Social Security number 🦿

With 40 million people having their SSN exposed during the T-Mobile hack, it's time to reconsider the usefulness of the Social Security number.

πŸ“– Read

via "Tech Republic".
🦿 Great Resignation hits IT departments and companies are switching strategies 🦿

To ensure business continuity amid high turnover, many CIOs are planning to alter their strategies to make the company "less dependent on employee institutional knowledge," says PwC.

πŸ“– Read

via "Tech Republic".
⚠ Japanese cryptocoin exchange robbed of $100,000,000 ⚠

Another week, another cryptocurrency catastrophe. This time, it's "only" $100 million's worth...

πŸ“– Read

via "Naked Security".
⚠ S3 Ep46: Copyright scams, video snooping and Grand Theft Crypto [Podcast] ⚠

Lastest episode - listen, laugh and learn! This week, Chester Wisniewski joins us on the show.

πŸ“– Read

via "Naked Security".
β€Ό CVE-2020-36474 β€Ό

SafeCurl before 0.9.2 has a DNS rebinding vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18886 β€Ό

Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18879 β€Ό

Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18885 β€Ό

Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-18877 β€Ό

SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Friday Five 8/20 πŸ”

Exposed web cams, mistakes made when hiring cybersecurity roles, and a $1 million breach settlement - catch up on the week's infosec news with the Friday Five!

πŸ“– Read

via "".
β€Ό CVE-2021-34228 β€Ό

Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-34218 β€Ό

Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter.

πŸ“– Read

via "National Vulnerability Database".