πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2018-12395

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12393

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12392

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12391

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12390

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12389

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-12388

Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Solving Security: Repetition or Redundancy? πŸ•΄

To effectively defend against today's risks and threats, organizations must examine their failings as well as their successes.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Turkish Group Using Phishing Emails to Hijack Popular Instagram Profiles πŸ•΄

In some cases, attackers have demanded ransom, nude photos/videos of victims in exchange for stolen account, Trend Micro says.

πŸ“– Read

via "Dark Reading: ".
⚠ The β€œMomo challenge” – why it’s time to stop the hype [VIDEO] ⚠

What's the real deal with the "Momo challenge"?

πŸ“– Read

via "Naked Security".
πŸ” Using your Office 365 Secure Score πŸ”

Office 365, Microsoft 365 and the Security Graph are coming together at last.

πŸ“– Read

via "Security on TechRepublic".
⚠ Dow Jones Watchlist of risky businesses exposed on public server ⚠

A company with access to the Dow Jones Watchlist of risky people and businesses left it on a public AWS server without a password.

πŸ“– Read

via "Naked Security".
⚠ Disgruntled dev blames crypto-wallet for losing cryptocoins ⚠

Warith Al Maawali is blaming wallet vendor Coinomi for the loss of $65,000 in bitcoin. Coinomi countered by blaming him for blackmail.

πŸ“– Read

via "Naked Security".
⚠ For sale: iPhone hacking tool, one previous (not very careful) owner ⚠

At $100, the old-gen iPhone encryption-cracking tools are a bargain to hackers looking to pick up leftover forensics or police Wi-Fi data.

πŸ“– Read

via "Naked Security".
⚠ Data-tracking Chrome flaw triggered by viewing PDFs ⚠

Researchers have spotted an unusual β€˜trackware’ attack triggered by a viewing a PDF inside the Chrome browser.

πŸ“– Read

via "Naked Security".
πŸ•΄ Encryption Offers Safe Haven for Criminals and Malware πŸ•΄

The same encryption that secures private enterprise data also provides security to malware authors and criminal networks.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Security Pros Agree: Cloud Adoption Outpaces Security πŸ•΄

Oftentimes, responsibility for securing the cloud falls to IT instead of the security organization, researchers report.

πŸ“– Read

via "Dark Reading: ".
πŸ” Your systems, their profit: How IT rights can be abused for shadow mining of cryptocurrency πŸ”

IT professionals have the know-how and requisite privileges to deploy Bitcoin miners, and to cover their tracks. Could your organization be at risk?

πŸ“– Read

via "Security on TechRepublic".
πŸ” Why ransomware attacks are growing more targeted πŸ”

Ransomware attacks in 2018 used Remote Desktop Protocol (RDP) as a main attack vector, according to a Webroot report.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Security Experts, Not Users, Are the Weakest Link πŸ•΄

CISOs: Stop abdicating responsibility for problems with users - it's part of your job.

πŸ“– Read

via "Dark Reading: ".