πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-39391 β€Ό

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.

πŸ“– Read

via "National Vulnerability Database".
❌ 2021’s Most Dangerous Software Weaknesses ❌

Saryu Nayyar, CEO at Gurucul, peeks into Mitre's list of dangerous software bug types, highlighting that the oldies are still the goodies for attackers.

πŸ“– Read

via "Threat Post".
❌ Microsoft Patches Actively Exploited Windows Zero-Day Bug ❌

On Patch Tuesday, Microsoft fixed 66 CVEs, including an RCE bug in MSHTML under active attack as threat actors passed around guides for the drop-dead simple exploit.

πŸ“– Read

via "Threat Post".
β™ŸοΈ Microsoft Patch Tuesday, September 2021 Edition β™ŸοΈ

Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that's reportedly been abused to install spyware on iOS products, and Google's got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat, Reader and a slew of other software.

πŸ“– Read

via "Krebs on Security".
❌ Adobe Snuffs Critical Bugs in Acrobat, Experience Manager ❌

Adobe releases security updates for 59 bugs affecting its core products, including Adobe Acrobat Reader, XMP Toolkit SDK and Photoshop.

πŸ“– Read

via "Threat Post".
🦿 Dark Web sees spike in fake COVID vaccine card sales 🦿

Some people would rather pay money for a phony vaccine card than get the actual shot for free, according to Check Point Research.

πŸ“– Read

via "Tech Republic".
🦿 T-Mobile was breached: Here's how to protect your account 🦿

T-Mobile customers should change their password and PIN and set up two-step verification to protect their accounts.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-23025 β€Ό

On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23028 β€Ό

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23030 β€Ό

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x, when a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23027 β€Ό

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23029 β€Ό

On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23026 β€Ό

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Apple patches zero-day flaw abused by infamous NSO exploit πŸ“’

The ForcedEntry flaw affects all Apple devices and allows hackers to compromise systems without any user interaction

πŸ“– Read

via "ITPro".
πŸ“’ WhatsApp activates end-to-end encrypted cloud backups πŸ“’

The messaging service will grant users a password-protected key when they save their chat histories to the cloud

πŸ“– Read

via "ITPro".
πŸ“’ Dual citizen sentenced to 11 years for role in North Korean crypto hacking scheme πŸ“’

Ontario resident laundered cash for North Korea from bank heists and BEC scams

πŸ“– Read

via "ITPro".
πŸ“’ Olympus hit by suspected ransomware attack πŸ“’

The former digital camera specialist has shut down its networks in Europe, Africa and the Middle East while it investigates the incident

πŸ“– Read

via "ITPro".
πŸ“’ Irish data regulator fails to resolve 98% of big tech GDPR cases πŸ“’

Campaigners accuse the Irish DPC of being the β€˜bottleneck’ for GDPR enforcement with 160 unresolved complaints

πŸ“– Read

via "ITPro".
πŸ“’ Google handed user data to Hong Kong authorities despite pledge πŸ“’

The tech giant last year said it would suspend the processing of user data requests from the Hong Kong government after a law that criminalised protests was introduced

πŸ“– Read

via "ITPro".
πŸ“’ Medigate and CrowdStrike bolster IoT medical device security πŸ“’

CrowdStrike will integrate its Falcon software with Medigate’s device security platform

πŸ“– Read

via "ITPro".
πŸ“’ Hackers develop Linux port of Cobalt Strike for new attacks πŸ“’

The modified version of the penetration testing toolkit can evade malware detection

πŸ“– Read

via "ITPro".