πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ“’ Acer Taiwan falls victim to cyber attack πŸ“’

Hackers obtained employee data three days after they breached Acer India servers

πŸ“– Read

via "ITPro".
πŸ“’ The rise of cloud misconfiguration threats and how to avoid them πŸ“’

Businesses must adopt new tools and practices to combat one of the leading causes of security breaches

πŸ“– Read

via "ITPro".
πŸ“’ Marsh McLennan reveals its cyber risk analytics center πŸ“’

The center combines the expertise of Marsh, Guy Carpenter, Mercer, and Oliver Wyman

πŸ“– Read

via "ITPro".
🦿 Is your organization safe from a cybersecurity attack? 🦿

How is your company preventing the terror of a potential cybersecurity breach? Take this quick, multiple choice survey and tell us about it.

πŸ“– Read

via "Tech Republic".
❌ TikTok Serves Up Fresh Gamer Targets via Fake Among Us, Steam Offerings ❌

The tween-friendly video app is being used to serve up malvertising, disguised as free Steam game accounts or Among Us game hacks.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-36513 β€Ό

An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive information due to an uninitialized value.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42055 β€Ό

ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23449 β€Ό

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-29878 β€Ό

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Sinclair Broadcast Group Confirms Ransomware Attack πŸ•΄

The US television station operator has revealed certain servers and workstations, as well as office and operational networks, were disrupted in the attack.

πŸ“– Read

via "Dark Reading".
πŸ” DOJ Aims to Keep Companies Accountable with Cyber-Fraud Initiative πŸ”

Companies that fail to follow required cybersecurity standards could soon be a target under the DOJ's new Civil Cyber-Fraud Initiative.

πŸ“– Read

via "".
πŸ•΄ NSA, FBI, CISA Issue Advisory on 'BlackMatter' Ransomware πŸ•΄

Ransomware has become a "national security issue," NSA director said.

πŸ“– Read

via "Dark Reading".
❌ Sinclair Confirms Ransomware Attack That Disrupted TV Stations ❌

A major cyberattack resulted in data being stolen, too, but Sinclair's not sure which information is now in the hands of the crooks.

πŸ“– Read

via "Threat Post".
🦿 Gartner analyst: 12 technologies to accelerate growth, engineer trust and sculpt change in 2022 🦿

CIOs must prioritize the same business imperatives and find the IT force multipliers to enable growth and innovation, according to a Gartner analyst during Gartner's IT Symposium.

πŸ“– Read

via "Tech Republic".
❌ Podcast: Could the Zoho Flaw Trigger SolarWinds 2.0? ❌

Companies are worried that the highly privileged password app could let attackers deep inside an enterprise’s footprint, says Redscan’s George Glass.

πŸ“– Read

via "Threat Post".
🦿 How to deal with supply-chain disruptions: 5 tips 🦿

Tom Merritt gives us five ways to deal with the uncertainty of weather events and port issues.

πŸ“– Read

via "Tech Republic".
🦿 Top 5 tips for dealing with supply-chain disruptions 🦿

Weather events and port issues have caused major disruptions in the global supply chain. Tom Merritt gives us five ways to deal with it.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Loss Prevention Teams Up With Cybersecurity to Address Retail Fraud πŸ•΄

As retailers roll out more "buy online, pickup in-store" options, loss prevention professionals are increasingly shifting their attention from in-store theft to e-commerce fraud.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-41152 β€Ό

OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on the target system. The attack could be used to read any file accessible in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account or the enabled guest user feature together with the usage of the folder component in a course. The attack does not allow writing of arbitrary files, it allows only reading of files and also only ready of files that the attacker knows the exact path which is very unlikely at least for OpenOlat data files. The problem is fixed in version 15.5.8 and 16.0.1 It is advised to upgrade to version 16.0.x. There are no known workarounds to fix this problem, an upgrade is necessary.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41156 β€Ό

anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42650 β€Ό

Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.

πŸ“– Read

via "National Vulnerability Database".