πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-42055 β€Ό

ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-23449 β€Ό

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-29878 β€Ό

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Sinclair Broadcast Group Confirms Ransomware Attack πŸ•΄

The US television station operator has revealed certain servers and workstations, as well as office and operational networks, were disrupted in the attack.

πŸ“– Read

via "Dark Reading".
πŸ” DOJ Aims to Keep Companies Accountable with Cyber-Fraud Initiative πŸ”

Companies that fail to follow required cybersecurity standards could soon be a target under the DOJ's new Civil Cyber-Fraud Initiative.

πŸ“– Read

via "".
πŸ•΄ NSA, FBI, CISA Issue Advisory on 'BlackMatter' Ransomware πŸ•΄

Ransomware has become a "national security issue," NSA director said.

πŸ“– Read

via "Dark Reading".
❌ Sinclair Confirms Ransomware Attack That Disrupted TV Stations ❌

A major cyberattack resulted in data being stolen, too, but Sinclair's not sure which information is now in the hands of the crooks.

πŸ“– Read

via "Threat Post".
🦿 Gartner analyst: 12 technologies to accelerate growth, engineer trust and sculpt change in 2022 🦿

CIOs must prioritize the same business imperatives and find the IT force multipliers to enable growth and innovation, according to a Gartner analyst during Gartner's IT Symposium.

πŸ“– Read

via "Tech Republic".
❌ Podcast: Could the Zoho Flaw Trigger SolarWinds 2.0? ❌

Companies are worried that the highly privileged password app could let attackers deep inside an enterprise’s footprint, says Redscan’s George Glass.

πŸ“– Read

via "Threat Post".
🦿 How to deal with supply-chain disruptions: 5 tips 🦿

Tom Merritt gives us five ways to deal with the uncertainty of weather events and port issues.

πŸ“– Read

via "Tech Republic".
🦿 Top 5 tips for dealing with supply-chain disruptions 🦿

Weather events and port issues have caused major disruptions in the global supply chain. Tom Merritt gives us five ways to deal with it.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Loss Prevention Teams Up With Cybersecurity to Address Retail Fraud πŸ•΄

As retailers roll out more "buy online, pickup in-store" options, loss prevention professionals are increasingly shifting their attention from in-store theft to e-commerce fraud.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-41152 β€Ό

OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on the target system. The attack could be used to read any file accessible in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account or the enabled guest user feature together with the usage of the folder component in a course. The attack does not allow writing of arbitrary files, it allows only reading of files and also only ready of files that the attacker knows the exact path which is very unlikely at least for OpenOlat data files. The problem is fixed in version 15.5.8 and 16.0.1 It is advised to upgrade to version 16.0.x. There are no known workarounds to fix this problem, an upgrade is necessary.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41156 β€Ό

anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42650 β€Ό

Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41151 β€Ό

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41153 β€Ό

The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`. This is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Group With Potential Links to Iranian Threat Actor Resurfaces πŸ•΄

The Lyceum group has previously been linked to attacks on targets in the Middle East.

πŸ“– Read

via "Dark Reading".
πŸ•΄ FIDO Alliance Research Tracks Passwordless Authentication as It Moves Mainstream πŸ•΄

New Online Authentication Barometer from the FIDO Alliance reveals consumer habits, trends and adoption of authentication technologies.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-41155 β€Ό

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix: Tuleap Community Edition 11.17.99.146, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41154 β€Ό

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.

πŸ“– Read

via "National Vulnerability Database".