๐Ÿ›ก Cybersecurity & Privacy ๐Ÿ›ก - News
25.9K subscribers
89.2K links
๐Ÿ—ž The finest daily news on cybersecurity and privacy.

๐Ÿ”” Daily releases.

๐Ÿ’ป Is your online life secure?

๐Ÿ“ฉ lalilolalo.dev@gmail.com
Download Telegram
โ€ผ CVE-2021-21747 โ€ผ

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-3542 โ€ผ

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42739. Reason: This candidate is a reservation duplicate of CVE-2021-42739. Notes: All CVE users should reference CVE-2021-42739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-21746 โ€ผ

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ•ด Passwordless Is the Future โ€ฆ but What About the Present? ๐Ÿ•ด

Password managers, single sign-on, and multifactor authentication each offers its own methodology and unique set of benefits โ€” and drawbacks โ€” to users.

๐Ÿ“– Read

via "Dark Reading".
โŒ VPN Exposes Data for 1M Users, Leading to Researcher Questioning โŒ

Experts warn that virtual private networks are increasingly vulnerable to leaks and attack.

๐Ÿ“– Read

via "Threat Post".
โ€ผ CVE-2021-21749 โ€ผ

ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-21743 โ€ผ

ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header information through a specially crafted HTTP request.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-21744 โ€ผ

ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration parameters of the device, causing some security functions of the device to be disabled.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-21745 โ€ผ

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-21748 โ€ผ

ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary code.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ” Government Agencies Warn Against BlackMatter Ransomware ๐Ÿ”

CISA, the FBI, and NSA provided defenders with tips to protect networks and mitigations to prevent the spread of the ransomware.

๐Ÿ“– Read

via "".
โŒ Google Crushes YouTube Cookie-Stealing Channel Hijackers โŒ

Google has caught and brushed off a bunch of cookie-stealing YouTube channel hijackers who were running cryptocurrency scams on, or auctioning off, ripped-off channels. 

๐Ÿ“– Read

via "Threat Post".
๐Ÿ•ด Removing Friction for the Enterprise With Trusted Access ๐Ÿ•ด

Our work lives are supposed to be simpler and easier because of technology. At least thatโ€™s the promise.

๐Ÿ“– Read

via "Dark Reading".
โ€ผ CVE-2021-42762 โ€ผ

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-41167 โ€ผ

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-38896 โ€ผ

IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209566.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2021-41135 โ€ผ

The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includes a user-defined expiration time for when the authorization grant expires. In Grant.ValidateBasic(), that time is compared to the nodeรƒยขรขโ€šยฌรขโ€žยขs local clock time. Any chain running an affected version of the SDK with the authz module enabled could be halted by anyone with the ability to send transactions on that chain. Recovery would require applying the patch and rolling back the latest block. Users are advised to update to version 0.44.2.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ•ด Execs From Now-Defunct GigaTrust Arrested in $50M Fraud Scheme ๐Ÿ•ด

Email endpoint security-as-a-service company founder and two others indicted in an elaborate financial fraud scheme.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด MITRE Engenuity Announces ATT&CKยฎ Evaluations Call for Participation for Managed Services ๐Ÿ•ด

Offering to provide transparency into the capabilities of managed security service providers and and managed detection and response competencies.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด Google: Phishing Campaign Targets YouTube Creators ๐Ÿ•ด

The attackers behind the campaign, which distributes cookie theft malware, are attributed to actors recruited in a Russian-speaking forum.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด CISA Awards $2 Million to Bring Cybersecurity Training to Rural Communities and Diverse Populations ๐Ÿ•ด

Award recipients NPower and CyberWarrior recognized for development of cyber workforce training programs.

๐Ÿ“– Read

via "Dark Reading".