πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ—“οΈ Remote code execution, SQL injection bugs uncovered in Pentaho Business Analytics software πŸ—“οΈ

Penetration test reveals severe issues in Hitachi Vantara’s business solution

πŸ“– Read

via "The Daily Swig".
πŸ•΄ How to Avoid Another Let's Encrypt-Like Meltdown πŸ•΄

Experts weigh in on steps network and security administrators need to take before the next time a root certificate expires.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Appsian Security Announces Acquisition of Q Software, a Leader in JD Edwards Security and Compliance πŸ•΄

The acquisition provides customers of JD Edwards, along with Oracle EBS and Oracle Cloud, with expanded capabilities for data masking, threat detection and response, and real-time analytics across multiple ERP applications.

πŸ“– Read

via "Dark Reading".
❌ Critical Linux Kernel Bug Allows Remote Takeover ❌

The bug (CVE-2021-43267) exists in a TIPC message type that allows Linux nodes to send cryptographic keys to each other.

πŸ“– Read

via "Threat Post".
❌ Free Discord Nitro Offer Used to Steal Steam Credentials ❌

A fake Steam pop-up prompts users to β€˜link’ Discord account for free Nitro subs.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Majority of consumer IoT vendors still lack vulnerability disclosure programs – report πŸ—“οΈ

Dismal findings appear to vindicate global efforts to regulate the sector

πŸ“– Read

via "The Daily Swig".
πŸ—“οΈ US federal agencies ordered to patch hundreds of actively exploited vulnerabilities πŸ—“οΈ

CISA directive establishes tight patching deadlines

πŸ“– Read

via "The Daily Swig".
🦿 US government orders federal agencies to patch 100s of vulnerabilities 🦿

The Cybersecurity and Infrastructure Security Agency is maintaining a database of known security flaws with details on how and when federal agencies and departments should patch them.

πŸ“– Read

via "Tech Republic".
🦿 2022 will be the year of convergence between edge, IoT and networking tech, Forrester predicts 🦿

IoT tech will help reduce emissions, satellite internet will challenge 5G, the chip shortage will continue and more will happen in 2022 as pandemic recovery continues to move slowly forward.

πŸ“– Read

via "Tech Republic".
β™ŸοΈ β€˜Tis the Season for the Wayward Package Phish β™ŸοΈ

The holiday shopping season always means big business for phishers, who tend to find increased success this time of year with a time-honored lure about a wayward package that needs redelivery. Here's a look at a fairly elaborate SMS-based phishing scam that spoofs FedEx in a bid to extract personal and financial information from unwary recipients.

πŸ“– Read

via "Krebs on Security".
⚠ Facebook to throw out face recognition, delete all template data ⚠

Publicity stunt? Or privacy progress?

πŸ“– Read

via "Naked Security".
⚠ S3 Ep57: Europol v. Ransomware, Shrootless bug, and Linux browser flamewars [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
❌ US Blacklists Pegasus Spyware Maker ❌

NSO Group plans to fight the trade ban, saying it's "dismayed" and clinging to the mantra that its tools actually help to prevent terrorism and crime.

πŸ“– Read

via "Threat Post".
❌ 3 Guideposts for Building a Better Incident-Response Plan ❌

Invest and practice: Grant Oviatt, director of incident-response engagements at Red Canary, lays out the key building blocks for effective IR.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-40115 β€Ό

A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21687 β€Ό

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-34774 β€Ό

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to a specific API request. An attacker could exploit the vulnerability by sending a crafted HTTP request to the affected application. A successful exploit could allow the attacker to obtain sensitive information about the users of the application, including security questions and answers. To exploit this vulnerability an attacker would need valid Administrator credentials. Cisco expects to release software updates that address this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21688 β€Ό

The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21685 β€Ό

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-1500 β€Ό

A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to persuade users to unknowingly visit malicious sites.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-21689 β€Ό

FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

πŸ“– Read

via "National Vulnerability Database".