πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Dark Reading Video News Desk Comes to Black Hat Europe πŸ•΄

While attendees join Black Hat Europe 2021 virtually and live in London, we bring you prerecorded interviews from remote offices around the world.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Black Hat Europe: Laws and regulations need to change to secure world’s digital infrastructure πŸ—“οΈ

Better incentives to build secure products needed, former MEP tells conference

πŸ“– Read

via "The Daily Swig".
❌ New Android Spyware Poses Pegasus-Like Threat ❌

PhoneSpy already has stolen data and tracked the activity of targets in South Korea, disguising itself as legitimate lifestyle apps.

πŸ“– Read

via "Threat Post".
πŸ•΄ Researcher Details Vulnerabilities Found in AWS API Gateway πŸ•΄

AWS fixed the security flaws that left the API service at risk of so-called HTTP header-smuggling attacks, says the researcher who discovered them.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 4 Tips to Secure the OT Cybersecurity Budget You Require πŸ•΄

OT security engineers and personnel should approach senior management with an emphasis on risk reduction benefits and with a concrete plan to secure budget and funding before it's too late.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Securing the Public: Who Should Take Charge? πŸ•΄

International policy expert Marietke Schaake explores the intricacies of protecting the public as governments depend on private companies to build and secure digital infrastructure.

πŸ“– Read

via "Dark Reading".
🦿 How healthcare organizations and patients are increasingly at risk from cyber threats 🦿

A majority of IT pros working at hospitals who were surveyed by Armis said they've seen a rise in cyber risk over the past 12 months.

πŸ“– Read

via "Tech Republic".
πŸ•΄ CISA and State and Local Partners Test Emergency Response Plans at Chevron Salt Lake Refinery πŸ•΄

The exercise included several objectives related to response procedures at the refinery, including evacuation and shelter-in-place decision-making; roles and responsibilities during investigations; communication with first responders; and public messaging before and following an incident.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Smuggling hidden backdoors into JavaScript with homoglyphs and invisible Unicode characters πŸ—“οΈ

Researchers urge developers to secure code by disallowing non-ASCII characters

πŸ“– Read

via "The Daily Swig".
❌ Massive Zero Day Hole Found in Palo Alto Security Appliances ❌

Researchers have a working exploit for the vulnerability (now patched), which allows for unauthenticated RCE and affects an estimated 70,000+ VPN/firewalls.

πŸ“– Read

via "Threat Post".
⚠ Sophos 2022 Threat Report: Malware, Mobile, Machine learning and more! ⚠

The crooks have shown that they're willing to learn and adapt their attacks, so we need to make sure we learn and adapt, too.

πŸ“– Read

via "Naked Security".
β€Ό CVE-2021-42062 β€Ό

SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41426 β€Ό

Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40503 β€Ό

An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the userÒ€ℒs password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40502 β€Ό

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from B2B units they do not belong to.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41427 β€Ό

Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43561 β€Ό

An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-38887 β€Ό

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information from application response requests that could be used in further attacks against the system. IBM X-Force ID: 209401.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43564 β€Ό

An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43563 β€Ό

An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43562 β€Ό

An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.

πŸ“– Read

via "National Vulnerability Database".