🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
🕴 Follow the Leaders: A Blueprint for Software Security Success 🕴

Organizations can study software security leaders and emulate their habits and initiatives in order to build a successful software security program of their own.

📖 Read

via "Dark Reading".
‼ CVE-2021-41972 ‼

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.

📖 Read

via "National Vulnerability Database".
🕴 Open Source Project Aims to Detect Living-Off-the-Land Attacks 🕴

The machine learning classifier from Adobe can determine whether system commands are malicious and classify them using a variety of tags useful for security analysts.

📖 Read

via "Dark Reading".
🦿 Security researcher: Flaw in Apple Pay, Samsung Pay and Google Pay makes fraud easy for thieves 🦿

Positive Technologies expert describes vulnerability linked to apps used to pay for public transit tickets.

📖 Read

via "Tech Republic".
🦿 Save an extra 15% off training in ethical hacking with this pre-Black Friday sale deal 🦿

Develop the necessary skills and use the tools to be an ethical hacker through this 120-hour comprehensive course bundle.

📖 Read

via "Tech Republic".
🕴 BT to Deploy 'Epidemiological AI' Based on the Spread of Viruses in Humans to Combat Cyberattacks 🕴

Using the spread of viruses in human populations as a model to inform its AI, Inflame is a key component in BT’s recently-announced Eagle-i platform.

📖 Read

via "Dark Reading".
🕴 MSPAlliance Leadership Council Forms Vendor Council to Address Managed Services Supply Chain Risk 🕴

MSP supply chain threats will be mitigated through transparency, education, business continuity planning, and managed services channel certification.

📖 Read

via "Dark Reading".
🕴 Emerging Security Tools Tackle GraphQL Security 🕴

New security tools are proactively protecting APIs built with GraphQL, before attacks against them become more commonplace.

📖 Read

via "Dark Reading".
🕴 Ankura Launches Brooklyn Cyber Center 🕴

New initiative addresses shortage of professionals and lack of diversity in cybersecurity by recruiting, training and retaining diverse talent from underrepresented backgrounds.

📖 Read

via "Dark Reading".
‼ CVE-2021-3786 ‼

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-43610 ‼

Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3789 ‼

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-39303 ‼

The server in Jamf Pro before 10.32.0 has a vulnerability affecting integrity and availability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3788 ‼

An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3720 ‼

An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could allow other applications to access device GPS data.

📖 Read

via "National Vulnerability Database".
‼ CVE-2020-21141 ‼

iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3718 ‼

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3793 ‼

An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified firmware.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3791 ‼

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3577 ‼

An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-3843 ‼

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

📖 Read

via "National Vulnerability Database".