πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-42377 β€Ό

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

πŸ“– Read

via "National Vulnerability Database".
⚠ Emotet malware: β€œThe report of my death was an exaggeration” ⚠

"Old malware rarely dies." The best way to predict the future is to look at the past... if it worked before, it will probably work again.

πŸ“– Read

via "Naked Security".
⚠ The self-driving smart suitcase… that the person behind you can hijack! ⚠

Apparently, we need a self-driving IoT Bluetooth robot suitcase. Who knew?

πŸ“– Read

via "Naked Security".
🦿 Your weak passwords can be cracked in less than a second 🦿

Easy-to-crack phrases "123456," "123456789," "12345," "qwerty" and "password" are the five most common passwords, says NordPass.

πŸ“– Read

via "Tech Republic".
🦿 How to protect your organization from ransomware attacks during the holiday season 🦿

A quarter of security pros polled by Cybereason said they lack a plan to deal with a ransomware attack during a weekend or holiday.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-42250 β€Ό

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40745 β€Ό

Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Is XDR Overhyped? πŸ•΄

Security experts weigh in on the value and pitfalls of extended detection and response (XDR), offering consideration and advice on this growing new category.

πŸ“– Read

via "Dark Reading".
❌ Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns ❌

Meanwhile, a Microsoft analysis that followed six Iranian threat actor groups for over a year found them increasingly sophisticated, adapting and thriving.

πŸ“– Read

via "Threat Post".
⚠ Apple’s Privacy Protection feature – watch out if you have a Watch! ⚠

Apple's "Protect Mail Activity" is a handy privacy enhancement for your messaging habits. As long as you know its limitations...

πŸ“– Read

via "Naked Security".
πŸ—“οΈ Secure development: New and improved Linux Random Number Generator ready for testing πŸ—“οΈ

Proposed replacement for /dev/random promises to double performance and add flexibility

πŸ“– Read

via "The Daily Swig".
🦿 How to beef up your multicloud security 🦿

A majority of IT leaders surveyed by Valtix said they realize their employees lack the necessary skills to manage multicloud security.

πŸ“– Read

via "Tech Republic".
πŸ•΄ 5 Things ML Teams Should Know About Privacy and the GDPR πŸ•΄

Machine learning delivers plenty of benefits. But as the emerging technology gets applied more broadly, be careful about how you handle all the data used in the process.

πŸ“– Read

via "Dark Reading".
🦿 5 predictions to help you focus your web app security resources in 2022 🦿

This is the year business leaders will learn just how innovative online criminals have become, and it'll take rethinking how we perceive account security to fight it, says PerimeterX CTO Ido Safruti.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-43976 β€Ό

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42362 β€Ό

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42360 β€Ό

On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-33480 β€Ό

An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-35528 β€Ό

Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing (CSB) allows an attacker to execute a modified signed Java Applet JAR file. A successful exploitation may lead to data extraction or modification of data inside the application. This issue affects: Hitachi Energy Retail Operations 5.7.3 and prior versions. Hitachi Energy Counterparty Settlement and Billing (CSB) 5.7.3 prior versions.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-33479 β€Ό

A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43977 β€Ό

SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.

πŸ“– Read

via "National Vulnerability Database".