πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-44143 β€Ό

A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution.

πŸ“– Read

via "National Vulnerability Database".
🦿 GoDaddy security breach impacts more than 1 million WordPress users 🦿

The hosting company has revealed a security incident that exposed the email addresses and customer numbers of 1.2 million Managed WordPress customers.

πŸ“– Read

via "Tech Republic".
β™ŸοΈ Arrest in β€˜Ransom Your Employer’ Email Scheme β™ŸοΈ

In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employer's network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the scheme -- a young man who said he was trying to save up money to help fund a new social network.

πŸ“– Read

via "Krebs on Security".
❌ GoDaddy’s Latest Breach Affects 1.2M Customers ❌

The kingpin domain registrar has logged its fifth cyber-incident since 2018, after an attacker with a compromised password stole email addresses, SSH keys and database logins.

πŸ“– Read

via "Threat Post".
🦿 How to install and use InVID, a plugin to debunk fake news and verify videos and images 🦿

You can make sure you aren't seeing fake news, edited photos or deepfakes with this software. Here's how to install and use it.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Bug Bounties Surge as Firms Compete for Talent πŸ•΄

Companies such as GItLab, which today increased its payment for critical bugs by 75%, are raising bounties and bonuses to attract top-notch researchers.

πŸ“– Read

via "Dark Reading".
πŸ•΄ CISA Urges Critical Infrastructure to Be Alert for Holiday Threats πŸ•΄

CISA and the FBI share steps organizations should take to better protect against security threats during holidays and weekends.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-44147 β€Ό

An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel document and perform server-side request forgery attacks.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-44144 β€Ό

Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-44150 β€Ό

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32004 β€Ό

This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause browser cache poisoning.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ GoDaddy Breach Exposes SSL Keys of Managed WordPress Hosting Customers πŸ•΄

The incident, which affected 1.2 million users, raises concerns about domain impersonation attacks and other malicious activities.

πŸ“– Read

via "Dark Reading".
⚠ GoDaddy admits to password breach: check your Managed WordPress site! ⚠

GoDaddy found crooks in its network, and kicked them out - but not before they'd been in there for six weeks.

πŸ“– Read

via "Naked Security".
⚠ Black Friday and Cyber Monday – here’s what you REALLY need to do! ⚠

The world fills up with cybersecurity tips every year when Black Friday comes round. But what about the rest of the year?

πŸ“– Read

via "Naked Security".
β€Ό CVE-2021-40830 β€Ό

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the systemÒ€ℒs default trust-store. Attackers with access to a hostÒ€ℒs trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40828 β€Ό

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-22719 β€Ό

Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the table content text field.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40829 β€Ό

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40831 β€Ό

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been Ò€œoverriddenҀ�. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the systemÒ€ℒs default trust-store. Attackers with access to a hostÒ€ℒs trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ GoDaddy managed WordPress hosting service breach exposed 1.2m user profiles πŸ—“οΈ

External investigation finds breach dates back more than two months

πŸ“– Read

via "The Daily Swig".
⚠ Check your patches – public exploit now out for critical Exchange bug ⚠

It was a zero-day bug until Patch Tuesday, now there's an anyone-can-use-it exploit. Don't be the one who hasn't patched.

πŸ“– Read

via "Naked Security".