πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-44150 β€Ό

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32004 β€Ό

This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows attacker to cause browser cache poisoning.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ GoDaddy Breach Exposes SSL Keys of Managed WordPress Hosting Customers πŸ•΄

The incident, which affected 1.2 million users, raises concerns about domain impersonation attacks and other malicious activities.

πŸ“– Read

via "Dark Reading".
⚠ GoDaddy admits to password breach: check your Managed WordPress site! ⚠

GoDaddy found crooks in its network, and kicked them out - but not before they'd been in there for six weeks.

πŸ“– Read

via "Naked Security".
⚠ Black Friday and Cyber Monday – here’s what you REALLY need to do! ⚠

The world fills up with cybersecurity tips every year when Black Friday comes round. But what about the rest of the year?

πŸ“– Read

via "Naked Security".
β€Ό CVE-2021-40830 β€Ό

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the systemÒ€ℒs default trust-store. Attackers with access to a hostÒ€ℒs trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40828 β€Ό

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-22719 β€Ό

Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the table content text field.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40829 β€Ό

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40831 β€Ό

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been Ò€œoverriddenҀ�. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the systemÒ€ℒs default trust-store. Attackers with access to a hostÒ€ℒs trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ GoDaddy managed WordPress hosting service breach exposed 1.2m user profiles πŸ—“οΈ

External investigation finds breach dates back more than two months

πŸ“– Read

via "The Daily Swig".
⚠ Check your patches – public exploit now out for critical Exchange bug ⚠

It was a zero-day bug until Patch Tuesday, now there's an anyone-can-use-it exploit. Don't be the one who hasn't patched.

πŸ“– Read

via "Naked Security".
🦿 US government warns of increased ransomware threats during Thanksgiving 🦿

Though the feds haven't identified any specific known threats, criminals are prone to strike when key employees are traveling or spending time with family and friends.

πŸ“– Read

via "Tech Republic".
🦿 If you're serious about privacy, it's time to use DuckDuckGo as your default Android browser 🦿

Third-party app trackers have become a real problem on Android, and DuckDuckGo is doing something about it. Find out why Jack Wallen believes this is the browser you need to use.

πŸ“– Read

via "Tech Republic".
πŸ•΄ How Sun Tzu's Wisdom Can Rewrite the Rules of Cybersecurity πŸ•΄

The ancient Chinese military strategist Sun Tzu would agree: The best defense is to avoid an attack in the first place.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Research has come a long way, but gaps remain – security researcher Artur Janc on the state of XS-Leaks πŸ—“οΈ

β€˜By focusing on XS-Leaks as a fundamental vulnerability class, we help raise their profile and make it easier for developers to understand their impact’

πŸ“– Read

via "The Daily Swig".
🦿 Dump Chrome as your default browser on Android 🦿

Jack Wallen tells us why Android users should switch from Chrome as their default browsers.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-37004 β€Ό

There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-37012 β€Ό

There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-37034 β€Ό

There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-22410 β€Ό

There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. A module of the client does not verify the input sufficiently. Attackers can exploit this vulnerability by modifying input after logging onto the client. This may compromise the normal service of the client.

πŸ“– Read

via "National Vulnerability Database".