πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-44022 β€Ό

A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading to a denial-of-service (DoS). Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-44019 β€Ό

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar to but not identical to CVE-2021-44020 and 44021.

πŸ“– Read

via "National Vulnerability Database".
🦿 How to avoid being a hacker's next target: Don't overshare information on business social media 🦿

When using LinkedIn and other social media accounts for professional reasons, there are important factors to consider about securing your personal data. Learn how to protect yourself from a hacker.

πŸ“– Read

via "Tech Republic".
πŸ” Friday Five 12/2 πŸ”

$31 in digital coin stolen, an insider extortion attack, and a new cybersecurity resource for healthcare workers - catch up on the infosec news of the week with the Friday Five!

πŸ“– Read

via "".
πŸ—“οΈ US identity thieves jailed over $130,000 scam that targeted the elderly πŸ—“οΈ

Dark web fraudsters caught after stealing the identities of murder victims

πŸ“– Read

via "The Daily Swig".
πŸ•΄ An Insider's Account of Disclosing Vulnerabilities πŸ•΄

Vendors drag their heels when it comes to identifying software vulnerabilities and are often loath to expedite the fixes.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-44278 β€Ό

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43676 β€Ό

matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-43674 β€Ό

** UNSUPPORTED WHEN ASSIGNED ** ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Pip-audit: Google-backed tool probes Python environments for vulnerable packages πŸ—“οΈ

β€˜Good initial results’, says one early adopter

πŸ“– Read

via "The Daily Swig".
πŸ•΄ USB Devices the Common Denominator in All Attacks on Air-Gapped Systems πŸ•΄

A new study of 17 malware frameworks shows threat actors always use USB drives to sneak malware into air-gapped environments and then steal data from there.

πŸ“– Read

via "Dark Reading".
⚠ IoT devices must β€œprotect consumers from cyberharm”, says UK government ⚠

"Must be at least THIS tall to go on ride" seems to be the starting point. Too little, too late? Or better than nothing?

πŸ“– Read

via "Naked Security".
⚠ S3 Ep61: Call scammers, cloud insecurity, and facial recognition creepiness [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
β€Ό CVE-2021-43991 β€Ό

The Kentico Xperience CMS version 13.0 Γ’β‚¬β€œ 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-3980 β€Ό

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

πŸ“– Read

via "National Vulnerability Database".
❌ What Are Your Top Cloud Security Challenges? Threatpost Poll ❌

We want to know what your biggest cloud security concerns and challenges are, and how your company is dealing with them. Weigh in with our exclusive poll!

πŸ“– Read

via "Threat Post".
⚠ Mozilla patches critical β€œBigSig” cryptographic bug: Here’s how to track it down and fix it ⚠

Mozilla's cryptographic code had a critical bug. Problem is that numerous apps are affected and may need patching individually.

πŸ“– Read

via "Naked Security".
🦿 How well do you know your APIs? Not well enough, says Cisco 🦿

Many APIs are openly accessible online, and that means big chunks of your apps are, too. Cisco's Vijoy Pandey has tools and tips to help businesses get visibility into their APIs.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Logiq.ai Tackles Observability Problem With LogFlow πŸ•΄

LogFlow addresses data risks associated with machine data pipelines.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-29756 β€Ό

IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202167.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-29867 β€Ό

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212.

πŸ“– Read

via "National Vulnerability Database".