πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-4082 β€Ό

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

πŸ“– Read

via "National Vulnerability Database".
❌ β€˜Karakurt’ Extortion Threat Emerges, But Says No to Ransomware ❌

The threat group, first identified in June, focuses solely on data exfiltration and subsequent extortion, and has already targeted 40 victims since September.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ β€˜Log4Shell’ vulnerability poses critical threat to applications using β€˜ubiquitous’ Java logging package Apache Log4j πŸ—“οΈ

Wide range of enterprise software impacted by CVSS 10-rated bug

πŸ“– Read

via "The Daily Swig".
πŸ•΄ The Vulnerability Lag: Cut Ransomware Risks Resulting From Digital Transformation πŸ•΄

Exploring ransomware and other data integrity risks from accelerated digital transformation in the wake of COVID-19.

πŸ“– Read

via "Dark Reading".
πŸ›  nfstream 6.4.0 πŸ› 

nfstream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments.

πŸ“– Read

via "Packet Storm Security".
β€Ό CVE-2021-37187 β€Ό

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-37188 β€Ό

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not verify that it is authentic), changing the behavior of the gateway.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40834 β€Ό

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAFE browser goes into full screen and hides the user interface. A remote attacker can leverage this to perform spoofing attack.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-37189 β€Ό

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-35978 β€Ό

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker (with knowledge of the protocol) to execute arbitrary code on the controller including overwriting firmware, adding/removing users, disabling the internal firewall, etc.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Russian man sentenced to prison for β€˜crypting’ service that concealed malware from antivirus programs πŸ—“οΈ

Underground service promised to render malicious software fully undetectable by nearly every major antivirus provider

πŸ“– Read

via "The Daily Swig".
❌ Sprawling Active Attack Aims to Take Over 1.6M WordPress Sites ❌

Cyberattackers are targeting security vulnerabilities in four plugins plus Epsilon themes, to assign themselves administrative accounts.

πŸ“– Read

via "Threat Post".
⚠ β€œLog4Shell” Java vulnerability – how to safeguard your servers ⚠

Just when you thought it was safe to relax for the weekend... a critical bug showed up in Apache's Log4j product

πŸ“– Read

via "Naked Security".
πŸ•΄ Dark Reading Reflects on a Legacy and Life Well-Written: Tim Wilson πŸ•΄

The Dark Reading editorial team, along with contributing writers and editors, share their favorite stories and memories of co-founder and editor-in-chief Tim Wilson, an influential editor and well-respected thought leader in the cybersecurity industry.

πŸ“– Read

via "Dark Reading".
πŸ” Friday Five 12/10 πŸ”

Five things CIOs want from their CEOs, Google and Microsoft crack down on hackers, and how to prepare for forthcoming privacy laws - catch up on the infosec news of the week with the Friday Five!

πŸ“– Read

via "".
β€Ό CVE-2021-3829 β€Ό

openwhyd is vulnerable to URL Redirection to Untrusted Site

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Identity Authentication Access Market Set to Hit $28.9B in 2021 πŸ•΄

With more staff working remotely, identity, authentication, and access (IAA) has never been more important. Market forecasts, drivers and trends are explored.

πŸ“– Read

via "Dark Reading".
❌ Zero Day in Ubiquitous Apache Log4j Tool Under Active Attack ❌

The Log4Shell vulnerability critically threatens anybody using the popular open-source Apache Struts framework and could lead to a β€œMini internet meltdown soonish.”

πŸ“– Read

via "Threat Post".
❌ β€˜Appalling’ Riot Games Job Fraud Takes Aim at Wallets ❌

Scammers are using fake job listings to empty the wallets of young, hopeful victims looking to break into the gaming industry.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-38917 β€Ό

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory through a series of carefully crafted service procedures. IBM X-Force ID: 210018.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-31745 β€Ό

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation attempts such as resetting their password.

πŸ“– Read

via "National Vulnerability Database".