🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
CVE-2021-43245

Windows Digital TV Tuner Elevation of Privilege Vulnerability

📖 Read

via "National Vulnerability Database".
CVE-2021-43239

Windows Recovery Environment Agent Elevation of Privilege Vulnerability

📖 Read

via "National Vulnerability Database".
CVE-2021-43888

Microsoft Defender for IoT Information Disclosure Vulnerability

📖 Read

via "National Vulnerability Database".
🗓️ Propane distributor Superior Plus admits ransomware breach 🗓️

Clean up and damage assessment underway

📖 Read

via "The Daily Swig".
🕴 What Are the Pros and Cons of a SASE Architecture? 🕴

SASE is a promising and burgeoning networking architecture approach, but it's not without some challenges.

📖 Read

via "Dark Reading".
🕴 Privacy and Safety Issues With Facebook's New 'Metaventure' 🕴

With access to a user's 3D model and full-body digital tracking, attackers can recreate the perfect replica of a C-level executive to trick employees.

📖 Read

via "Dark Reading".
🔏 IP Theft: Definition and Examples 🔏

IP theft can have a long term damaging effects on a company. In this blog, we look at nearly 50 different examples of IP theft to help you better understand the threat.

📖 Read

via "".
CVE-2021-42216

A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.

📖 Read

via "National Vulnerability Database".
SAP Kicks Log4Shell Vulnerability Out of 20 Apps

SAP’s still feverishly working to patch another 12 apps vulnerable to the Log4Shell flaw, while its Patch Tuesday release includes 21 other fixes, some rated at 9.9 criticality.

📖 Read

via "Threat Post".
Malicious Exchange Server Module Hoovers Up Outlook Credentials

"Owowa" stealthily lurks on IIS servers, waiting to harvest successful logins when an Outlook Web Access (OWA) authentication request is made.

📖 Read

via "Threat Post".
🦿 Log4j: How to protect yourself from this security vulnerability 🦿

As cybercriminals scan for susceptible servers, there are steps you can take to mitigate the Log4j critical vulnerability.

📖 Read

via "Tech Republic".
🕴 Cybereason Announces Availability of AI-Driven Cybereason XDR and EDR on Google Cloud Marketplace 🕴

Cloud-native platform automates prevention, detection, and response to cyberattacks.

📖 Read

via "Dark Reading".
🕴 Kroll Acquires Security Compass Advisory 🕴

Combined capabilities will help clients address the growing complexity of securing public, private and hybrid cloud, 5G, IoT, and industrial control systems

📖 Read

via "Dark Reading".
🕴 Analysis: Log4j Vulnerability Highlights the Value of Defense-in-Depth, Accurate Inventory 🕴

The early lessons from Log4j indicate that key security principles can help better handle these high-risk software supply chain security incidents if teams have proper support.

📖 Read

via "Dark Reading".
🕴 Meta Expands Bug-Bounty Program to Include Data Scraping 🕴

Scraping bugs and scraped databases are two new areas of research for the company's bug-bounty and data-bounty programs.

📖 Read

via "Dark Reading".
🦿 Initial access brokers: How are IABs related to the rise in ransomware attacks? 🦿

Initial access brokers are cybercriminals who specialize in breaching companies and then selling the access to ransomware attackers. Learn how to protect your business from IABs.

📖 Read

via "Tech Republic".
CVE-2021-0970

In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196970023

📖 Read

via "National Vulnerability Database".
CVE-2021-0931

In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-180747689

📖 Read

via "National Vulnerability Database".
CVE-2021-1013

In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186404356

📖 Read

via "National Vulnerability Database".
CVE-2021-39652

In sec_ts_parsing_cmds of (TBD), there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-194499021References: N/A

📖 Read

via "National Vulnerability Database".
CVE-2021-39639

In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. This could lead to local escalation of privilege with physical access to device internals with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-198291476References: N/A

📖 Read

via "National Vulnerability Database".