πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ As drones fill the skies, cybercriminals won’t be far behind ⚠

Putting these toys back in the box after a decade of hype isn’t going to be easy, but these researchers are exploring the options.

πŸ“– Read

via "Naked Security".
πŸ” 90% of large tech companies vulnerable to email spoofing πŸ”

Most companies have not implemented standards for authenticating emails and preventing hackers from successful phishing attacks, according to Valimail.

πŸ“– Read

via "Security on TechRepublic".
❌ Critical Rockwell Automation Bug in Drive Component Puts IIoT Plants at Risk ❌

A critical Rockwell Automation flaw could be exploited to manipulate an industrial drive’s physical process and or even stop it.

πŸ“– Read

via "Threatpost".
πŸ•΄ 20 Years of STRIDE: Looking Back, Looking Forward πŸ•΄

The invention of STRIDE was the key inflection point in the development of threat modeling from art to engineering practice.

πŸ“– Read

via "Dark Reading: ".
❌ Zero-Day Bug Lays Open TP-Link Smart Home Router ❌

However, an attacker would need to already be on the local network to be successful.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2017-18110

The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18109

The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18108

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18106

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18105

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.

πŸ“– Read

via "National Vulnerability Database".
❌ Magento Patches Critical SQL Injection and RCE Vulnerabilities ❌

Magento patched 37 flaws Thursday, including a stored cross-site scripting (XSS) vulnerability that could have let an attacker take over a site.

πŸ“– Read

via "Threatpost".
πŸ•΄ 7 Malware Families Ready to Ruin Your IoT's Day πŸ•΄

This latest list of Internet of Things miscreants doesn't limit itself to botnets, like Mirai.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Toyota Customer Information Exposed in Data Breach πŸ•΄

The attackers hit dealer sales systems in Japan, according to the automaker.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ NDSU Offers Nation's First Ph.D. in Cybersecurity Education πŸ•΄

The new program focuses on training university-level educators in cybersecurity.

πŸ“– Read

via "Dark Reading: ".
❌ Critical Bug in Cisco WebEx Browser Extensions Allows Remote Code-Execution ❌

Users of the conferencing platform should update immediately.

πŸ“– Read

via "Threatpost".
❌ Undocumented Intel VISA Tech Can Be Abused, Researchers Allege ❌

Researchers at Black Hat Asia said that Intel VISA, an undocumented testing tool, can be abused using previously-disclosed vulnerabilities.

πŸ“– Read

via "Threatpost".
πŸ” Use a password to secure access to an Excel workbook πŸ”

At the file level, you can password protect an Excel workbook in two ways: You can determine who can get in and who can save changes.

πŸ“– Read

via "Security on TechRepublic".
❌ Medical Weed Dispensary Exposes Health Data for Thousands ❌

As to how the breach happened, the company is so far keeping details tightly rolled up.

πŸ“– Read

via "Threatpost".
πŸ” Blockchain: Top 4 challenges CIOs face πŸ”

With hype around blockchain fading, organizations are starting to seek out use cases for the technology, according to Gartner.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2014-7198

OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection.

πŸ“– Read

via "National Vulnerability Database".
⚠ Monday review – the hot 21 stories of the week ⚠

From the Android bloatware selling your data to the hoards of security keys on GitHub, and everything in between. It's the weekly roundup.

πŸ“– Read

via "Naked Security".