πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ 20 Years of STRIDE: Looking Back, Looking Forward πŸ•΄

The invention of STRIDE was the key inflection point in the development of threat modeling from art to engineering practice.

πŸ“– Read

via "Dark Reading: ".
❌ Zero-Day Bug Lays Open TP-Link Smart Home Router ❌

However, an attacker would need to already be on the local network to be successful.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2017-18110

The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18109

The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18108

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18106

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18105

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.

πŸ“– Read

via "National Vulnerability Database".
❌ Magento Patches Critical SQL Injection and RCE Vulnerabilities ❌

Magento patched 37 flaws Thursday, including a stored cross-site scripting (XSS) vulnerability that could have let an attacker take over a site.

πŸ“– Read

via "Threatpost".
πŸ•΄ 7 Malware Families Ready to Ruin Your IoT's Day πŸ•΄

This latest list of Internet of Things miscreants doesn't limit itself to botnets, like Mirai.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Toyota Customer Information Exposed in Data Breach πŸ•΄

The attackers hit dealer sales systems in Japan, according to the automaker.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ NDSU Offers Nation's First Ph.D. in Cybersecurity Education πŸ•΄

The new program focuses on training university-level educators in cybersecurity.

πŸ“– Read

via "Dark Reading: ".
❌ Critical Bug in Cisco WebEx Browser Extensions Allows Remote Code-Execution ❌

Users of the conferencing platform should update immediately.

πŸ“– Read

via "Threatpost".
❌ Undocumented Intel VISA Tech Can Be Abused, Researchers Allege ❌

Researchers at Black Hat Asia said that Intel VISA, an undocumented testing tool, can be abused using previously-disclosed vulnerabilities.

πŸ“– Read

via "Threatpost".
πŸ” Use a password to secure access to an Excel workbook πŸ”

At the file level, you can password protect an Excel workbook in two ways: You can determine who can get in and who can save changes.

πŸ“– Read

via "Security on TechRepublic".
❌ Medical Weed Dispensary Exposes Health Data for Thousands ❌

As to how the breach happened, the company is so far keeping details tightly rolled up.

πŸ“– Read

via "Threatpost".
πŸ” Blockchain: Top 4 challenges CIOs face πŸ”

With hype around blockchain fading, organizations are starting to seek out use cases for the technology, according to Gartner.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2014-7198

OMERO before 5.0.6 has multiple CSRF vulnerabilities because the framework for OMERO's web interface lacks CSRF protection.

πŸ“– Read

via "National Vulnerability Database".
⚠ Monday review – the hot 21 stories of the week ⚠

From the Android bloatware selling your data to the hoards of security keys on GitHub, and everything in between. It's the weekly roundup.

πŸ“– Read

via "Naked Security".
⚠ Politicians mistakenly vote the wrong way in controversial internet law ⚠

Members of the European Parliament appear to have materially affected the future of the internet by mistakenly voting the wrong way.

πŸ“– Read

via "Naked Security".
⚠ Top-secret defense document hoarder Harold Martin pleads guilty ⚠

Martin admitted that for more than 20 years, he stole and a vast quantity of highly classified information, stashing it in his home and car.

πŸ“– Read

via "Naked Security".
⚠ Microsoft slaps down 99 APT35/Charming Kitten domains ⚠

Court order in hand, Microsoft seized control of the hacker group's (which it calls Phosphorous) phishing sites.

πŸ“– Read

via "Naked Security".