🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
‼ CVE-2021-46171 ‼

Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-46170 ‼

An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string in js-lexer.c file.

📖 Read

via "National Vulnerability Database".
📢 Microsoft takes aim at critical RCE flaws with "massive" Patch Tuesday update 📢

Microsoft has kicked off 2022 with a score of security fixes for critical-rated vulnerabilities in some of the most widely used products used by businesses around the world

📖 Read

via "ITPro".
📢 Cyber attacks on corporate networks increased 50% in 2021 📢

Check Point data reveals an upward trend of malicious activity since mid-2020

📖 Read

via "ITPro".
📢 Google Drive accounted for the most malware downloads in 2021 📢

NetSkope research malware downloaded via cloud apps is now more prevalent than web-delivered malware

📖 Read

via "ITPro".
📢 QNAP warns of ransomware targeting internet-facing NAS products 📢

The manufacturer has provided a guide to securing vulnerable products amid ongoing attacks

📖 Read

via "ITPro".
📢 Open source in open rebellion - can Google bring peace to the developer community? 📢

A recent White House gathering exposes divisions between the open source community and the private companies that exploit it

📖 Read

via "ITPro".
📢 US gov issues fresh warning over Russian threat to critical infrastructure 📢

The FBI, NSA and CISA have urged network defenders to be on "heightened alert" for Russian cyber attacks

📖 Read

via "ITPro".
📢 NetUSB flaw exposes millions of routers to remote code execution 📢

The vulnerability impacts devices from Netgear, TP-Link, D-Link, and Western Digital

📖 Read

via "ITPro".
📢 Five giveaways that show an email is a phishing attack 📢

One of the biggest problems in cyber security is the phishing email

📖 Read

via "ITPro".
📢 Ransomware is being rewritten in Go for joint attacks on Windows, Linux users 📢

The Google-created programming language has become increasingly popular in the malware community for its speed and effectiveness in targeting more users with the same code base

📖 Read

via "ITPro".
📢 Ukraine government and embassies hit by "massive" cyber attacks 📢

Russia is said to be most-likely behind the attacks as tensions between the two countries increases

📖 Read

via "ITPro".
📢 How to build a zero trust model 📢

Threats are becoming greater and more diverse, but having a zero trust architecture could help your business defend its infrastructure

📖 Read

via "ITPro".
📢 Nearly half of all Log4j downloads remain critically vulnerable 📢

The findings come as the US threatens legal action against those who fail to patch to the latest versions of the popular Java library

📖 Read

via "ITPro".
📢 El Salvador becomes latest target of Pegasus spyware 📢

The list of nations with access to Pegasus is growing, with evidence pointing to potential links between 35 confirmed Pegasus cases and the Salvadoran government

📖 Read

via "ITPro".
‼ CVE-2022-23094 ‼

Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-24044 ‼

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-44049 ‼

CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.

📖 Read

via "National Vulnerability Database".
‼ CVE-2022-23178 ‼

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.

📖 Read

via "National Vulnerability Database".
‼ CVE-2022-23095 ‼

Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption. An attacker can leverage this vulnerability to execute code in the context of the current process.

📖 Read

via "National Vulnerability Database".
‼ CVE-2021-33828 ‼

The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be deleted upon detection.

📖 Read

via "National Vulnerability Database".