πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Cybercriminals Love Supply-Chain Chaos: Here’s How to Protect Your Inbox ❌

Threat actors use bogus 'shipping delays' to deceive customers and businesses. Troy Gill, senior manager of threat intelligence at Zix, discusses how spoofing is evolving and what to do.

πŸ“– Read

via "Threat Post".
πŸ” Ransomware Groups Turning to Insiders to Help with Attacks πŸ”

A new survey suggests there's been an uptick in ransomware groups reaching out to employees in hopes they can help them carry out attacks against their company.

πŸ“– Read

via "".
❌ New Year, New Threats: 4 Tips to Activate Your Best Cyber-Defense ❌

Need a blueprint for architecting a formidable cyber-defense? Kerry Mandiant, senior director at Mandiant, shares hers in this detailed breakdown.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2022-23993 β€Ό

/usr/local/www/pkg.php in pfSense through 2.5.2 uses $_REQUEST['pkg_filter'] in a PHP echo call.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22850 β€Ό

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_types.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-21686 β€Ό

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-23990 β€Ό

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-46114 β€Ό

jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22852 β€Ό

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_list.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-46385 β€Ό

https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¢¢ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.

πŸ“– Read

via "National Vulnerability Database".
❌ β€˜Dark Herring’ Billing Malware Swims onto 105M Android Devices ❌

The mobile malware heisted hundreds of millions of dollars from unsuspecting users, thanks to 470 different well-crafted malicious app in Google Play.

πŸ“– Read

via "Threat Post".
πŸ“’ Dark Souls servers taken offline after RCE flaw identified πŸ“’

Experts say PowerShell scripts could have been launched on other players' machines as a result

πŸ“– Read

via "ITPro".
πŸ“’ DDoS attacks are still a key weapon for corporate extortion πŸ“’

Ransomware isn’t the only rotten fruit, with DDoS attacks deployed both as an extra twist of the knife – and on their own

πŸ“– Read

via "ITPro".
πŸ“’ UK's first government cyber strategy aims to bolster public sector defences πŸ“’

The NCSC found that almost half of all cyber incidents recorded between 2020 and 2021 were aimed at the public sector

πŸ“– Read

via "ITPro".
πŸ“’ Microsoft warns of phishing campaign targeting OAuth tokens πŸ“’

The attack, which gives hackers persistent access to email accounts, has targeted hundreds of organizations

πŸ“– Read

via "ITPro".
πŸ“’ IT Pro Podcast: Learning to live with risk πŸ“’

Taking shortcuts is part of human nature, but it doesn’t have to be a threat to your business

πŸ“– Read

via "ITPro".
πŸ“’ Belarusian hacktivists target railway in bid to halt Russian military πŸ“’

The incident is thought to be one of the first times ransomware has been used in hacktivism

πŸ“– Read

via "ITPro".
❌ Apple Fixes 2 Zero-Day Security Bugs, One Exploited in the Wild ❌

iOS 15.3 & iPadOS 15.3 fix the Safari browser flaw that could have spilled users’ browsing data, plus a zero day IOMobileFrameBuffer bug exploited in the wild.

πŸ“– Read

via "Threat Post".
πŸ•΄ OMB Issues Zero-Trust Strategy for Federal Agencies πŸ•΄

Federal officials tout the strategy as a more proactive approach to securing government networks.

πŸ“– Read

via "Dark Reading".
❌ TrickBot Crashes Security Researchers’ Browsers in Latest Upgrade ❌

The malware has added an anti-debugging tool that crashes browser tabs when researchers use code beautifying for analysis.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-32849 β€Ό

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".