πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ“’ DDoS attacks are still a key weapon for corporate extortion πŸ“’

Ransomware isn’t the only rotten fruit, with DDoS attacks deployed both as an extra twist of the knife – and on their own

πŸ“– Read

via "ITPro".
πŸ“’ UK's first government cyber strategy aims to bolster public sector defences πŸ“’

The NCSC found that almost half of all cyber incidents recorded between 2020 and 2021 were aimed at the public sector

πŸ“– Read

via "ITPro".
πŸ“’ Microsoft warns of phishing campaign targeting OAuth tokens πŸ“’

The attack, which gives hackers persistent access to email accounts, has targeted hundreds of organizations

πŸ“– Read

via "ITPro".
πŸ“’ IT Pro Podcast: Learning to live with risk πŸ“’

Taking shortcuts is part of human nature, but it doesn’t have to be a threat to your business

πŸ“– Read

via "ITPro".
πŸ“’ Belarusian hacktivists target railway in bid to halt Russian military πŸ“’

The incident is thought to be one of the first times ransomware has been used in hacktivism

πŸ“– Read

via "ITPro".
❌ Apple Fixes 2 Zero-Day Security Bugs, One Exploited in the Wild ❌

iOS 15.3 & iPadOS 15.3 fix the Safari browser flaw that could have spilled users’ browsing data, plus a zero day IOMobileFrameBuffer bug exploited in the wild.

πŸ“– Read

via "Threat Post".
πŸ•΄ OMB Issues Zero-Trust Strategy for Federal Agencies πŸ•΄

Federal officials tout the strategy as a more proactive approach to securing government networks.

πŸ“– Read

via "Dark Reading".
❌ TrickBot Crashes Security Researchers’ Browsers in Latest Upgrade ❌

The malware has added an anti-debugging tool that crashes browser tabs when researchers use code beautifying for analysis.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-32849 β€Ό

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32840 β€Ό

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32841 β€Ό

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-23967 β€Ό

In TightVNC 1.3.10, there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbproto.c (for the vncviewer component). There is no check on the size given to malloc, e.g., -1 is accepted. This allocates a chunk of size zero, which will give a heap pointer. However, one can send 0xffffffff bytes of data, which can have a DoS impact or lead to remote code execution.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32842 β€Ό

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Millions of Routers, IoT Devices at Risk as Malware Source Code Surfaces on GitHub πŸ•΄

"BotenaGo" contains exploits for more than 30 vulnerabilities in multiple vendor products and is being used to spread Mirai botnet malware, security vendor says.

πŸ“– Read

via "Dark Reading".
πŸ•΄ ArmorCode Closes $11 Million Seed Funding Round πŸ•΄

Company will use new funds to extend its AppSecOps platform capabilities.

πŸ“– Read

via "Dark Reading".
πŸ•΄ IT Pros May Use Cloud, But They Trust On-Prem More πŸ•΄

While opinions about the trustworthiness of the cloud are split, everyone believes that's where hackers will focus their efforts.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-21722 β€Ό

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41166 β€Ό

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-21723 β€Ό

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-0370 β€Ό

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22828 β€Ό

An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.

πŸ“– Read

via "National Vulnerability Database".