🗓️ Privacy slalom: Human rights, media orgs offer OPSEC warning to Winter Olympics attendees 🗓️
📖 Read
via "The Daily Swig".
Behind the spectacle of Beijing 2022, visitors’ digital freedoms may be left out in the cold📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Privacy slalom: Human rights, media orgs offer OPSEC warning to Winter Olympics attendees
Behind the spectacle of Beijing 2022, visitors’ digital freedoms may be left out in the cold
‼ CVE-2020-28885 ‼
📖 Read
via "National Vulnerability Database".
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-28884 ‼
📖 Read
via "National Vulnerability Database".
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21720 ‼
📖 Read
via "National Vulnerability Database".
GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24071 ‼
📖 Read
via "National Vulnerability Database".
A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0394 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.📖 Read
via "National Vulnerability Database".
♟️ Who Wrote the ALPHV/BlackCat Ransomware Strain? ♟️
📖 Read
via "Krebs on Security".
In December 2021, researchers discovered a new ransomware-as-a-service named ALPHV (a.k.a. "BlackCat"), considered to be the first professional cybercrime group to create and use a ransomware strain in the Rust programming language. In this post, we'll explore some of the clues left behind by the developer who was reputedly hired to code the ransomware variant.📖 Read
via "Krebs on Security".
Krebs on Security
Who Wrote the ALPHV/BlackCat Ransomware Strain?
In December 2021, researchers discovered a new ransomware-as-a-service named ALPHV (a.k.a. "BlackCat"), considered to be the first professional cybercrime group to create and use a ransomware strain in the Rust programming language. In this post, we'll explore…
🗓️ Xerox belatedly addresses web-based printer bricking threat 🗓️
📖 Read
via "The Daily Swig".
Firmware flaw resolved after extended 28-month disclosure process📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Xerox belatedly addresses web-based printer bricking threat
Firmware flaw resolved after extended 28-month disclosure process
🕴 More Security Flaws Found in Apple's OS Technologies 🕴
📖 Read
via "Dark Reading".
Apple's updates this week included fixes for two zero-day flaws, several code execution bugs, and vulnerabilities that allowed attackers to bypass its core security protections.📖 Read
via "Dark Reading".
Dark Reading
More Security Flaws Found in Apple's OS Technologies
Apple's latest updates included fixes for two zero-day flaws, several code execution bugs, and vulnerabilities that allowed attackers to bypass its core security protections.
⚠ Apple fixes Safari data leak (and patches a zero-day!) – update now ⚠
📖 Read
via "Naked Security".
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ S3 Ep67: Tax scams, carder busts and crypto capers [Podcast + Transcript] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep67: Tax scams, carder busts and crypto capers [Podcast + Transcript]
Latest episode – listen now!
❌ Conti, DeadBolt Target Delta, QNAP ❌
📖 Read
via "Threat Post".
QNAP had to push out an unexpected (and not entirely welcome) NAS device update, and Delta Electronics' network has been crippled.📖 Read
via "Threat Post".
Threat Post
Conti, DeadBolt Ransomwares Target Delta, QNAP
QNAP had to push out an unexpected (and not entirely welcome) NAS device update, and Delta Electronics’ network has been crippled.
❌ Shlayer and Bundlore MacOS Malware Strains – How Uptycs EDR Detection Can Help ❌
📖 Read
via "Threat Post".
MacOS malware Shlayer and Bundlore may have variations, but the behavior of their attacks have not changed – attacking older macOS versions and poorly-protected websites.📖 Read
via "Threat Post".
Threat Post
Shlayer and Bundlore MacOS Malware Strains – How Uptycs EDR Detection Can Help
Ashwin Vamshi Adware strains Shlayer and Bundlore are the most common malware in macOS – although they have slight variations, they have long invaded and bypassed Xprotect, Notarization, Gatekeeper, and File Quarantine, all security features pre-built into…
‼ CVE-2021-42791 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.📖 Read
via "National Vulnerability Database".
🗓️ US government’s ‘zero trust’ roadmap calls time on perimeter-based paradigm 🗓️
📖 Read
via "The Daily Swig".
Federal agencies have a little over two years to fundamentally remodel cyber defenses📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
US government’s ‘zero trust’ roadmap calls time on perimeter-based paradigm
Federal agencies have a little over two years to fundamentally remodel cyber defenses
⚠ Happy Data Privacy Day – and we really do mean “happy” :-) ⚠
📖 Read
via "Naked Security".
We give you some simple digital lifesytle tips that cost nothing.📖 Read
via "Naked Security".
Naked Security
Happy Data Privacy Day – and we really do mean “happy” :-)
We give you some simple digital lifesytle tips that cost nothing.
❌ Zerodium Spikes Payout for Zero-Click Outlook Zero-Days ❌
📖 Read
via "Threat Post".
The sweetened deal came on the same day that Trustwave SpiderLabs published a new way to bypass Outlook security to deliver malicious links to victims.📖 Read
via "Threat Post".
Threat Post
Zerodium Spikes Payout for Zero-Click Outlook Zero-Days
The sweetened deal came on the same day that Trustwave SpiderLabs published a new way to bypass Outlook security to deliver malicious links to victims.
‼ CVE-2022-23098 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44249 ‼
📖 Read
via "National Vulnerability Database".
Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23863 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23097 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read.📖 Read
via "National Vulnerability Database".