πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-43944 β€Ό

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Breaking the Bias for International Women’s Day 2022 πŸ•΄

The theme of International Women’s Day 2022 is β€œBreak the bias." This is what #BreaktheBias means to me.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 8 More Women in Security You May Not Know But Should πŸ•΄

Dark Reading highlights women who are quietly changing the game in cybersecurity. We also revisit some of those we've spoken to in the past to see what they're up to now.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Concerns raised over bug disclosure program aimed at tackling Russia’s β€˜propaganda machine’ πŸ—“οΈ

Some cybersecurity professionals express unease about β€˜red team’ VDP launched alongside defense-focused program

πŸ“– Read

via "The Daily Swig".
πŸ—“οΈ SQL injection vulnerability in e-learning platform Moodle could enable database takeover πŸ—“οΈ

Security flaw could risk data leak

πŸ“– Read

via "The Daily Swig".
❌ Bug in the Linux Kernel Allows Privilege Escalation, Container Escape ❌

A missing check allows unprivileged attackers to escape containers and execute arbitrary commands in the kernel.

πŸ“– Read

via "Threat Post".
πŸ•΄ 7 Essentials for More Security-Aware Design Automation πŸ•΄

Electronic design automation solutions, software programs that help designers develop electronic systems and semiconductor chips, can be used in service of security assurance.

πŸ“– Read

via "Dark Reading".
❌ Zero-Click Flaws in Widely Used UPS Devices Threaten Critical Infratructure ❌

The 'TLStorm' vulnerabilities, found in APC Smart-UPS products, could allow attackers to cause both cyber and physical damage by taking down critical infrastructure.

πŸ“– Read

via "Threat Post".
πŸ›  Samhain File Integrity Checker 4.4.7 πŸ› 

Samhain is a file system integrity checker that can be used as a client/server application for centralized monitoring of networked hosts. Databases and configuration files can be stored on the server. Databases, logs, and config files can be signed for tamper resistance. In addition to forwarding reports to the log server via authenticated TCP/IP connections, several other logging facilities (e-mail, console, and syslog) are available. Tested on Linux, AIX, HP-UX, Unixware, Sun and Solaris.

πŸ“– Read

via "Packet Storm Security".
β€Ό CVE-2022-0877 β€Ό

Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.

πŸ“– Read

via "National Vulnerability Database".
❌ The Uncertain Future of IT Automation ❌

While IT automation is growing, big challenges remain. Chris Hass, director of information security and research at Automox, discusses how the future looks.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Aspiring women in infosec need role models and collective strength, industry panel hears πŸ—“οΈ

Another panelist urged young security pros to consider starting out as generalists before specializing

πŸ“– Read

via "The Daily Swig".
πŸ—“οΈ Electronics retailer Adafruit apologises after training data containing real customer info leaks onto GitHub πŸ—“οΈ

IoT hardware vendor promises to tighten up procedures

πŸ“– Read

via "The Daily Swig".
⚠ Adafruit suffers GitHub data breach – don’t let this happen to you ⚠

Training data stashed in GitHub by mistake... unfortunately, it was *real* data

πŸ“– Read

via "Naked Security".
⚠ β€œDirty Pipe” Linux kernel bug lets anyone to write to any file ⚠

Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

πŸ“– Read

via "Naked Security".
πŸ•΄ Google to Buy Mandiant, Aims to Automate Security Response πŸ•΄

In a deal worth $5.4 billion, Google would expand its security portfolio with managed detection and response (MDR) and threat intelligence, with an increasing focus on automation.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Dark Reading Reflects on Breaking the Bias for International Women's Day πŸ•΄

A look at how far the information security industry has come - and how far it still has to go.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-41239 β€Ό

Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41181 β€Ό

Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41180 β€Ό

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Improve security and compliance πŸ“’

Adopting an effective security and compliance risk management approach

πŸ“– Read

via "ITPro".