πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-24728 β€Ό

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Microsoft the No. 1 Most-Spoofed Brand in Phishing Attacks πŸ•΄

New Barracuda Networks data shows attackers sent some 3 million emails from around 12,000 pilfered accounts.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ What the Newly Signed US Cyber-Incident Law Means for Security πŸ•΄

Bipartisan cybersecurity legislation comes amid increased worries over ransomware, and fears of cyberattacks from Russia in the wake of its invasion of Ukraine.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-26295 β€Ό

A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-26293 β€Ό

Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/classes/Users.php.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ 4 Critical Capabilities for a SaaS Security Posture Management (SSPM) Solution πŸ•΄

The need for deep visibility and remediation for SaaS security settings is critical. If you're considering a SaaS Security Posture Management solution, here’s a checklist of what to look for.

πŸ“– Read

via "Dark Reading".
πŸ•΄ How Pen Testing Gains Critical Security Buy-in and Defense Insight πŸ•΄

It's more important than ever for companies to challenge their defenses, learning about new gaps and opportunities for improvement along the way.

πŸ“– Read

via "Dark Reading".
πŸ•΄ TAC Security Survey Reveals: 88% of Businesses Rely on Manual Processes to Identify Network Vulnerabilities πŸ•΄



πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-24075 β€Ό

Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24074 β€Ό

Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24073 β€Ό

The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24072 β€Ό

The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1000 β€Ό

Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-45791 β€Ό

Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/user_group.php, and /admin/modules/membership/index.php through the dir parameter. It can be used by remotely authenticated librarian users.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-45792 β€Ό

Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Enhancing DLP With Natural Language Understanding for Better Email Security πŸ•΄

Natural language understanding is well-suited for scanning enterprise email to detect and filter out spam and other malicious content. Armorblox introduces a data loss prevention service to its email security platform using NLU.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ β€˜Fox guarding the henhouse’ – Founder of cyber-fraud prevention company pleads guilty to defrauding investors πŸ—“οΈ

Adam Rogas has been charged with using fraudulent financial data to secure more than $100m in funding

πŸ“– Read

via "The Daily Swig".
πŸ“’ Germany advises against using Kaspersky software due to hacking risk πŸ“’

The Moscow-headquartered cyber security company has a history of being targeted for its alleged links to the Russian state

πŸ“– Read

via "ITPro".
πŸ“’ NortonLifeLock and Avast merger could reduce competition, CMA warns πŸ“’

The watchdog will launch a phase two investigation into the merger unless NortonLifeLock and Avast address its concerns within five days

πŸ“– Read

via "ITPro".
πŸ“’ NSW ditches e-voting system for 2023 election πŸ“’

The electoral commissioner has suggested there should be a review of internet voting following the problems with the system found last December

πŸ“– Read

via "ITPro".
⚠ CISA warning: β€œRussian actors bypassed 2FA” – what happened and how to avoid it ⚠

Don't leave old accounts lying around where someone sketchy could reactivate them.

πŸ“– Read

via "Naked Security".