πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-27049 β€Ό

Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-27965 β€Ό

Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-27050 β€Ό

BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system level.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-27964 β€Ό

Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24798 β€Ό

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-27966 β€Ό

Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-24796 β€Ό

RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Breaking end-to-end encryption would do more harm than good, warn IT professionals πŸ“’

Two-thirds of IT specialists said restricting the use of this technology would have a negative impact on protecting society

πŸ“– Read

via "ITPro".
πŸ“’ Mobile security firm Zimperium to be acquired for $525 million πŸ“’

Texas-based Zimperium offers on-device mobile threat defense to protect against cyber attacks

πŸ“– Read

via "ITPro".
πŸ“’ Google patches second Chrome browser zero-day of 2022 πŸ“’

Google acted quickly to secure against the type confusion vulnerability that was under active exploitation

πŸ“– Read

via "ITPro".
πŸ“’ WatchGuard Firebox T40-W review: Powerful yet classy πŸ“’

A powerful desktop security appliance with classy remote monitoring and configuration services

πŸ“– Read

via "ITPro".
πŸ“’ Patch finally released for Spring4Shell zero-day after vulnerable businesses put on high alert πŸ“’

With proof-of-concept code out in the wild, businesses are encouraged to assess their exposure to what's being dubbed 'Log4Shell 2.0'

πŸ“– Read

via "ITPro".
πŸ“’ NCSC warns businesses against using Kaspersky products πŸ“’

Critical infrastructure companies, as well as organisations aiding Ukraine or criticising the Russian government, are at the highest risk of being compromised

πŸ“– Read

via "ITPro".
πŸ“’ Leaked report on Okta breach reveals finer details of LAPSUS$ operation πŸ“’

Poor OPSEC and publicly available hacking tools allowed the hackers to pull off one of the most high-profile cyber attacks of the year so far

πŸ“– Read

via "ITPro".
πŸ“’ Kaspersky declared threat to US national security πŸ“’

Kaspersky was added to the FCC's blacklist alongside China Mobile International and China Telecom

πŸ“– Read

via "ITPro".
πŸ“’ Cyber attackers' NFT blockchain heist nets hundreds of millions in stolen cryptocurrency πŸ“’

Ronin blockchain owner Sky Mavis said it's working with outside experts to ensure the stolen funds are returned to owners

πŸ“– Read

via "ITPro".
πŸ“’ DCMS: A third of businesses experience "weekly" cyber attacks πŸ“’

Government data suggests senior managers are more worried about cyber attacks than ever before

πŸ“– Read

via "ITPro".
πŸ“’ Cyber incidents targeting UK financial services providers surged in 2021 πŸ“’

A fifth of incidents reported to the Financial Conduct Authority involved ransomware

πŸ“– Read

via "ITPro".
πŸ“’ The ten biggest threats to your Windows PC in 2022 πŸ“’

From malware to a man with a screwdriver called Steve, we round up the biggest dangers to your machine this year

πŸ“– Read

via "ITPro".
πŸ“’ Australian gov promises new cyber capabilities despite β€œmassive skills shortage” πŸ“’

The country is investing $9.9 billion to triple its offensive cyber capabilities and double its cyber hunt and response activities

πŸ“– Read

via "ITPro".
πŸ“’ LAPSUS$ returns with Globant breach, leaking trove of data on top global businesses πŸ“’

Experts analysing the data dump told of the 'immense' damage that could be caused with access to such files

πŸ“– Read

via "ITPro".