πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2017-18373

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username user3 and and a long password consisting of a repetition of the string 0123456789. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18372

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the tools_time.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18371

The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18370

The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18369

The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the adv_remotelog.asp page and can be exploited through the syslogServerAddr parameter.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2017-18368

The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Security Depends on Careful Design πŸ•΄

Deploying focused edge protection on-site extends security beyond the network level to shield millions of previously exposed devices, apps, and control systems.

πŸ“– Read

via "Dark Reading: ".
❌ D-Link Cloud Camera Flaw Gives Hackers Access to Video Stream ❌

Researchers warn customers to reconsider the use of the camera’s remote access feature if the device is monitoring highly sensitive areas of their household or company.

πŸ“– Read

via "Threatpost".
πŸ•΄ Security Doesn't Trust IT - and IT Doesn't Trust Security πŸ•΄

How a rocky relationship between IT operations and cybersecurity teams can compound security risks.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Misconfigured Ladders Database Exposed 13M User Records πŸ•΄

Job-hunting site Ladders leaves job seeker data exposed on the Internet.

πŸ“– Read

via "Dark Reading: ".
πŸ” How to use the Enpass Password Audit tools πŸ”

If Enpass is your password manager of choice, there are three handy audit tools you should be using. Jack Wallen explains.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How to use the Enpass password audit tools πŸ”

Use Enpass audit tools to identify weak, identical, and old passwords.

πŸ“– Read

via "Security on TechRepublic".
❌ Critical Flaws Found in Eight Wireless Presentation Systems ❌

Crestron, Barco wePresent, Extron ShareLink and more wireless presentation systems have an array of critical flaws.

πŸ“– Read

via "Threatpost".
πŸ•΄ New Exploits For Old Configuration Issues Heighten Risk for SAP Customers πŸ•΄

Exploits give attackers a way to create havoc in business-critical SAP ERP, CRM, SCM, and other environments, Onapsis says.

πŸ“– Read

via "Dark Reading: ".
⚠ Google rolling out auto-delete for your location and activity history ⚠

Auto-delete will hopefully please those of us who haven't already turned off location history altogether (for very good reason).

πŸ“– Read

via "Naked Security".
⚠ Cybersecurity experts battle for right to repair ⚠

A battle rages between manufacturers and users over who can repair a product, with tech companies using security concerns as a weapon.

πŸ“– Read

via "Naked Security".
⚠ Cryptocoin theft, scam and fraud could total more than $1.2b in Q1 ⚠

Crooks have developed "ingenious" new ways to drain user accounts and wallets, CipherTrace says, prodding regulators into action.

πŸ“– Read

via "Naked Security".
⚠ Criminals are hiding in Telegram – but backdoors are not the answer ⚠

When it comes to an easy life, the criminals behind the fearful Anubis banking malware have become big fans of Twitter and, increasingly, the secure messaging of Telegram.

πŸ“– Read

via "Naked Security".
πŸ” Why consumers still don't trust IoT devices πŸ”

Privacy and security concerns frequently drive consumer smart device buying decisions, according to an Internet Society and Consumers International report.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Why older employees are less likely to get tricked by phishing attacks πŸ”

While Gen Zers think they won't fall for phishing scams, most don't even know what "phishing" means, according to a Google report.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ How Storytelling Can Help Keep Your Company Safe πŸ•΄

Well-crafted narratives can help you win over users in the battle to develop a sustainable cybersecurity culture.

πŸ“– Read

via "Dark Reading: ".