πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2021-41959 β€Ό

JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp, which causes a memory leak.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-42218 β€Ό

OMPL v1.5.2 contains a memory leak in VFRRT.cpp

πŸ“– Read

via "National Vulnerability Database".
❌ Mozilla: Lack of Security Protections in Mental-Health Apps Is β€˜Creepy’ ❌

Popular apps to support people’s psychological and spiritual well-being can harm them by sharing their personal and sensitive data with third parties, among other privacy offenses.

πŸ“– Read

via "Threat Post".
πŸ•΄ TLS Flaws Leave Avaya, Aruba Switches Open to Complete Takeover πŸ•΄

In the latest incarnation of the TLStorm vulnerability, switches from Avaya and Aruba β€” and perhaps others β€” are susceptible to compromise from an internal attacker.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Data breach at US energy supplier Riviera Utilities exposes customer information πŸ—“οΈ

Unknown actor accessed employee emails

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Developing Software? Get Accountability Right First πŸ•΄

Software accountability offers a fresh perspective for creating and managing digital products, mainly by making processes more reliable and transparent for every stakeholder.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-42165 β€Ό

MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path".

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
β€Ό CVE-2021-39390 β€Ό

Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘Ž1
πŸ•΄ Teleport Raises $110 Million Series C at $1.1 Billion Valuation Led by Bessemer Venture Partners πŸ•΄

Funding follows dramatic revenue growth as identity-based access requirements skyrocket.

πŸ“– Read

via "Dark Reading".
πŸ•΄ OccamSec Unveils New Cybersecurity Platform πŸ•΄

Providing continuous penetration testing with context, and a host of other features, the Incenter platform is built to give organizations what they need to effectively secure their environment.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Radware Launches SkyHawk Security, a Spinoff of Its Cloud Native Protector Business πŸ•΄

Tiger Global Management invests $35 million in SkyHawk Security to accelerate growth.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Path traversal flaw found in OWASP enterprise security testing library πŸ—“οΈ

Difficult-to-exploit ESAPI vulnerability offers best practice lessons

πŸ“– Read

via "The Daily Swig".
πŸ›  OpenSSL Toolkit 3.0.3 πŸ› 

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide. The 3.x series is the current major version of OpenSSL.

πŸ“– Read

via "Packet Storm Security".
πŸ›  OpenSSL Toolkit 1.1.1o πŸ› 

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

πŸ“– Read

via "Packet Storm Security".
β€Ό CVE-2022-28589 β€Ό

A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=add_new

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-0916 β€Ό

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28590 β€Ό

A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme.

πŸ“– Read

via "National Vulnerability Database".
⚠ GitHub issues final report on supply-chain source code intrusions ⚠

Learn how to find out which apps you've given access rights to, and how to revoke those rights immediately in an emergency.

πŸ“– Read

via "Naked Security".
πŸ•΄ How to Create a Cybersecurity Mentorship Program πŸ•΄

As the talent shortage rages on, companies have found mentorship programs to be one of the best ways to obtain the security skills they need to develop their existing teams.

πŸ“– Read

via "Dark Reading".
⚠ Firefox hits 100*, fixes bugs… but no new zero-days this month ⚠

Despite concerns that some websites might break when Chromium and then Firefox reached version 100, the web still seems to be intact.

πŸ“– Read

via "Naked Security".
πŸ‘2
πŸ•΄ Third-Party App Access Is the New Executable File πŸ•΄

By providing these apps and other add-ons for SaaS platforms and associated permissions, businesses present bad actors with more opportunities to gain access to company data.

πŸ“– Read

via "Dark Reading".