πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-30057 β€Ό

Shopwind <=v3.4.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30448 β€Ό

Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28255 β€Ό

Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30063 β€Ό

ftcms <=2.1 was discovered to be vulnerable to code execution attacks .

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30453 β€Ό

ShopWind <= 3.4.2 has a RCE vulnerability in Database.php

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30060 β€Ό

ftcms <=2.1 was discovered to be vulnerable to Arbitrary File Write via admin/controllers/tp.php

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ PlainID Debuts Authorization-as-a-Service Platform πŸ•΄

Platform powered by policy-based access control (PBAC).

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-30557 β€Ό

Foxit PDF Reader and PDF Editor before 11.2.2 have a Type Confusion issue that causes a crash because of Unsigned32 mishandling during JavaScript execution.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29596 β€Ό

MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=_any_password_&ConnMode=1&3054=Login substring for directory traversal.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29855 β€Ό

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.

πŸ“– Read

via "National Vulnerability Database".
❌ Novel β€˜Nerbian’ Trojan Uses Advanced Anti-Detection Tricks ❌

The stealthy, feature-rich malware has multistage evasion tactics to fly under the radar of security analysis, researchers at Proofpoint have found.

πŸ“– Read

via "Threat Post".
β™ŸοΈ DEA Investigating Breach of Law Enforcement Data Portal β™ŸοΈ

The U.S. Drug Enforcement Administration (DEA) says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.

πŸ“– Read

via "Krebs on Security".
πŸ•΄ On Air With Dark Reading News Desk at Black Hat Asia 2022 πŸ•΄

This year's Black Hat Asia is hybrid, with some sessions broadcast on the virtual platform and others live on stage in Singapore. News Desk is available on-demand with prerecorded interviews.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-1674 β€Ό

NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1650 β€Ό

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.

πŸ“– Read

via "National Vulnerability Database".
❌ You Can’t Eliminate Cyberattacks, So Focus on Reducing the Blast Radius ❌

Tony Lauro, director of security technology and strategy at Akamai, discusses reducing your company's attack surface and the "blast radius" of a potential attack.

πŸ“– Read

via "Threat Post".
πŸ•΄ Nokia Opens Cybersecurity Testing Lab πŸ•΄

The end-to-end cybersecurity 5G testing lab will help identify and prevent cyberattacks on 5G networks.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Box, Zoom, Google Docs offer phishing boost with β€˜vanity URL’ flaws πŸ—“οΈ

Attack technique bypasses email filters and burnishes credibility of phishing links

πŸ“– Read

via "The Daily Swig".
πŸ•΄ 5 Years That Altered the Ransomware Landscape πŸ•΄

WannaCry continues to be a reminder of the challenges that organizations face dealing with the ransomware threat.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Known macOS Vulnerabilities Led Researcher to Root Out New Flaws πŸ•΄

Researcher shares how he unearthed newer bugs in Apple's operating system by closer scrutiny of previous research, including vulnerabilities that came out of the Pwn2Own competition.

πŸ“– Read

via "Dark Reading".
❌ Malware Builder Leverages Discord Webhooks ❌

Researchers discovered a simple malware builder designed to steal credentials, then pinging them to Discord webhooks.

πŸ“– Read

via "Threat Post".