πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ—“οΈ Volatile market for stolen credit card data shaken up by sanctions against Russia πŸ—“οΈ

Illicit trade still flourishing despite recent law enforcement takedowns

πŸ“– Read

via "The Daily Swig".
β€Ό CVE-2021-32989 β€Ό

When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29380 β€Ό

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1678 β€Ό

An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32966 β€Ό

Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDAP system credentials.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-32997 β€Ό

The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01 versions 5.05 and prior) utilize a weak encryption algorithm for storage and transmission of sensitive data, which may allow an attacker to more easily obtain credentials used for access.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22127 β€Ό

Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-35487 β€Ό

Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates (for the Manage Alerts page) via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user, database name, and database version information, and potentially database data.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Spring Cleaning Checklist for Keeping Your Devices Safe at Work πŸ•΄

Implement zero-trust policies for greater control, use BYOD management tools, and take proactive steps such as keeping apps current and training staff to keep sensitive company data safe and employees' devices secure.

πŸ“– Read

via "Dark Reading".
πŸ•΄ CLOP Ransomware Activity Spiked in April πŸ•΄

In just one month, the ransomware group's activity rose by 2,100%, a new report finds.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Brexit Leak Site Linked to Russian Hackers πŸ•΄

Purporting to publish leaked emails of pro-Brexit leadership in the UK, a new site's operations have been traced to Russian cyber-threat actors, Google says.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Meet the 10 Finalists in the RSA Conference Innovation Sandbox πŸ•΄

This year's finalists tackle such vital security concerns as permissions management, software supply chain vulnerability, and data governance. Winners will be announced June 6.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Corelight Announces New SaaS Platform for Threat Hunting πŸ•΄

Corelight Investigator aids threat hunting and investigation through intelligent alert aggregation, built-in queries and scalable search

πŸ“– Read

via "Dark Reading".
πŸ•΄ Mastercard Launches Cybersecurity β€œExperience Centre” πŸ•΄

Experience Centre features emerging Mastercard products and solutions for securing digital payments on a global scale, including those developed locally in Vancouver.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Qualys to Unveil VMDR 2.0 at Qualys Security Conference in San Francisco πŸ•΄

Company will detail enhancements to Vulnerability Management, Detection and Response solution next month.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cybersecurity-Focused SYN Ventures Closes $300 Million Fund II πŸ•΄

Cylance co-founder Ryan Permeh has joined full time as an operating partner.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Vishing Attacks Reach All Time High, According to Latest Agari and PhishLabs Report πŸ•΄

According to the findings, vishing attacks have overtaken business email compromise as the second most reported response-based email threat since Q3 2021.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Zero-Click Zoom Bug Allows Code Execution Just by Sending a Message πŸ•΄

Google has disclosed a nasty set of six bugs affecting Zoom chat that can be chained together for MitM and RCE attacks, no user interaction required.

πŸ“– Read

via "Dark Reading".
πŸ•΄ JFrog Launches Project Pyrsia to Help Prevent Software Supply Chain Attacks πŸ•΄

Open source software community initiative utilizes blockchain technology.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Interpol's Massive 'Operation Delilah' Nabs BEC Bigwig πŸ•΄

A sprawling, multiyear operation nabs a suspected SilverTerrier BEC group ringleader, exposing a massive attack infrastructure and sapping the group of a bit of its strength.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-29402 β€Ό

TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allows attackers to connect to the UART port via a serial connection and execute commands as the root user without authentication.

πŸ“– Read

via "National Vulnerability Database".