πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-30687 β€Ό

Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the productÒ€ℒs secure erase feature to delete arbitrary files.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28394 β€Ό

EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427). Please note that this was reported on an EOL version of the product, and users are advised to upgrade to the latest supported version (5.x).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30701 β€Ό

An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30700 β€Ό

An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1909 β€Ό

Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1907 β€Ό

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1908 β€Ό

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1898 β€Ό

Use After Free in GitHub repository vim/vim prior to 8.2.

πŸ“– Read

via "National Vulnerability Database".
❌ Critical Flaws in Popular ICS Platform Can Trigger RCE ❌

Cisco Talos discovered eight vulnerabilities in the Open Automation Software, two of them critical, that pose risk for critical infrastructure networks.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Security β€˜researcher’ hits back against claims of malicious CTX file uploads πŸ—“οΈ

They claim that all data received was deleted

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Taking the Danger Out of IT/OT Convergence πŸ•΄

The Colonial Pipeline attack highlighted the dangers of convergence, but unified security provides a safer way to proceed.

πŸ“– Read

via "Dark Reading".
⚠ S3 Ep84: Government demand, Mozilla velocity, and Clearview fine [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
πŸ—“οΈ Patch released for cross-domain cookie leakage flaw in Guzzle πŸ—“οΈ

Drupal rolls out update for issue that is contingent on cookie middleware being enabled

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Physical Security Teams' Impact Is Far-Reaching πŸ•΄

Here's how physical security teams can integrate with the business to identify better solutions to security problems.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ” Friday Five 5/27 πŸ”

Learn why Twitter owes the Federal Trade Commission $150 million, how spyware is taking advantage of zero-day vulnerabilities, and more in this week's Friday Five!


πŸ“– Read

via "".
πŸ•΄ ChromeLoader Malware Hijacks Browsers With ISO Files πŸ•΄

The malware’s abuse of PowerShell makes it more dangerous, allowing for more advanced attacks such as ransomware, fileless malware, and malicious code memory injections.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-20668 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20671 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20765 β€Ό

A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affected system. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom JavaScript to affected web applications. A successful exploit could allow the attacker to rewrite web page content, access sensitive information stored in the applications, and alter data by submitting forms.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20672 β€Ό

Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-20807 β€Ό

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

πŸ“– Read

via "National Vulnerability Database".