πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Zero-Day β€˜Follina’ Bug Lays Older Microsoft Office Versions Open to Attack ❌

Malware loads itself from remote servers and bypasses Microsoft's Defender AV scanner, according to reports.

πŸ“– Read

via "Threat Post".
πŸ•΄ 6 Steps to Ensure Cyber Resilience πŸ•΄

To minimize the impact of cyber incidents, organizations must be pragmatic and develop a strategy of resilience for dealing with break-ins, advanced malware, and data theft.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Dozens of high-traffic websites vulnerable to β€˜account pre-hijacking’, study finds πŸ—“οΈ

Validation check loopholes exposed

πŸ“– Read

via "The Daily Swig".
⚠ S3 Ep84: Government demand, Mozilla velocity, and Clearview fine [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
πŸ—“οΈ Data breach at Australian pension provider Spirit Super impacts 50k victims following phishing attack πŸ—“οΈ

β€˜Super fund’ confirms user information has been exposed

πŸ“– Read

via "The Daily Swig".
⚠ Beware the Smish! Home delivery scams with a professional feel… ⚠

Home delivery scams are getting leaner, and meaner, and more likely to "look about right". Here's an example to show you what we mean...

πŸ“– Read

via "Naked Security".
β€Ό CVE-2022-1931 β€Ό

Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1934 β€Ό

Use After Free in GitHub repository mruby/mruby prior to 3.2.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-3555 β€Ό

A Buffer Overflow vulnerability in the RSTP server component of Eufy Indoor 2K Indoor Camera allows a local attacker to achieve remote code execution. This issue affects: Eufy Indoor 2K Indoor Camera 2.0.9.3 version and prior versions.

πŸ“– Read

via "National Vulnerability Database".
❌ EnemyBot Malware Targets Web Servers, CMS Tools and Android OS ❌

Malware borrows generously from code used by other botnets such as Mirai, Qbot and Zbot.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Connecticut becomes fifth US state to enact comprehensive consumer privacy law πŸ—“οΈ

The newly signed CTPA is more consumer-friendly than similar legislation in other US states

πŸ“– Read

via "The Daily Swig".
πŸ•΄ How to Keep Your Enterprise Safe From Digital Supply Chain Attacks πŸ•΄

Digital supply chains are more vulnerable than ever; here's what you need to do to secure them.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-1942 β€Ό

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30973 β€Ό

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-23082 β€Ό

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function ΓƒΒ’Γ’β€šΒ¬Γ‹Ε“isFileOutsideDirΓƒΒ’Γ’β€šΒ¬Γ’β€žΒ’ fails to sanitize the user input which may lead to path traversal.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Bug Bounty Radar // The latest bug bounty programs for June 2022 πŸ—“οΈ

New web targets for the discerning hacker

πŸ“– Read

via "The Daily Swig".
πŸ•΄ New CyberCatch Research Discovers Alarming Increase in Cyber Vulnerabilities for Small and Medium Sized Businesses in US and Canada πŸ•΄

For the first time, CyberCatch's SMBVR detected significant vulnerability to 'session riding' attacks among North American SMBs.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Fewer DDoS Attacks in 2021, Still Above Pre-Pandemic Levels πŸ•΄

New research finds a rise in TCP acknowledgement (ACK) DDoS attacks, which rely on a smaller amount of traffic to disrupt targets.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-29258 β€Ό

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI contains a possible cross-site scripting vector in the `Filter.FilterStreamDescriptorForm` wiki page related to pretty much all the form fields printed in the home page of the application. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. The easiest workaround is to edit the wiki page `Filter.FilterStreamDescriptorForm` (with wiki editor) according to the instructions in the GitHub Security Advisory.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29243 β€Ό

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22361 β€Ό

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

πŸ“– Read

via "National Vulnerability Database".