πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Managing Extended Software Supply Chain Risks πŸ•΄

Supply chain woes have dominated headlines, but there's another type of supply chain that's also increasingly at risk: the cloud supply chain.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-29235 β€Ό

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and up to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29234 β€Ό

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and up to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s after the lock setting was enacted. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29233 β€Ό

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29236 β€Ό

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and up to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
❌ Being prepared for adversarial attacks ❌

There is no question that the level of threats facing today’s businesses continues to change on a daily basis. So what are the trends that CISOs need to be on the lookout for? For this episode of the Threatpost podcast, I am joined by Derek Manky, Chief Security Strategist & VP Global Threat Intelligence, Fortinet’s […]

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Insight: Russia is β€˜failing’ in its mission to destabilize Ukraine’s networks after a series of thwarted cyber-attacks πŸ—“οΈ

Speaking at WithSecure’s annual conference, Mikko HyppΓΆnen discussed the threat landscape between the two nations

πŸ“– Read

via "The Daily Swig".
❌ International Authorities Take Down Flubot Malware Network ❌

The info-stealing trojan used SMS messages and lifted contact credentials to spread with unprecedented speed across Android devices globally since December 2020.

πŸ“– Read

via "Threat Post".
❌ Scammers Target NFT Discord Channel ❌

Hackers escalate phishing and scamming attacks to exploit popular Discord bot and persuade users to click on the malicious links.

πŸ“– Read

via "Threat Post".
❌ Cybercriminals Expand Attack Radius and Ransomware Pain Points ❌

Melissa Bischoping, security researcher with Tanium and Infosec Insiders columnist, urges firms to consider the upstream and downstream impact of "triple extortion" ransomware attacks.

πŸ“– Read

via "Threat Post".
πŸ•΄ Neutralizing Novel Trickbot Attacks With AI πŸ•΄

Artificial intelligence technology can detect the latest wave of Trickbot ransomware and block the attack before it causes damage.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ Fighting Follina: Application Vulnerabilities and Detection Possibilities πŸ•΄

Although organizations should perform proper risk analysis and patch as soon as practical after there's a fix for this vulnerability, defenders still have options before that's released.

πŸ“– Read

via "Dark Reading".
⚠ Yet another zero-day (sort of) in Windows β€œsearch URL” handling ⚠

More trouble with special-purpose URLs on Windows.

πŸ“– Read

via "Naked Security".
πŸ•΄ 'Clipminer' Malware Actors Steal $1.7 Million Using Clipboard Hijackingp πŸ•΄

The malware targets Windows users via Trojanized downloads of cracked or pirated software and then starts in on cryptocurrency mining and clipboard hijacking.

πŸ“– Read

via "Dark Reading".
⚠ Yet another zero-day (sort of) in Windows β€œsearch URL” handling ⚠

More trouble with special-purpose URLs on Windows.

πŸ“– Read

via "Naked Security".
⚠ S3 Ep85: Now THAT’S what I call a Microsoft Office exploit! [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
β€Ό CVE-2022-27780 β€Ό

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
β€Ό CVE-2022-29653 β€Ό

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29659 β€Ό

Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30819 β€Ό

In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29711 β€Ό

LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.

πŸ“– Read

via "National Vulnerability Database".