πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
❌ Scammers Target NFT Discord Channel ❌

Hackers escalate phishing and scamming attacks to exploit popular Discord bot and persuade users to click on the malicious links.

πŸ“– Read

via "Threat Post".
❌ Cybercriminals Expand Attack Radius and Ransomware Pain Points ❌

Melissa Bischoping, security researcher with Tanium and Infosec Insiders columnist, urges firms to consider the upstream and downstream impact of "triple extortion" ransomware attacks.

πŸ“– Read

via "Threat Post".
πŸ•΄ Neutralizing Novel Trickbot Attacks With AI πŸ•΄

Artificial intelligence technology can detect the latest wave of Trickbot ransomware and block the attack before it causes damage.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ Fighting Follina: Application Vulnerabilities and Detection Possibilities πŸ•΄

Although organizations should perform proper risk analysis and patch as soon as practical after there's a fix for this vulnerability, defenders still have options before that's released.

πŸ“– Read

via "Dark Reading".
⚠ Yet another zero-day (sort of) in Windows β€œsearch URL” handling ⚠

More trouble with special-purpose URLs on Windows.

πŸ“– Read

via "Naked Security".
πŸ•΄ 'Clipminer' Malware Actors Steal $1.7 Million Using Clipboard Hijackingp πŸ•΄

The malware targets Windows users via Trojanized downloads of cracked or pirated software and then starts in on cryptocurrency mining and clipboard hijacking.

πŸ“– Read

via "Dark Reading".
⚠ Yet another zero-day (sort of) in Windows β€œsearch URL” handling ⚠

More trouble with special-purpose URLs on Windows.

πŸ“– Read

via "Naked Security".
⚠ S3 Ep85: Now THAT’S what I call a Microsoft Office exploit! [Podcast] ⚠

Latest episode - listen now!

πŸ“– Read

via "Naked Security".
β€Ό CVE-2022-27780 β€Ό

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
β€Ό CVE-2022-29653 β€Ό

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29659 β€Ό

Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30819 β€Ό

In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29711 β€Ό

LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-26974 β€Ό

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization in the upload mechanism leads to reflected XSS.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-29729 β€Ό

Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30825 β€Ό

Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\client_edit.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30490 β€Ό

Badminton Center Management System V1.0 is vulnerable to SQL Injection via parameter 'id' in /bcms/admin/court_rentals/update_status.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-26971 β€Ό

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-26976 β€Ό

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanitization in the upload mechanism is leads to reflected XSS.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-26491 β€Ό

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attacker to take over control over the XMPP connection and to obtain user credentials and all communication content. This is similar to CVE-2022-24968.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30826 β€Ό

Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php.

πŸ“– Read

via "National Vulnerability Database".