πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-27732 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41042 β€Ό

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-19155 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
⚠ S3 Ep90: Chrome 0-day again, True Cybercrime, and a 2FA bypass [Podcast + Transcript] ⚠

Listen now! Or read if you prefer...

πŸ“– Read

via "Naked Security".
⚠ Apache β€œCommons Configuration” toolkit patches Log4Shell-like bug ⚠

It's a bit like Log4J, but for configuration files, not for logging.

πŸ“– Read

via "Naked Security".
β€Ό CVE-2022-1245 β€Ό

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-41037 β€Ό

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.

πŸ“– Read

via "National Vulnerability Database".
❌ U.S. Healthcare Orgs Targeted with Maui Ransomware ❌

State-sponsored actors are deploying the unique malware--which targets specific files and leaves no ransomware note--in ongoing attacks.

πŸ“– Read

via "Threat Post".
πŸ•΄ ICYMI: Critical Cisco RCE Bug, Microsoft Breaks Down Hive, SHI Cyberattack πŸ•΄

Dark Reading's digest of the other don't-miss stories of the week, including a new ransomware targeting QNAP gear, and a destructive attack against the College of the Desert that lingers on.

πŸ“– Read

via "Dark Reading".
πŸ•΄ What Do All of Those Cloud Cybersecurity Acronyms Mean? πŸ•΄

Acronyms serve as a gatekeeper β€” if you don't sling the lingo, you don't belong. So here's a quick guide to the letter salad of cloud cybersecurity.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-31290 β€Ό

A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28624 β€Ό

A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited to allow cross site scripting (XSS). HPE has made the following software updates to resolve the vulnerability. HPE FlexNetwork 5130EL_7.10.R3507P02 and HPE FlexFabric 5945_7.10.R6635.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-32115 β€Ό

An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
β€Ό CVE-2022-30852 β€Ό

Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-28623 β€Ό

Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the following updated modules to resolve these vulnerabilities. HPE IceWall SSO version 10.0 certd library Patch 9 for RHEL and HPE IceWall SSO version 10.0 certd library Patch 9 for HP-UX.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33011 β€Ό

Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Decentralized Identifiers: Everything you need to know about the next-gen web ID tech πŸ—“οΈ

DID promises to give web users more control over their digital identities

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Zero Trust Bolsters Our National Defense Against Rising Cyber Threats πŸ•΄

The Colonial Pipeline and JBS attacks, among others, showed us our national resilience is only as strong as public-private sector collaboration.

πŸ“– Read

via "Dark Reading".
❌ Sneaky Orbit Malware Backdoors Linux Devices ❌

The novel threat steals data and can affect all processes running on the OS, stealing information from different commands and utilities and then storing it on the affected machine.

πŸ“– Read

via "Threat Post".
πŸ” Friday Five 7/8 πŸ”

In this week’s Friday Five, read more about what Apple is doing to protect users against government-backed malware, why U.S. healthcare organizations should be on high alert, how threat actors are changing their tactics, and much more.


πŸ“– Read

via "".
πŸ•΄ Coalition Closes $250 Million in Series F Funding, Valuing the Cyber Insurance Provider at $5 Billion πŸ•΄

Funding from Allianz X, Valor Equity Partners, Kinetic Partners, and existing investors will accelerate Coalition’s vision to provide security for all.

πŸ“– Read

via "Dark Reading".