πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2019-10800 β€Ό

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-27294 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ Vulnerability in AWS IAM Authenticator for Kubernetes could allow user impersonation, privilege escalation attacks πŸ—“οΈ

Flaw in Amazon’s Kubernetes service has since been fixed

πŸ“– Read

via "The Daily Swig".
πŸ•΄ New Research Reveals 93% of Organizations Surveyed Have Had Failed IIoT/OT Security Projects πŸ•΄

Barracuda research finds organizations are struggling to protect operational technology and getting breached as a result.

πŸ“– Read

via "Dark Reading".
πŸ•΄ US Government and QuSecure Orchestrate First-Ever Post-Quantum Encryption Communication over a Government Network πŸ•΄

QuSecure’s QuProtect leverages unique post-quantum cryptographic algorithm on government legacy systems to achieve world’s first and only post-quantum resilient channel within a government facility.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Microsoft: 10,000 Orgs Targeted in Phishing Attack That Bypasses Multifactor Authentication πŸ•΄

The massive phishing campaign does not exploit a vulnerability in MFA. Instead, it spoofs an Office 365 authentication page to steal credentials.

πŸ“– Read

via "Dark Reading".
⚠ Paying ransomware crooks won’t reduce your legal risk, warns regulator ⚠

"We paid the crooks to keep things under control and make a bad thing better"... isn't a valid excuse. Who knew?

πŸ“– Read

via "Naked Security".
πŸ•΄ Survey: Small Cybersecurity Teams Face Greater Risk from Attacks than Larger Enterprises πŸ•΄

Cynet CISO survey reveals lack of staff, skills, and resources driving smaller teams to outsource security with advanced tools, technologies, and services.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-35259 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-32274 β€Ό

The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-32065 β€Ό

An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.

πŸ“– Read

via "National Vulnerability Database".
⚠ Facebook 2FA scammers return – this time in just 21 minutes ⚠

Last time they arrived 28 minutes after lighting up their fake domain... this time it was just 21 minutes

πŸ“– Read

via "Naked Security".
πŸ” UK Urges Organizations Not to Pay Ransomware Payments πŸ”

The UK ICO and NCSC issued a letter to UK lawyers stressing that paying the demands of ransomware actors is not advisable.

πŸ“– Read

via "".
β€Ό CVE-2022-34358 β€Ό

IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230516.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-32096 β€Ό

Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted JWE token.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-32074 β€Ό

A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-32073 β€Ό

WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ 3 Golden Rules of Modern Third-Party Risk Management πŸ•΄

It's time to expand the approach of TPRM solutions so risk management is more effective in the digital world.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Internet Searches Reveal Surprisingly Prevalent Ransomware πŸ•΄

Two mostly defunct threats β€” WannaCry and NonPetya β€” top the list of ransomware searches, but does that mean they are still causing problems?

πŸ“– Read

via "Dark Reading".
πŸ•΄ MacOS Bug Could Let Malicious Code Break Out of Application Sandbox πŸ•΄

Microsoft reveals now-fixed flaw in Apple's App Sandbox controls could allow attackers to escalate device privileges and deploy malware.

πŸ“– Read

via "Dark Reading".
πŸ•΄ The 3 Critical Elements You Need for Vulnerability Management Today πŸ•΄

Most organizations are flying blind when remediating vulnerabilities. We lack the tooling to secure software fast enough. We need a new approach to vulnerability management now.

πŸ“– Read

via "Dark Reading".