βΌ CVE-2022-20407 βΌ
π Read
via "National Vulnerability Database".
Product: AndroidVersions: Android kernelAndroid ID: A-210916981References: N/Aπ Read
via "National Vulnerability Database".
βΌ CVE-2022-35666 βΌ
π Read
via "National Vulnerability Database".
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.π Read
via "National Vulnerability Database".
βΌ CVE-2022-35678 βΌ
π Read
via "National Vulnerability Database".
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.π Read
via "National Vulnerability Database".
ποΈ Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA ποΈ
π Read
via "The Daily Swig".
Renowned researcher James Kettle demonstrates his latest attack technique in Las Vegasπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA
Renowned researcher James Kettle demonstrates his latest attack technique in Las Vegas
π΄ New Cross-Industry Group Launches Open Cybersecurity Framework π΄
π Read
via "Dark Reading".
18 companies led by Amazon and Splunk announced the OCSF framework, to provide a standard way for sharing threat detection telemetry among different monitoring tools and applications.π Read
via "Dark Reading".
Dark Reading
New Cross-Industry Group Launches Open Cybersecurity Framework
Eighteen companies, led by Amazon and Splunk, announced the OCSF framework to provide a standard way for sharing threat detection telemetry among different monitoring tools and applications.
π΄ 4 Flaws, Other Weaknesses Undermine Cisco ASA Firewalls π΄
π Read
via "Dark Reading".
More than 1 million instances of firewalls running Cisco Adaptive Security Appliance (ASA) software have four vulnerabilities that undermine its security, a researcher finds.π Read
via "Dark Reading".
Dark Reading
4 Flaws, Other Weaknesses Undermine Cisco ASA Firewalls
More than 1 million instances of firewalls running Cisco Adaptive Security Appliance (ASA) software have four vulnerabilities that undermine its security, a researcher finds.
βοΈ It Might Be Our Data, But Itβs Not Our Breach βοΈ
π Read
via "Krebs on Security".
A cybersecurity firm says it has intercepted a large, unique stolen data set containing the names, addresses, email addresses, phone numbers, Social Security Numbers and dates of birth on nearly 23 million Americans. The firm's analysis of the data suggests it corresponds to current and former customers of AT&T. The telecommunications giant stopped short of saying the data wasn't theirs, but it maintains the records do not appear to have come from its systems and may be tied to a previous data incident at another company.π Read
via "Krebs on Security".
Krebs on Security
It Might Be Our Data, But Itβs Not Our Breach
A cybersecurity firm says it has intercepted a large, unique stolen data set containing the names, addresses, email addresses, phone numbers, Social Security Numbers and dates of birth on nearly 23 million Americans. The firm's analysis of the data suggestsβ¦
π΄ Cyber-Insurance Fail: Most Businesses Lack Ransomware Coverage π΄
π Read
via "Dark Reading".
Even among businesses with cyber insurance, they lack coverage for basic costs of many cyberattacks, according to a BlackBerry survey.π Read
via "Dark Reading".
Dark Reading
Cyber-Insurance Fail: Most Businesses Lack Ransomware Coverage
Even among businesses with cyber insurance, they lack coverage for basic costs of many cyberattacks, according to a BlackBerry survey.
π1
π΄ Supply-Chain Security Startup Phylum Wins the First Black Hat Innovation Spotlight π΄
π Read
via "Dark Reading".
Up-and-coming companies shoot their shot in a new feature introduced at the 25th annual cybersecurity conference.π Read
via "Dark Reading".
Dark Reading
Supply Chain Security Startup Phylum Wins the First Black Hat Innovation Spotlight
Up-and-coming companies shoot their shot in a new feature introduced at the 25th annual cybersecurity conference.
π΄ After Colonial Pipeline, Critical Infrastructure Operators Remain Blind to Cyber-Risks π΄
π Read
via "Dark Reading".
In her keynote address at Black Hat USA 2022, Kim Zetter gives scathing rebuke of Colonial Pipeline attack.π Read
via "Dark Reading".
Dark Reading
After Colonial Pipeline, Critical Infrastructure Operators Remain Blind to Cyber-Risks
In her keynote address at Black Hat USA 2022, Kim Zetter gives a scathing rebuke of Colonial Pipeline for not foreseeing the attack.
π΄ Microsoft: We Don't Want to Zero-Day Our Customers π΄
π Read
via "Dark Reading".
The head of Microsoft's Security Response Center defends keeping its initial vulnerability disclosures sparse -- it is, she says, to protect customers.π Read
via "Dark Reading".
Dark Reading
Microsoft: We Don't Want to Zero-Day Our Customers
The head of Microsoft's Security Response Center defends keeping its initial vulnerability disclosures sparse β it is, she says, to protect customers.
βΌ CVE-2022-2779 βΌ
π Read
via "National Vulnerability Database".
A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned to this vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2390 βΌ
π Read
via "National Vulnerability Database".
Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.π Read
via "National Vulnerability Database".
βΌ CVE-2022-2503 βΌ
π Read
via "National Vulnerability Database".
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5π Read
via "National Vulnerability Database".
βΌ CVE-2022-38179 βΌ
π Read
via "National Vulnerability Database".
JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attackπ Read
via "National Vulnerability Database".
βΌ CVE-2022-38180 βΌ
π Read
via "National Vulnerability Database".
In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some casesπ Read
via "National Vulnerability Database".
ποΈ GoTestWAF adds API attack testing via OpenAPI support ποΈ
π Read
via "The Daily Swig".
CI/CD support is next for WAF security toolπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
GoTestWAF adds API attack testing via OpenAPI support
CI/CD support is next for WAF security tool
β Facebookβs In-app Browser on iOS Tracks βAnything You Do on Any Websiteβ β
π Read
via "Threat Post".
Researcher shows how Instagram and Facebookβs use of an in-app browser within both its iOS apps can track interactions with external websites.π Read
via "Threat Post".
Threat Post
Facebookβs In-app Browser on iOS Tracks βAnything You Do on Any Websiteβ
Researcher shows how Instagram and Facebookβs use of an in-app browser within both its iOS apps can track interactions with external websites.
β S3 Ep95: Slack leak, Github onslaught, and post-quantum crypto [Audio + Text] β
π Read
via "Naked Security".
Latest episode - listen now! (Or read the transcript if you prefer.)π Read
via "Naked Security".
Naked Security
S3 Ep95: Slack leak, Github onslaught, and post-quantum crypto [Audio + Text]
Latest episode β listen now! (Or read the transcript if you prefer.)
π΄ How to Clear Security Obstacles and Achieve Cloud Nirvana π΄
π Read
via "Dark Reading".
Back-end complexity of cloud computing means there's plenty of potential for security problems. Here's how to get a better handle on SaaS application security.π Read
via "Dark Reading".
Dark Reading
How to Clear Security Obstacles and Achieve Cloud Nirvana
Back-end complexity of cloud computing means there's plenty of potential for security problems. Here's how to get a better handle on SaaS application security.
ποΈ BHUSA: Make sure your security bug bounty program doesnβt create a data leak of its own ποΈ
π Read
via "The Daily Swig".
Researchers, organizations, and bug disclosure platforms can all make improvements to help protect user dataπ Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
BHUSA: Make sure your security bug bounty program doesnβt create a data leak of its own
Researchers, organizations, and bug disclosure platforms can all make improvements to help protect user data