πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-34378 β€Ό

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to denial of service.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36071 β€Ό

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from version 2.2.0 to 2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. This issue has been fixed in version 2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-34369 β€Ό

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive information in log files vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to exposure of this sensitive data.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36754 β€Ό

Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-29260 β€Ό

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36642 β€Ό

A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.5.0+r1 allows attackers to escalate privileges to root and execute arbitrary commands.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36647 β€Ό

PKUVCL davs2 v1.6.205 was discovered to contain a global buffer overflow via the function parse_sequence_header() at source/common/header.cc:269.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ REvil claims ransomware attack on multi-billion-dollar manufacturing giant Midea Group πŸ“’

The once-dominant ransomware group resurfaced in April but has now claimed an attack on the biggest company since its heyday

πŸ“– Read

via "ITPro".
πŸ“’ US imposes sanctions on Nvidia's chip sales in China πŸ“’

New export rules are intended to thwart China’s efforts to use AI computing chips for military purposes

πŸ“– Read

via "ITPro".
πŸ“’ Asian businesses overhaul their approach to cyber security following attacks πŸ“’

Organisations in Singapore and Malaysia are also impacted by the introduction of tighter regulations and legislations around cyber security

πŸ“– Read

via "ITPro".
πŸ“’ What is the Computer Misuse Act? πŸ“’

If your computer systems are attacked, is the law effective enough to put those criminals behind bars?

πŸ“– Read

via "ITPro".
πŸ“’ Podcast transcript: What did we learn from WannaCry? πŸ“’

Read the full transcript for this episode of the IT Pro Podcast

πŸ“– Read

via "ITPro".
πŸ“’ The IT Pro Podcast: What did we learn from WannaCry? πŸ“’

Five years on, WannaCry still remains one of the most impactful security incidents in recent memory

πŸ“– Read

via "ITPro".
πŸ“’ 'Vast majority' of mobile apps found leaking AWS credentials are on iOS πŸ“’

Only 2% of the apps that were found to be leaking hard-coded AWS credentials were on the Android platform, research has shown

πŸ“– Read

via "ITPro".
πŸ“’ Apple breaks update policy to secure older iPhones and iPads against zero-day πŸ“’

It's been four years since the company patched an end-of-life device against a major vulnerability

πŸ“– Read

via "ITPro".
πŸ“’ Hitachi announces major restructure of US subsidiaries πŸ“’

The company cited improved managed services as a chief benefit of the change, which will also affect Canadian and Indian offshoot

πŸ“– Read

via "ITPro".
πŸ‘1
πŸ“’ How quantum computing could change cyber security πŸ“’

The huge leap in computing performance from quantum computing poses a threat to traditional security, but there are steps you can take to guard against the quantum future

πŸ“– Read

via "ITPro".
β€Ό CVE-2022-3099 β€Ό

Use After Free in GitHub repository vim/vim prior to 9.0.0359.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-3118 β€Ό

A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing of the file /pages/processlogin.php. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207845 was assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β™ŸοΈ Violence-as-a-Service: Brickings, Firebombings & Shootings for Hire β™ŸοΈ

A 21-year-old New Jersey man has been arrested and charged with stalking in connection with a federal investigation into groups of cybercriminals who are settling scores by hiring people to carry out physical attacks on their rivals. Prosecutors say the defendant recently participated in several of these schemes -- including firing a handgun into a Pennsylvania home and torching a residence in another part of the state with a Molotov Cocktail.

πŸ“– Read

via "Krebs on Security".
β€Ό CVE-2022-39829 β€Ό

There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new.

πŸ“– Read

via "National Vulnerability Database".