πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-38296 β€Ό

Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38297 β€Ό

UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38299 β€Ό

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38304 β€Ό

Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_leave_type.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-35572 β€Ό

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38302 β€Ό

Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_department.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38303 β€Ό

Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_type.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38298 β€Ό

Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ New approach to ransomware encryption threatens to undermine cyber security strategies πŸ“’

Intermittent encryption is already in use with ransomware such as BlackCat and Qyick, and could mark a widespread shift in the threat landscape

πŸ“– Read

via "ITPro".
πŸ“’ Iranian Ministry of Intelligence sanctioned after Albania cyber attack πŸ“’

Iran faces stiff criticism from Nato, the US, and the UK for β€œincreasingly aggressive” cyber operations

πŸ“– Read

via "ITPro".
πŸ“’ Google’s Project Zero is frightening and reassuring in equal measure πŸ“’

This crack team of security researchers are doing work we should all be grateful for

πŸ“– Read

via "ITPro".
πŸ“’ Numerous HP business laptops and desktops vulnerable to publicly disclosed security bugs πŸ“’

Researchers revealed the details of the six vulnerabilities at Black Hat in August but many laptops, desktops, and workstations remain vulnerable

πŸ“– Read

via "ITPro".
πŸ“’ A breakdown of iOS 16's security features πŸ“’

Digital passkeys, faster security updates and a 15-minute window to fix or recall iMessages and emails

πŸ“– Read

via "ITPro".
πŸ“’ What is your digital footprint? πŸ“’

Your digital footprint is always growing – so we explore how you can keep it under control

πŸ“– Read

via "ITPro".
πŸ‘2
πŸ“’ CISA warns against actively exploited Chrome and D-Link security flaws πŸ“’

The agency has made it imperative for all FCEB agencies to patch their systems before September 29

πŸ“– Read

via "ITPro".
β€Ό CVE-2022-38616 β€Ό

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Lorenz Ransomware Goes After SMBs via Mitel VoIP Phone Systems πŸ•΄

The ransomware gang has been seen exploiting a Mitel RCE flaw discovered in VoIP devices in April (and patched in July) to perform double-extortion attacks.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Let’s Encrypt builds infrastructure to support browser-based certificate revocation revival πŸ—“οΈ

CRLs are back, baby!

πŸ“– Read

via "The Daily Swig".
πŸ‘1
β€Ό CVE-2022-36779 β€Ό

PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=1620814301

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36385 β€Ό

A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38541 β€Ό

Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.

πŸ“– Read

via "National Vulnerability Database".