πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.1K subscribers
88.5K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-33880 β€Ό

hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-35137 β€Ό

DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39266 β€Ό

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. As of time of publication, there are no known fixed versions or workarounds.

πŸ“– Read

via "National Vulnerability Database".
β™ŸοΈ Fake CISO Profiles on LinkedIn Target Fortune 500s β™ŸοΈ

Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources.

πŸ“– Read

via "Krebs on Security".
β€Ό CVE-2022-36066 β€Ό

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-3364 β€Ό

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-40472 β€Ό

ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39232 β€Ό

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-41828 β€Ό

In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36068 β€Ό

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39226 β€Ό

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Ransomware Attacks Continue Increasing: 20% of All Reported Attacks Occurred in the Last 12 Months - New Survey πŸ•΄

Survey of over 2,000 IT pros revealed that a quarter either don't know or don't think Microsoft 365 data can be affected by ransomware.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Intel Hardens Confidential Computing With Project Amber Updates πŸ•΄

The chip giant has developed new features and services to make it more difficult for malicious hackers and insiders to access sensitive data from applications in the cloud.

πŸ“– Read

via "Dark Reading".
πŸ•΄ KnowBe4 Simplifies Compliance Requirements for Healthcare Privacy πŸ•΄

KnowBe4's Compliance Audit Readiness Assessment (CARA) now addresses select requirements from HIPAA Security Rule.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Pathlock Expands SAP Capabilities with Acquisition of Grey Monarch πŸ•΄

Combination of two companies to help SAP customers streamline audit, compliance and control processes.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Organizations Finding the Need for New Approaches on the Cybersecurity Front, CompTIA research reveals πŸ•΄

Settling for 'satisfactory' level of readiness may underestimate growing levels of risk.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Latest Delinea Update Streamlines DevOps Security πŸ•΄

.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Veristor Partners with SANS Security Awareness to Deliver Employee Security Awareness Training πŸ•΄

Companies collaborate to strengthen organizations' first line of security defense – end users.

πŸ“– Read

via "Dark Reading".
πŸ•΄ YouMail, Inc. and WMC Global Partner to Deliver Voice and SMS Phishing Disruption Services πŸ•΄

Joint phishing intelligence solution provides 360-degree mobile communication defense.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Aunalytics Launches Security Patching Platform as a Service πŸ•΄

Expedited software patching and updating recognized as one of the most important processes to protect against system compromise from cyberattacks.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cyera Survey Finds One in Three Respondents Want to Minimize Cloud Data Risk πŸ•΄

Multiple providers say 'cloud data sprawl' makes managing cloud data risk a priority initiative within the next 12 months.

πŸ“– Read

via "Dark Reading".