🛡 Cybersecurity & Privacy 🛡 - News
25.2K subscribers
88.5K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.

📖 Read

via "National Vulnerability Database".
CVE-2022-36551

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.

📖 Read

via "National Vulnerability Database".
CVE-2022-32173

In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.

📖 Read

via "National Vulnerability Database".
🕴 Name That Edge Toon: Mumbo Dumbo 🕴

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

📖 Read

via "Dark Reading".
CVE-2022-33882

Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code.

📖 Read

via "National Vulnerability Database".
CVE-2022-41443

phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.

📖 Read

via "National Vulnerability Database".
CVE-2022-42247

pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.

📖 Read

via "National Vulnerability Database".
🕴 Bumblebee Malware Loader's Payloads Significantly Vary by Victim System 🕴

On some systems the malware drops infostealers and banking Trojans; on others it installs sophisticated post-compromise tools, new analysis shows.

📖 Read

via "Dark Reading".
🕴 Vice Society Publishes LA Public School Student Data, Psych Evals 🕴

After a flat refusal to pay the ransom, Los Angeles Unified School District's stolen data has been dumped on the Dark Web by a ransomware gang.

📖 Read

via "Dark Reading".
👍1
🕴 First 72 Hours of Incident Response Critical to Taming Cyberattack Chaos 🕴

Responding to cyberattacks is extraordinarily stressful, but better planning, frequent practice, and the availability of mental health services can help IR professionals, a survey finds.

📖 Read

via "Dark Reading".
👍2
Scammers and rogue callers – can anything ever stop them?

Some thoughts for Cybersecurity Awareness Month: Is is worth reporting nuisance calls? Is it even worth reporting outright scams?

📖 Read

via "Naked Security".
👍2
🗓️ Researchers net $46k for Akamai misconfiguration vulnerability 🗓️

A lesson in how to achieve maximum value for your discoveries

📖 Read

via "The Daily Swig".
🗓️ JavaScript sandbox vm2 remediates remote code execution risk 🗓️

Affected firms alerted to bug whose potential impact is heightened by vm2’s use in production environments

📖 Read

via "The Daily Swig".
👍1
🕴 Aryaka Delivers Zero-Trust WAN Based on Unified SASE Architecture 🕴

The new offering integrates firewall-as-a-service and secure web gateway into cloud-managed networking and security services.

📖 Read

via "Dark Reading".
🕴 Tidal Cyber Closes $4M Funding Round To Expand Threat-Informed Defense Tech 🕴

.

📖 Read

via "Dark Reading".
🕴 Ransomware 3.0: The Next Frontier 🕴

Attackers are already circling back to reselling stolen data instead of — and in addition to — extortion.

📖 Read

via "Dark Reading".
👍1
🕴 Eclypsium Raises Series B to Protect Digital Supply Chain As Attacks Grow 🕴

The new round highlights market demand to protect global businesses from soaring breaches through supply chains of critical hardware, devices, firmware, and software.

📖 Read

via "Dark Reading".
🕴 More Than 30% of All Malicious Attacks Target Shadow APIs 🕴

New research spotlights how attackers are capitalizing on API-driven innovation.

📖 Read

via "Dark Reading".
Romance scammer and BEC fraudster sent to prison for 25 years

Two years of scamming + $10 million leeched = 25 years in prison. Just in time for #Cybermonth.

📖 Read

via "Naked Security".
🕴 Steam Gaming Phish Showcases Browser-in-Browser Threat 🕴

Attackers are using the recently emerged browser-in-the-browser phishing technique to steal accounts from Valve's popular gaming platform, but it's a warning shot to businesses.

📖 Read

via "Dark Reading".
👍1