πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.1K subscribers
88.5K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-39871 β€Ό

Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39878 β€Ό

Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39868 β€Ό

Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39872 β€Ό

Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39874 β€Ό

Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ LofyGang Uses 100s of Malicious NPM Packages to Poison Open Source Software πŸ•΄

The group has been operating for over a year, promoting their tools in hacking forums, stealing credit card information, and using typosquatting techniques to target open source software flaws.

πŸ“– Read

via "Dark Reading".
⚠ WhatsApp goes after Chinese password scammers via US court ⚠

If you can't beat 'em, sue 'em!

πŸ“– Read

via "Naked Security".
πŸ•΄ Patch Now: Fortinet FortiGate & FortiProxy Contain Critical Vuln πŸ•΄

Fortinet issued a customer advisory urging customers to apply its update immediately.

πŸ“– Read

via "Dark Reading".
πŸ•΄ State Bar of Georgia Notifies Members and Employees of Cybersecurity Incident πŸ•΄

Current and former employees and members are being offered complimentary credit monitoring and identity protection services as some personal information may have been accessed.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-22493 β€Ό

IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-30613 β€Ό

IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36772 β€Ό

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22480 β€Ό

IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Force ID: 225889.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-41291 β€Ό

IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-34308 β€Ό

IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.

πŸ“– Read

via "National Vulnerability Database".
β™ŸοΈ Report: Big U.S. Banks Are Stiffing Account Takeover Victims β™ŸοΈ

When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation's largest banks, reimbursing account takeover victims has become more the exception than the rule.

πŸ“– Read

via "Krebs on Security".
β€Ό CVE-2022-41513 β€Ό

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-41378 β€Ό

Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-37896 β€Ό

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimÒ€ℒs browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-40162 β€Ό

A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-37887 β€Ό

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.

πŸ“– Read

via "National Vulnerability Database".