πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-25663 β€Ό

Possible buffer overflow due to lack of buffer length check during management frame Rx handling lead to denial of service in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25720 β€Ό

Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-39253 β€Ό

Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-22077 β€Ό

Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25719 β€Ό

Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33217 β€Ό

Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kernel. in Snapdragon Mobile

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25723 β€Ό

Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25718 β€Ό

Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25748 β€Ό

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25664 β€Ό

Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-33210 β€Ό

Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-23648 β€Ό

Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator password without any authentication.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-25736 β€Ό

Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ A New Solution to the Cybersecurity Skills Gap: Building Security into Operational Teams πŸ•΄

Why β€” and how β€” companies should consider shifting day-to-day security responsibilities out to operations teams. The move would elevate the team's level of decision-making and help address the challenge of finding professionals with security-specific credentials.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Revelstoke Teams Up With BreachRx, Offering Users Automated Incident Response and Compliance Solutions πŸ•΄

New partnership gives security analysts simplicity when sifting through data, thorough readouts of compliance options, and streamlined response to incidents.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Security certification body (ISC)Β² defends β€˜undemocratic’ bylaw changes πŸ—“οΈ

Former chair bemoans β€˜coup by governance’

πŸ“– Read

via "The Daily Swig".
πŸ•΄ DigiCert Appoints Industry Veteran Amit Sinha as Chief Executive Officer πŸ•΄

Former Zscaler president to lead DigiCert's next stage of growth as the company accelerates its strategy, expands its product offering, and works to become the de facto standard for digital trust.

πŸ“– Read

via "Dark Reading".
πŸ•΄ GroupSense Delivers New Ransomware Negotiation Training Service πŸ•΄

Training service prepares ransomware response teams for successful threat actor engagement to mitigate damage, protect brand reputation, anticipate emerging threats, and more.

πŸ“– Read

via "Dark Reading".
πŸ‘1
β€Ό CVE-2022-43037 β€Ό

An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-43040 β€Ό

GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function gf_isom_box_dump_start_ex at /isomedia/box_funcs.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-43038 β€Ό

Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.

πŸ“– Read

via "National Vulnerability Database".