πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-36137 β€Ό

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-45301 β€Ό

Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-41675 β€Ό

A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server website. Other users export form content as CSV file can trigger arbitrary code execution and allow the attacker to perform arbitrary system operation or disrupt service on the user side.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-45304 β€Ό

Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-41676 β€Ό

Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Scripting) attack to the mail recipient.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-43326 β€Ό

An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4.[*] allows attackers to arbitrarily change user and Administrator account passwords.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-45202 β€Ό

GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at isomedia/box_code_3gpp.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4202 β€Ό

A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214518 is the identifier assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ How the Cloud Changed Digital Forensics Investigations πŸ•΄

The enterprise's shift to the cloud means digital forensics investigators have had to adopt new remote techniques and develop custom tools to uncover and process evidence off compromised devices.

πŸ“– Read

via "Dark Reading".
πŸ•΄ What Every Enterprise Can Learn From Russia’s Cyber Assault on Ukraine πŸ•΄

Once isolated occurrences, nation-state attacks are now commonplace; security professionals should know the elements of defense.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cybersecurity and ESG Among Top Areas of Concern for Audit Leaders in 2023 πŸ•΄

.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 9 Out of 10 Security Leaders State That Control Failures Are the Primary Reason For Data Breaches πŸ•΄

Senior cybersecurity professionals reveal their number one frustration is the inability to continuously measure enterprise-wide security posture and identify control failures.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-46146 β€Ό

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, i someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36433 β€Ό

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ CISA's Strategic Plan Is Ushering in a New Cybersecurity Era πŸ•΄

Today's cyber environment requires less emphasis on detection and perimeter defenses and more focus on bolstering security with resilience.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ How to become a penetration tester: Part 1 – your path into offensive security testing πŸ—“οΈ

Fancy a career in what one practitioner described as the β€˜best job in the world’? Read on to find out how…

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Nok Nok and UberEther Partner to Deliver Phishing-Resistant MFA FedRAMP-Certified IAM Solutions πŸ•΄

Nok Nok’s S3 Suite brings next-level MFA to UberEther’s IAM Advantage Platform to protect the US federal government and its suppliers.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Million-dollar bug bounties: The rise of record-breaking payouts πŸ—“οΈ

As seven-figure vulnerability rewards continue to hit headlines, what is driving bug bounty inflation?

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Acer Firmware Flaw Lets Attackers Bypass Key Security Feature πŸ•΄

The manufacturer is working to fix a vulnerability β€” similar to a previous problem in Lenovo laptops β€” that allows threat actors to modify or disable Secure Boot settings to load malware.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ—“οΈ Intel disputes seriousness of Data Centre Manager authentication flaw πŸ—“οΈ

Security researcher scores $10K bug bounty

πŸ“– Read

via "The Daily Swig".
πŸ•΄ CDNetworks Releases State of Web Security H1 2022: Attacks Against API Services Surged 168.8% πŸ•΄

.

πŸ“– Read

via "Dark Reading".