πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-43326 β€Ό

An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4.[*] allows attackers to arbitrarily change user and Administrator account passwords.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-45202 β€Ό

GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at isomedia/box_code_3gpp.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4202 β€Ό

A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214518 is the identifier assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ How the Cloud Changed Digital Forensics Investigations πŸ•΄

The enterprise's shift to the cloud means digital forensics investigators have had to adopt new remote techniques and develop custom tools to uncover and process evidence off compromised devices.

πŸ“– Read

via "Dark Reading".
πŸ•΄ What Every Enterprise Can Learn From Russia’s Cyber Assault on Ukraine πŸ•΄

Once isolated occurrences, nation-state attacks are now commonplace; security professionals should know the elements of defense.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cybersecurity and ESG Among Top Areas of Concern for Audit Leaders in 2023 πŸ•΄

.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 9 Out of 10 Security Leaders State That Control Failures Are the Primary Reason For Data Breaches πŸ•΄

Senior cybersecurity professionals reveal their number one frustration is the inability to continuously measure enterprise-wide security posture and identify control failures.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-46146 β€Ό

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, i someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-36433 β€Ό

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ CISA's Strategic Plan Is Ushering in a New Cybersecurity Era πŸ•΄

Today's cyber environment requires less emphasis on detection and perimeter defenses and more focus on bolstering security with resilience.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ How to become a penetration tester: Part 1 – your path into offensive security testing πŸ—“οΈ

Fancy a career in what one practitioner described as the β€˜best job in the world’? Read on to find out how…

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Nok Nok and UberEther Partner to Deliver Phishing-Resistant MFA FedRAMP-Certified IAM Solutions πŸ•΄

Nok Nok’s S3 Suite brings next-level MFA to UberEther’s IAM Advantage Platform to protect the US federal government and its suppliers.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Million-dollar bug bounties: The rise of record-breaking payouts πŸ—“οΈ

As seven-figure vulnerability rewards continue to hit headlines, what is driving bug bounty inflation?

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Acer Firmware Flaw Lets Attackers Bypass Key Security Feature πŸ•΄

The manufacturer is working to fix a vulnerability β€” similar to a previous problem in Lenovo laptops β€” that allows threat actors to modify or disable Secure Boot settings to load malware.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ—“οΈ Intel disputes seriousness of Data Centre Manager authentication flaw πŸ—“οΈ

Security researcher scores $10K bug bounty

πŸ“– Read

via "The Daily Swig".
πŸ•΄ CDNetworks Releases State of Web Security H1 2022: Attacks Against API Services Surged 168.8% πŸ•΄

.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-45343 β€Ό

GPAC v2.1-DEV-rev478-g696e6f868-master was discovered to contain a heap use-after-free via the Q_IsTypeOn function at /gpac/src/bifs/unquantize.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44635 β€Ό

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.

πŸ“– Read

via "National Vulnerability Database".
⚠ Chrome fixes 8th zero-day of 2022 – check your version now (Edge too!) ⚠

There isn't a rhyme to remind you which months have browser zero-days... you just have to keep your eyes and ears open!

πŸ“– Read

via "Naked Security".
⚠ TikTok β€œInvisible Challenge” porn malware puts us all at risk ⚠

An injury to one is an injury to all. Especially if the other people are part of your social network.

πŸ“– Read

via "Naked Security".
πŸ•΄ Why the Culture Shift on Privacy and Security Means Today's Data Looks Different πŸ•΄

A lack of federal regulatory legislation leaves US privacy concerns to battle for attention with other business priorities.

πŸ“– Read

via "Dark Reading".