πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-36433 β€Ό

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ CISA's Strategic Plan Is Ushering in a New Cybersecurity Era πŸ•΄

Today's cyber environment requires less emphasis on detection and perimeter defenses and more focus on bolstering security with resilience.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ How to become a penetration tester: Part 1 – your path into offensive security testing πŸ—“οΈ

Fancy a career in what one practitioner described as the β€˜best job in the world’? Read on to find out how…

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Nok Nok and UberEther Partner to Deliver Phishing-Resistant MFA FedRAMP-Certified IAM Solutions πŸ•΄

Nok Nok’s S3 Suite brings next-level MFA to UberEther’s IAM Advantage Platform to protect the US federal government and its suppliers.

πŸ“– Read

via "Dark Reading".
πŸ—“οΈ Million-dollar bug bounties: The rise of record-breaking payouts πŸ—“οΈ

As seven-figure vulnerability rewards continue to hit headlines, what is driving bug bounty inflation?

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Acer Firmware Flaw Lets Attackers Bypass Key Security Feature πŸ•΄

The manufacturer is working to fix a vulnerability β€” similar to a previous problem in Lenovo laptops β€” that allows threat actors to modify or disable Secure Boot settings to load malware.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ—“οΈ Intel disputes seriousness of Data Centre Manager authentication flaw πŸ—“οΈ

Security researcher scores $10K bug bounty

πŸ“– Read

via "The Daily Swig".
πŸ•΄ CDNetworks Releases State of Web Security H1 2022: Attacks Against API Services Surged 168.8% πŸ•΄

.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-45343 β€Ό

GPAC v2.1-DEV-rev478-g696e6f868-master was discovered to contain a heap use-after-free via the Q_IsTypeOn function at /gpac/src/bifs/unquantize.c.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44635 β€Ό

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.

πŸ“– Read

via "National Vulnerability Database".
⚠ Chrome fixes 8th zero-day of 2022 – check your version now (Edge too!) ⚠

There isn't a rhyme to remind you which months have browser zero-days... you just have to keep your eyes and ears open!

πŸ“– Read

via "Naked Security".
⚠ TikTok β€œInvisible Challenge” porn malware puts us all at risk ⚠

An injury to one is an injury to all. Especially if the other people are part of your social network.

πŸ“– Read

via "Naked Security".
πŸ•΄ Why the Culture Shift on Privacy and Security Means Today's Data Looks Different πŸ•΄

A lack of federal regulatory legislation leaves US privacy concerns to battle for attention with other business priorities.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Killnet Gloats About DDoS Attacks Downing Starlink, White House πŸ•΄

Elon Musk-owned Starlink, WhiteHouse.gov, and the Prince of Wales were targeted by Killnet in apparent retaliation for its support of Ukraine.

πŸ“– Read

via "Dark Reading".
❀1
πŸ•΄ The Metaverse Could Become a Top Avenue for Cyberattacks in 2023 πŸ•΄

Expect to see attackers expand their use of current consumer-targeting tactics while exploring new ways to target Internet users β€” with implications for businesses.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-44356 β€Ό

WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4172 β€Ό

An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46152 β€Ό

OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vulnerability. The function `cleanup_shm_refs()` is called by both `entry_invoke_command()` and `entry_open_session()`. The commands `OPTEE_MSG_CMD_OPEN_SESSION` and `OPTEE_MSG_CMD_INVOKE_COMMAND` can be executed from the normal world via an OP-TEE SMC. This function is not validating the `num_params` argument, which is only limited to `OPTEE_MSG_MAX_NUM_PARAMS` (127) in the function `get_cmd_buffer()`. Therefore, an attacker in the normal world can craft an SMC call that will cause out-of-bounds reading in `cleanup_shm_refs` and potentially freeing of fake-objects in the function `mobj_put()`. A normal-world attacker with permission to execute SMC instructions may exploit this flaw. Maintainers believe this problem permits local privilege escalation from the normal world to the secure world. Version 3.19.0 contains a fix for this issue. There are no known workarounds.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44355 β€Ό

SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-21126 β€Ό

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4144 β€Ό

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

πŸ“– Read

via "National Vulnerability Database".