πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-40204 β€Ό

A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages after login.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2019-18265 β€Ό

Digital Alert SystemsÒ€ℒ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46162 β€Ό

discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched in commit 91478f5. As a workaround, ensure that the Content Security Policy is enabled and monitor any posts that contain bbcode.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Podcast transcript: The front line of fraud tech πŸ“’

Read the full transcript for this episode of the IT Pro Podcast

πŸ“– Read

via "ITPro".
πŸ“’ Getting board-level buy-in for security strategy πŸ“’

Why cyber security needs to be a board-level issue

πŸ“– Read

via "ITPro".
πŸ“’ "Unacceptable" data scraping lands Meta a Β£228m data protection fine πŸ“’

The much-awaited decision follows the scraping of half a billion users' data and received unanimous approval from EU regulators

πŸ“– Read

via "ITPro".
πŸ“’ The IT Pro Podcast: The front line of fraud tech πŸ“’

With tools such as deepfakes, the future of fraud tech relies on cutting edge AI as much as good security practice

πŸ“– Read

via "ITPro".
πŸ“’ Hyundai vulnerability allowed remote hacking of locks, engine πŸ“’

Researchers discovered flaws in a number of apps linked to car brands that allowed for personal details and remote control of vehicles using easily-obtained IDs

πŸ“– Read

via "ITPro".
πŸ“’ The NFT bubble bursting means a brighter future for crypto assets πŸ“’

Sales slump as the market decides β€œno one wants a gorilla with a hat on”, but the downturn might give rise to a much brighter future for NFTs

πŸ“– Read

via "ITPro".
πŸ“’ Best free malware removal tools 2022 πŸ“’

Worried your device is infected? Here are some of the best free tools for removing malicious software from your systems

πŸ“– Read

via "ITPro".
πŸ•΄ CI Fuzz CLI Brings Fuzz Testing to Java Applications πŸ•΄

CI Fuzz CLI, the open source fuzzing tool with just three commands, integrates fuzz testing directly into the software development workflow.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-45640 β€Ό

Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-45045 β€Ό

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-40849 β€Ό

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-40489 β€Ό

ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44262 β€Ό

ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-1471 β€Ό

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-3270 β€Ό

In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Guidehouse Insights Anticipates Market for Automotive Cybersecurity Solutions Will Grow to More Than $445 Billion by 2031 πŸ•΄

Market drivers include new regulations, increasing automobile complexity, and new vehicle types.

πŸ“– Read

via "Dark Reading".
πŸ•΄ CyberRatings.org Announces Results from First-of-its-Kind Comparative Test on Cloud Network Firewall πŸ•΄

Ratings ranged from AAA to CC, with security effectiveness scores from 27% to 100%.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ Data Security Concerns Are Driving Changes in US Consumer Behavior and Demands πŸ•΄

As consumers catch on to the dangers, protection could become a major topic for legislative bodies.

πŸ“– Read

via "Dark Reading".