πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-23515 β€Ό

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-23516 β€Ό

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ How Our Behavioral Bad Habits Are a Community Trait and Security Problem πŸ•΄

Learn to think three moves ahead of hackers so you're playing chess, not checkers. Instead of reacting to opponents' moves, be strategic, and disrupt expected patterns of vulnerability.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Royal Ransomware Puts Novel Spin on Encryption Tactics πŸ•΄

An emerging cybercriminal group linked with Conti has expanded its partial encryption strategy and demonstrates other evasive maneuvers, as it takes aim at healthcare and other sectors.

πŸ“– Read

via "Dark Reading".
πŸ›  Global Socket 1.4.39 πŸ› 

Global Socket is a tool for moving data from here to there, securely, fast, and through NAT and firewalls. It uses the Global Socket Relay Network to connect TCP pipes, has end-to-end encryption (using OpenSSL's SRP / RFC-5054), AES-256 and key exchange using 4096-bit Prime, requires no PKI, has Perfect Forward Secrecy, and TOR support.

πŸ“– Read

via "Packet Storm Security".
πŸ•΄ Automated Cybercampaign Creates Masses of Bogus Software Building Blocks πŸ•΄

The proliferation of automated cyberattacks against npm, NuGet, and PyPI underscores the growing sophistication of threat actors and the threats to open source software supply chains.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Proofpoint Nabs Illusive, Signaling a Sunset for Deception Tech πŸ•΄

Former pure-play deception startup Illusive attracts Proofpoint with its repositioned platform focusing on identity threat detection and response (ITDR).

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-31358 β€Ό

A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4495 β€Ό

A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent 1.7. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 6c4d616fcc771822a14ebae5e23f3f6d96d134bd. It is recommended to upgrade the affected component. The identifier VDB-215813 was assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44832 β€Ό

D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46609 β€Ό

Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46997 β€Ό

Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46996 β€Ό

vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44898 β€Ό

The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory corruption and cause a Denial of Service (DoS) or escalate privileges via crafted IOCTL requests.

πŸ“– Read

via "National Vulnerability Database".
β™ŸοΈ Microsoft Patch Tuesday, December 2022 Edition β™ŸοΈ

Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software. The most pressing patches include a zero-day vulnerability in a Windows feature that tries to flag malicious files from the Web, a critical bug in PowerShell, and a dangerous flaw in Windows 11 systems that was detailed publicly prior to this week's Patch Tuesday.

πŸ“– Read

via "Krebs on Security".
❀1
πŸ•΄ Apple Zero-Day Actively Exploited on iPhone 15 πŸ•΄

Without many details, Apple patches a vulnerability that has been exploited in the wild to execute code.

πŸ“– Read

via "Dark Reading".
πŸ•΄ CSAF Is the Future of Vulnerability Management πŸ•΄

Version 2.0 of the Common Security Advisory Framework will enable organizations to automate vulnerability remediation.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Microsoft-Signed Malicious Drivers Usher In EDR-Killers, Ransomware πŸ•΄

Malicious Windows drivers signed as legit by Microsoft have been spotted as part of a toolkit used to kill off security processes in post-exploitation cyber activity.

πŸ“– Read

via "Dark Reading".
πŸ‘1
β€Ό CVE-2022-46071 β€Ό

There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46074 β€Ό

Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-23519 β€Ό

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.

πŸ“– Read

via "National Vulnerability Database".