πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
ATENTIONβ€Ό New - CVE-2015-9272

The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2014-10076

The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2014-10075

The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2013-7465

Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET, SSH, or FTP, which allows remote attackers to execute arbitrary code by uploading PHP scripts.

πŸ“– Read

via "National Vulnerability Database".
⚠ Google’s Intra app secures older Androids with encrypted DNS ⚠

DNS encryption is the Next Big Thing in web encryption and Google doesn't want Android users to miss out.

πŸ“– Read

via "Naked Security".
⚠ Facebook doubles cooling off period to cash in on your FOMO ⚠

Facebook has doubled its grace period because so many leavers are getting cold feet.

πŸ“– Read

via "Naked Security".
⚠ Wi-Fi versions to get names people can actually understand ⚠

The high priests of Wi-Fi just made your life - and the lives of wireless network equipment vendors everywhere - a little easier.

πŸ“– Read

via "Naked Security".
⚠ Prison smuggler busted by his own drone camera ⚠

It turns out that drones advertised off the back of beautiful aerial shots also take great videos of murky drug dens.

πŸ“– Read

via "Naked Security".
❌ Virus Bulletin 2018: Exposing the Social Media Fraud Ecosystem ❌

The business of fake likes and followers turns out to be a sprawling enterprise -- likely tied back to IoT botnet activity.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ 12 AppSec Activities Enterprises Can't Afford to Skip πŸ•΄

The latest Building Security in Maturity Model (BSIMM9) report offers a statistically backed, bare-minimum benchmark for software security initiatives.

πŸ“– Read

via "Dark Reading: ".
❌ Threatpost New Wrap Podcast For Oct. 5 ❌

Threatpost editors discuss the highlights and biggest breaking news from this past week.

πŸ“– Read

via "The first stop for security news | Threatpost ".
❌ D-Link Patches RCE Bugs in Wireless Access Point Gear ❌

 D-Link has released the beta version of the controller which addresses the reported vulnerabilities.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ Successful Scammers Call After Lunch πŸ•΄

Analysis of 20,000 voice phishing, or vishing, calls reveals patterns in how hackers operate.

πŸ“– Read

via "Dark Reading: ".
❌ Virus Bulletin 2018: Saudi Dissident Spyware Attack Belies Bigger Threat ❌

A spyware attack on a Saudi dissident living in Canada made headlines this week, but Citizen Lab warns that simpler attacks are the real epidemic.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ Most Home Routers Are Full of Vulnerabilities πŸ•΄

More than 80% of surveyed routers had, on average, 172 security vulnerabilities, new research shows.

πŸ“– Read

via "Dark Reading: ".
❌ Sony Smart TV Bug Allows Remote Access, Root Privileges ❌

Software patching becomes a new reality for smart TV owners.

πŸ“– Read

via "The first stop for security news | Threatpost ".
πŸ•΄ Mandia: Tipping Point Now Here for Rules of Cyber Engagement πŸ•΄

FireEye CEO and nation-state hacking expert Kevin Mandia says Russia began changing the game in 2015.

πŸ“– Read

via "Dark Reading: ".
πŸ” Cybersecurity investments: Why ROI calculations may not tell the whole story πŸ”

Cybersecurity spends are about loss prevention not earnings, suggests security expert Bruce Schneier. Thankfully, there are better options to ensure cybersecurity investments are maximized.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2015-9273

The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2012-6710

ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.

πŸ“– Read

via "National Vulnerability Database".