πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2022-46548 β€Ό

Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44643 β€Ό

In Grafana Enterprise Metrics (GEM) before 1.7.1 and 2.x before 2.3.1, after creating an Access Policy that is granted access to all tenants as well as specified a specific label matcher, the label matcher is erroneously not propagated to queries performed with this access policy. Thus, more access is granted to the policy than intended.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4619 β€Ό

The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Γ’β‚¬ΛœExtra CSS classÒ€ℒ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46020 β€Ό

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.

πŸ“– Read

via "National Vulnerability Database".
πŸ—“οΈ How to become a penetration tester: Part 2 – β€˜Mr hacking’ John Jackson on the virtue of β€˜endless curiosity’ πŸ—“οΈ

Marine Corps engineer-turned offensive security expert offers careers advice and his best and worst experiences

πŸ“– Read

via "The Daily Swig".
⚠ OneCoin scammer Sebastian Greenwood pleads guilty, β€œCryptoqueen” still missing ⚠

The Cryptoqueen herself is still missing, but her co-conspirator, who is said to have pocketed over $20m a month, has been convicted.

πŸ“– Read

via "Naked Security".
πŸ•΄ Cybersecurity VMRay Extends Series B Investment to a Total of $34 million USD to Drive Growth Into New Markets πŸ•΄

VMRay announces the closing of a Series B led by global alternative asset manager Tikehau Capital, which will fuel further expansion of the product portfolio to target a broader set of market segments.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Coming to a SOC Near You: New Browsers, 'Posture' Management, Virtual Assistants πŸ•΄

Startups are coalescing around effective data loss prevention, reducing data attack surfaces, and viable AI automation.

πŸ“– Read

via "Dark Reading".
⚠ Microsoft dishes the dirt on Apple’s β€œAchilles heel” shortly after fixing similar Windows bug ⚠

It happens to the best of us: Microsoft highlights a security bypass bug on Macs that is curiously similar to a recent Windows 0-day.

πŸ“– Read

via "Naked Security".
β€Ό CVE-2022-46076 β€Ό

D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Searchlight Security Changes Name to Searchlight Cyber and Launches New Brand πŸ•΄

Searchlight Cyber announces rebrand that reflects its status as a fast-growing cybersecurity business.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ How AI/ML Can Thwart DDoS Attacks πŸ•΄

When properly designed and trained, artificial intelligence and machine learning can help improve the accuracy of DDoS detection and mitigation.

πŸ“– Read

via "Dark Reading".
πŸ‘1
β™ŸοΈ The Equifax Breach Settlement Offer is Real, For Now β™ŸοΈ

Millions of people likely just received an email or snail mail notice saying they're eligible to claim a class action payment in connection with the 2017 megabreach at consumer credit bureau Equifax. Given the high volume of reader inquiries about this, it seemed worth pointing out that while this particular offer is legit (if paltry), scammers are likely to soon capitalize on public attention to the settlement money.

πŸ“– Read

via "Krebs on Security".
πŸ•΄ NATO-Member Oil Refinery Targeted in Russian APT Blitz Against Ukraine πŸ•΄

Security Service-backed Trident Ursa APT group shakes up tactics in its relentless cyberattacks against Ukraine.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Raspberry Robin Worm Targets Telcos & Governments πŸ•΄

With 10 layers of obfuscation and fake payloads, the Raspberry Robin worm is nesting its way deep into organizations.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-43875 β€Ό

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or managing these authorizations. IBM X-Force ID: 240034.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46424 β€Ό

An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service (DoS). This affects v0.4.1.1 and earlier.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-23537 β€Ό

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46912 β€Ό

An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46771 β€Ό

IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 242273.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-46430 β€Ό

TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.

πŸ“– Read

via "National Vulnerability Database".