🛡 Cybersecurity & Privacy 🛡 - News
25.9K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
ATENTION New - CVE-2015-6253

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2015-5601

edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.

📖 Read

via "National Vulnerability Database".
🔏 What's the Cost of a Data Breach in 2019? 🔏

The answer ultimately depends on the country and industry but in general, can span anywhere from $1.25 million to $8.19 million.

📖 Read

via "Subscriber Blog RSS Feed ".
🕴 Sephora Offers Monitoring Services in Wake of Data Breach 🕴

The data breach compromised data belonging to customers in parts of Southeast Asia, Australia, and New Zealand.

📖 Read

via "Dark Reading: ".
ThreatList: DMARC Adoption Nonexistent at 80% of Orgs

Standard email authentication to prevent spoofing and phishing remains elusive for most.

📖 Read

via "Threatpost".
ATENTION New - CVE-2018-17213

An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2018-17211

An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2018-11774

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2018-11773

Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2018-11772

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.

📖 Read

via "National Vulnerability Database".
🕴 Deutsche Bank Email Vulnerability Left Ex-Employees with Access 🕴

Failures in computer and control systems are being blamed.

📖 Read

via "Dark Reading: ".
🕴 Series of Zero-Day Vulnerabilities Could Endanger 200 Million Devices 🕴

Vulnerabilities in VxWorks' TCP stack could allow an attacker to execute random code, launch a DoS attack, or use the vulnerable system to attack other devices.

📖 Read

via "Dark Reading: ".
ATENTION New - CVE-2018-18570

Planon before Live Build 41 has XSS.

📖 Read

via "National Vulnerability Database".
🕴 How Can We Stop Ransomware From Spreading? 🕴

Here's how to stop them - or at least limit the systems it can reach.

📖 Read

via "Dark Reading: ".
🕴 Farewell, Dear Password? The Future of Identity and Authorization 🕴

Many organizations, along with their tech teams, are questioning whether eliminating passwords as an authentication tool might augment their overall security posture.

📖 Read

via "Dark Reading: ".
🕴 Sextortion Email Scams Rise Sharply 🕴

Cybercriminals are increasingly trying to trick people into paying ransoms by threatening to expose compromising activities to friends and family.

📖 Read

via "Dark Reading: ".
🔐 It's 2019, and one third of businesses still have active Windows XP deployments 🔐

As end of support for the still-popular Windows 7 draws near, risks of unpatched operating systems are likely to be a significant security concern in the near future.

📖 Read

via "Security on TechRepublic".
🔐 12 reasons why data breaches still happen 🔐

Half of IT security leaders don't know if their cybersecurity tools are working, according to a report from the Ponemon Institute and AttackIQ.

📖 Read

via "Security on TechRepublic".
Former AWS Engineer Arrested as Capital One Admits Massive Data Breach

More than 100 million customers have had their data compromised by a hacker after a cloud misconfiguration at Capital One.

📖 Read

via "Threatpost".
🕴 Black Hat Q&A: Cracking Apple's T2 Security Chip 🕴

Duo Labs' Mikhail Davidow and Jeremy Erickson speak about their research on the Apple T2 security chip, and why they're sharing it at Black Hat USA.

📖 Read

via "Dark Reading: ".