🛡 Cybersecurity & Privacy 🛡 - News
@cibsecurity
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
About
Blog
Apps
Platform
Join
🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-1244 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

📖 Read

via "National Vulnerability Database".
343 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-1237 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

📖 Read

via "National Vulnerability Database".
364 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-1241 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

📖 Read

via "National Vulnerability Database".
368 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-1245 ‼

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

📖 Read

via "National Vulnerability Database".
395 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Cyber Security Works to Rebrand As Securin Inc. 🕴

Securin Inc. will provide tech-enabled security solutions, vulnerability intelligence and deep domain expertise.

📖 Read

via "Dark Reading".
Dark Reading
Cyber Security Works to Rebrand As Securin Inc.
Securin Inc. will provide tech-enabled security solutions, vulnerability intelligence and deep domain expertise.
344 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Ransomware's Favorite Target: Critical Infrastructure and Its Industrial Control Systems 🕴

The health, manufacturing, and energy sectors are the most vulnerable to ransomware.

📖 Read

via "Dark Reading".
Dark Reading
Ransomware's Favorite Target: Critical Infrastructure and Its Industrial Control Systems
The health, manufacturing, and energy sectors are the most vulnerable to ransomware.
273 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Optiv Launches Full Suite of Operational Technology Services 🕴



📖 Read

via "Dark Reading".
Dark Reading
Optiv Launches Full Suite of Operational Technology Services
DENVER, March 7, 2023 /PRNewswire/ -- Digitization and the heavy adoption of connected devices are enabling organizations to reach new heights and, at the same time, have intensified the threat landscape and extended the attack surface. As organizations work…
253 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-26955 ‼

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module.

📖 Read

via "National Vulnerability Database".
227 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-36669 ‼

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.

📖 Read

via "National Vulnerability Database".
227 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-44197 ‼

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System.This issue affects Student Information Management System: before 20211126.

📖 Read

via "National Vulnerability Database".
213 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-26954 ‼

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.

📖 Read

via "National Vulnerability Database".
218 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-4330 ‼

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit – Import and versions up to and including 2.0.10 of Envato Elements & Download.

📖 Read

via "National Vulnerability Database".
224 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-36668 ‼

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.

📖 Read

via "National Vulnerability Database".
235 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-44196 ‼

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management System.This issue affects Student Information Management System: before 20211126.

📖 Read

via "National Vulnerability Database".
249 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2020-36667 ‼

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.

📖 Read

via "National Vulnerability Database".
262 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Delinea Adds New features for its Privilege Manager and DevOps Secrets Vault 🕴



📖 Read

via "Dark Reading".
Dark Reading
Delinea Adds New features for its Privilege Manager and DevOps Secrets Vault
REDWOOD CITY, Calif., March 7, 2023 /PRNewswire/ -- Delinea, a leading provider of Privileged Access Management (PAM) solutions for seamless security, today announced new features for its Privilege Manager and DevOps Secrets Vault products. Updates to both…
275 views
🛡 Cybersecurity & Privacy 🛡 - News
🕴 Remcos RAT Spyware Scurries Into Machines via Cloud Servers 🕴

Attackers use phishing emails that appear to come from reputable organizations, dropping the payload using public cloud servers and an old Windows UAC bypass technique.

📖 Read

via "Dark Reading".
Dark Reading
Remcos RAT Spyware Scurries Into Machines via Cloud Servers
Attackers use phishing emails that appear to come from reputable organizations, dropping the payload using public cloud servers and an old Windows UAC bypass technique.
277 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-27522 ‼

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

📖 Read

via "National Vulnerability Database".
241 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-1254 ‼

A vulnerability has been found in SourceCodester Health Center Patient Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file birthing_print.php. The manipulation of the argument birth_id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222484.

📖 Read

via "National Vulnerability Database".
229 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2023-25690 ‼

Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.

📖 Read

via "National Vulnerability Database".
204 views
🛡 Cybersecurity & Privacy 🛡 - News
‼ CVE-2021-4332 ‼

The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.

📖 Read

via "National Vulnerability Database".
176 views