๐Ÿ›ก Cybersecurity & Privacy ๐Ÿ›ก - News
25.8K subscribers
89.2K links
๐Ÿ—ž The finest daily news on cybersecurity and privacy.

๐Ÿ”” Daily releases.

๐Ÿ’ป Is your online life secure?

๐Ÿ“ฉ lalilolalo.dev@gmail.com
Download Telegram
โ€ผ CVE-2023-1291 โ€ผ

A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/clients/manage_client.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222645 was assigned to this vulnerability.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-1293 โ€ผ

A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects the function mysqli_query of the file admin_cs.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222647.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-1290 โ€ผ

A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this issue is some unknown functionality of the file admin/clients/view_client.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222644.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2022-29056 โ€ผ

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ•ด Iranian APT Targets Female Activists With Mahsa Amini Protest Lures ๐Ÿ•ด

A top Iranian, state-sponsored threat is a spear-phishing campaign that uses a fake Twitter persona to target women interested in Iranian political affairs and human rights.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด How to Jump-Start Your Cybersecurity Career ๐Ÿ•ด

With more than 700,000 cybersecurity jobs available, now is a good time to consider a career change.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ‘1
๐Ÿ•ด Inside Threat: Developers Leaked 10M Credentials, Passwords in 2022 ๐Ÿ•ด

More than five out of every 1,000 commits to GitHub included a software secret, half again the rate in 2021, putting applications and businesses at risk.

๐Ÿ“– Read

via "Dark Reading".
โš  S3 Ep125: When security hardware has security holes [Audio + Text] โš 

Lastest episode - listen now! (Full transcript inside.)

๐Ÿ“– Read

via "Naked Security".
โ€ผ CVE-2023-25573 โ€ผ

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-1288 โ€ผ

An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote File inclusions.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-1287 โ€ผ

An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-25814 โ€ผ

metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed to the user. This allows a users of the system to read arbitrary files on the filesystem of the server so long as the server process itself has permission to read the requested files. This issue has been addressed in version 2.7.1. All users are advised to upgrade. There are no known workarounds for this issue.

๐Ÿ“– Read

via "National Vulnerability Database".
โ™Ÿ๏ธ Whoโ€™s Behind the NetWire Remote Access Trojan? โ™Ÿ๏ธ

A Croatian national has been arrested for allegedly operating NetWire, a Remote Access Trojan (RAT) marketed on cybercrime forums since 2012 as a stealthy way to spy on infected systems and siphon passwords. The arrest coincided with a seizure of the NetWire sales website by the U.S. Federal Bureau of Investigation (FBI). While the defendant in this case hasnโ€™t yet been named publicly, the NetWire website has been leaking information about the likely true identity and location of its owner for the past 11 years.

๐Ÿ“– Read

via "Krebs on Security".
๐Ÿ•ด 5 Reasons You Should Care About Unmanaged Assets ๐Ÿ•ด

Unmanaged devices pose a significant challenge and risk for many organizations. Here are the five reasons you should care about unmanaged devices and assets.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ‘1
๐Ÿ•ด Medusa Gang Video Shows Minneapolis School District's Ransomed Data ๐Ÿ•ด

Much like a hostage's proof-of-life video, the ransomware gang offers the film as verification that it has the goods, and asks $1 million for the data.

๐Ÿ“– Read

via "Dark Reading".
โ€ผ CVE-2022-4317 โ€ผ

An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2022-4462 โ€ผ

An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-1084 โ€ผ

An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2023-0483 โ€ผ

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site.

๐Ÿ“– Read

via "National Vulnerability Database".
๐Ÿ•ด US Lawmakers Face Cyberattacks, Potential Physical Harm After DC Health Link Breach ๐Ÿ•ด

The threat actor who posted the data for sale has claimed credit for multiple other breaches, including one at grocery platform Weee! that exposed data on more than 1.1 million customers.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด IceFire Ransomware Portends a Broader Shift From Windows to Linux ๐Ÿ•ด

IceFire has changed up its OS target in recent cyberattacks, emblematic of ransomware actors increasingly targeting Linux enterprise networks, despite the extra work involved.

๐Ÿ“– Read

via "Dark Reading".