πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ Serious Security: That KeePass β€œmaster password crack”, and what we can learn from it ⚠

Here, in an admittedly discursive nutshell, is the fascinating story of CVE-2023-32784. (Short version: Don't panic.)

πŸ“– Read

via "Naked Security".
β€Ό CVE-2023-29747 β€Ό

Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘2
β€Ό CVE-2023-3021 β€Ό

Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Ways to Help Cybersecurity's Essential Workers Avoid Burnout πŸ•΄

To support and retain the people who protect assets against bad actors, organizations should create a more defensible environment.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ MacOS 'Migraine' Bug: Big Headache for Device System Integrity πŸ•΄

Microsoft says the vulnerability could allow cyberattackers with root access to bypass security protections and install malware.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2022-35746 β€Ό

Windows Digital Media Receiver Elevation of Privilege Vulnerability

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-33967 β€Ό

EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Can Cloud Services Encourage Better Login Security? Netflix's Accidental Model πŸ•΄

Netflix's unpopular password-sharing policy change had a positive cybersecurity silver lining. Can more B2C service providers nudge their users toward secure authentication?

πŸ“– Read

via "Dark Reading".
πŸ•΄ Yet Another Toyota Cloud Data Breach Jeopardizes Thousands of Customers πŸ•΄

The newly found misconfigured cloud services are discovered just two weeks after an initial data breach affecting millions came to light.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2023-33627 β€Ό

H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-33732 β€Ό

Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.

πŸ“– Read

via "National Vulnerability Database".
❀2
β€Ό CVE-2023-23954 β€Ό

Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-29159 β€Ό

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2010-10010 β€Ό

A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.2.2b is able to address this issue. The name of the patch is 5d3b7311fd5085ec6ea1b1bfa9a05285964e07e4. It is recommended to upgrade the affected component. The identifier VDB-230265 was assigned to this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-4332 β€Ό

In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x aΓ‚ vulnerable firmware verification has been identified. Through physical access and hardware manipulation, an attacker might be able to bypass hardware-based code verification and thus inject and execute arbitrary code and gain full access of the device.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Barracuda network appliance vulnerability β€œactively exploited” for seven months πŸ“’

The company has issued a patch, but warned customers that the vulnerability left them exposed for over half a year

πŸ“– Read

via "ITPro".
πŸ“’ Amazon's Ring agrees to $5.8m settlement over alleged use of its cameras to spy on female customers πŸ“’

The firm will also pay $25m for allegations Alexa stored child voice recordings indefinitely

πŸ“– Read

via "ITPro".
πŸ•΄ Meet Charlotte, CrowdStrike's New Generative AI Assistant πŸ•΄

Charlotte AI is the latest security-based generative AI assistant to hit the market.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Top macOS Malware Threats Proliferate: Here Are 6 to Watch πŸ•΄

Apple's growing market share β€” in a shrinking PC market β€” and the growing use of Golang for malware development is pushing a gradual increase in malicious tools targeting macOS environments.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Dark Reading Launches Inaugural CISO Advisory Board πŸ•΄

Ten chief information security officers from a variety of verticals will provide valuable insights to Dark Reading on what they see as the industry's most pressing issues.

πŸ“– Read

via "Dark Reading".
πŸ‘1
πŸ•΄ SolarWinds Transforms Brand to Signify Ongoing Evolution, Portfolio Expansion, and Customer Empowerment πŸ•΄

Refreshed version of iconic SolarWinds logo and vibrant new brand color palette honor company’s historic success while highlighting future vision.

πŸ“– Read

via "Dark Reading".