πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2023-34154 β€Ό

Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-2786 β€Ό

Mattermost fails to properly check theΓ‚ permissions when executing commands allowing a member with no permissionsΓ‚ to post a message in a channel to actually post it by executing channel commands.

πŸ“– Read

via "National Vulnerability Database".
πŸ“’ Latest arrest places LockBit firmly in the crosshairs of international cyber police πŸ“’

The threat group could be set for a fate reminiscent of REvil

πŸ“– Read

via "ITPro".
β€Ό CVE-2023-2785 β€Ό

Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation ofΓ‚ large log files

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-2793 β€Ό

Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.

πŸ“– Read

via "National Vulnerability Database".
πŸ‘1
πŸ•΄ HashiCorp Expands PAM, Secrets Management Capabilities πŸ•΄

The new privileged access management and secrets management capabilities tackles access issues and secret sprawl across the cloud environment.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cybercrime Doesn't Take a Vacation πŸ•΄

Organizations need to prepare for security threats as summer holidays approach.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2023-26537 β€Ό

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nicolly WP No External Links plugin <=Γ‚ 1.0.2 versions.

πŸ“– Read

via "National Vulnerability Database".
❀1
β€Ό CVE-2023-26527 β€Ό

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPIndeed Debug Assistant plugin <=Γ‚ 1.4 versions.

πŸ“– Read

via "National Vulnerability Database".
❀2
πŸ•΄ Attackers Create Synthetic Security Researchers to Steal IP πŸ•΄

Threat groups created a fake security company, "High Sierra," with faux exploits and fake profiles for security researchers on GitHub and elsewhere, aiming to get targets to install their malware.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2023-35783 β€Ό

The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.

πŸ“– Read

via "National Vulnerability Database".
❀1
πŸ•΄ Dodgy Microlending Apps Stalk MEA Users, Highlighting Cyber Maturity Gaps πŸ•΄

Mobile users in the Middle East and Africa often download moneylending apps that ask for excessive permissions β€” an all too common issue in an area where mobile-only is common and cyber awareness is low.

πŸ“– Read

via "Dark Reading".
πŸ›  Suricata IDPE 6.0.13 πŸ› 

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.

πŸ“– Read

via "Packet Storm Security".
β€Ό CVE-2023-30453 β€Ό

The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-34733 β€Ό

A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via supplying crafted media files when connecting a device to the vehicle's USB plug and play feature.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Third MOVEit Transfer Vulnerability Disclosed by Progress Software πŸ•΄

MOVEit has created a patch to fix the issue and urges customers to take action to protect their environments, as Cl0p attacks on the service continue to mount.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Security LeadHER Wraps Groundbreaking Inaugural Conference for Women in Security πŸ•΄

This first-ever event, hosted by the Security Industry Association and ASIS International and designed to advance, connect, and empower women in security, gathered hundreds of industry leaders in Nashville June 12-13, 2023.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Killnet Threatens Imminent SWIFT, World Banking Attacks πŸ•΄

The DDoS collective claims to be teaming up with ReVIL and Anonymous Sudan for destructive financial attacks in retaliation for US aid in Ukraine, but the partnerships (and danger) are far from verified.

πŸ“– Read

via "Dark Reading".
πŸ‘1
β€Ό CVE-2023-34645 β€Ό

jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-34660 β€Ό

jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Getting Over the DNS Security Awareness Gap πŸ•΄

To properly secure DNS infrastructure, organizations need strong security hygiene around DNS infrastructure and records management as well as closely monitoring and filtering DNS traffic.

πŸ“– Read

via "Dark Reading".