🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
🕴 Truebot Malware Variants Abound, According to CISA Advisory 🕴

US and Canadian government agencies find that new variants of the malware are increasingly being utilized.

📖 Read

via "Dark Reading".
🕴 Meta's Rush to Topple Twitter Sets Up Looming Privacy Debate 🕴

GDPR is halting Meta's new Threads app from entering EU markets, portending a broader struggle over the right ways to collect user data on social apps.

📖 Read

via "Dark Reading".
🕴 How to Safely Architect AI in Your Cybersecurity Programs 🕴

Guardrails need to be set in place to ensure confidentiality of sensitive information, while still leveraging AI as a force multiplier for productivity.

📖 Read

via "Dark Reading".
🕴 Global Hacking Competition Addresses Critical Increase in Cybersecurity Threats for Businesses 🕴

Hack The Box launches Capture The Flag competition, including offensive and defensive challenges, to unite teams as cyberattacks increase in 2023 to unprecedented levels.

📖 Read

via "Dark Reading".
CVE-2023-37269

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.

📖 Read

via "National Vulnerability Database".
CVE-2023-37270

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

📖 Read

via "National Vulnerability Database".
👏1
CVE-2023-32000

A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page.

📖 Read

via "National Vulnerability Database".
CVE-2023-3552

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

📖 Read

via "National Vulnerability Database".
1
CVE-2023-3553

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

📖 Read

via "National Vulnerability Database".
1👏1
CVE-2023-3551

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

📖 Read

via "National Vulnerability Database".
1
🕴 How to Use Log Management to Retrace Your Digital Footsteps 🕴

Log management tools help IT and security teams monitor and improve a system's performance by identifying bugs, cybersecurity breaches, and other issues that can create outages or compliance problems.

📖 Read

via "Dark Reading".
1
CVE-2023-37288

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.

📖 Read

via "National Vulnerability Database".
CVE-2023-37287

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.

📖 Read

via "National Vulnerability Database".
CVE-2023-37286

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.

📖 Read

via "National Vulnerability Database".
🕴 Zero Trust Keeps Digital Attacks From Entering the Real World 🕴

Amid IT/OT convergence, organizations must adopt an "assume breach" mindset to stop bad actors and limit their impact.

📖 Read

via "Dark Reading".
1
📢 The channel is helping to bake in endpoint security 📢

With endpoints expanding, how can the channel approach security with integrated technologies that protect every device?

📖 Read

via "ITPro".
👍1
🕴 Banking Firms Under Attack by Sophisticated 'Toitoin' Campaign 🕴

An attack involves a multi-stage infection chain with custom malware hosted on Amazon EC2 that ultimately steals critical system and browser data; so far, targets have been located in Latin America.

📖 Read

via "Dark Reading".
🤯1
🕴 10 Features an API Security Service Needs to Offer 🕴

Securing APIs is specialized work. Here's what organizations should look for when selecting an outside partner.

📖 Read

via "Dark Reading".
🕴 APT35 Develops Mac Bespoke Malware 🕴

Iran-linked APT35 group crafted specific Mac malware when targeting a member of the media with new tools to add backdoors.

📖 Read

via "Dark Reading".
CVE-2023-34442

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-M1

📖 Read

via "National Vulnerability Database".
CVE-2021-42083

An authenticated attacker is able to create alerts that trigger a stored XSS attack. 

📖 Read

via "National Vulnerability Database".