πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2023-34458 β€Ό

mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2022-42045 β€Ό

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-30559 β€Ό

The configuration from the PCU can be modified without authentication using physical connection to the PCU.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-30560 β€Ό

The configuration from the PCU can be modified without authentication using physical connection to the PCU.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Linux Hacker Exploits Researchers With Fake PoCs Posted to GitHub πŸ•΄

A cyber attacker gives defenders a taste of their own medicine, with GitHub honeypots concealing infostealers.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Cybersecurity Leaders Report Reduction in Disruptive Cyber Incidents With MSS/MDR Solutions πŸ•΄

Optiv survey highlights organizations' need for talent, challenges with sophistication of threat actors and expanding attack surface.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Facebook and Microsoft are the Most Impersonated Brands in Phishing Attacks πŸ•΄

Vade's phishing and malware report reveals phishing volumes increased by more than 54% in H1 2023.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Safe Security Acquires RiskLens πŸ•΄

A combination of SAFE Platform's industry defining AI capabilities coupled with the industry standard FAIR model for cyber risk quantification, that was pioneered by RiskLens.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Black Hat Announces Sustainability Pledge πŸ•΄

Pledge stems from Black Hat’s commitment to become a net zero carbon business by 2030.

πŸ“– Read

via "Dark Reading".
β™ŸοΈ SEO Expert Hired and Fired By Ashley Madison Turned on Company, Promising Revenge β™ŸοΈ

[This is Part II of a story published here last week on reporting that went into a new Hulu documentary series on the 2015 Ashley Madison hack.]It was around 9 p.m. on Sunday, July 19, when I received a message through the contact form on KrebsOnSecurity.com that the marital infidelity website AshleyMadison.com had been hacked. The message contained links to confidential Ashley Madison documents, and included a manifesto that said a hacker group calling itself the Impact Team was prepared to leak data on all 37 million users unless Ashley Madison and a sister property voluntarily closed down within 30 days.

πŸ“– Read

via "Krebs on Security".
πŸ•΄ White House Fills in Details Of National Cybersecurity Strategy πŸ•΄

While the plan may convey the right kind of urgency, it lacks both funding and bipartisan support, industry professionals say.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2023-37598 β€Ό

A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-36473 β€Ό

Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-35945 β€Ό

Envoy is a cloud-native high-performance edge/middle/service proxy. EnvoyÒ€ℒs HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-37463 β€Ό

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time complexity issues in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. These vulnerabilities have been patched in 0.29.0.gfm.12.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-37468 β€Ό

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-30563 β€Ό

A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2023-30565 β€Ό

An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.

πŸ“– Read

via "National Vulnerability Database".