Menu

Monthly Archives: May 2020

How EasyJet customers could make money out of the airline being hacked
eBay users spot the online auction house port-scanning their PCs. Um… is that OK?

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

New iOS Jailbreak Tool Works on iPhone Models iOS 11 to iOS 13.5

Reading Time: ~ 2 min. Our 2020 Threat Report shows increasing risks for businesses and consumers still running Windows 7, which ceased updates, support and patches earlier this year. This creates security gaps that hackers are all too eager to exploit. In fact, according to the report, malware targeting Windows 7 increased by 125%. And […]

Several security issues were fixed in Thunderbird.

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

Galaxy S20 security is already old hat as Samsung launches new safety silicon
Contact-tracing app may become a permanent fixture in major Chinese city

This microcode updates provides new microcode versions for the following Intel Ice Lake and Sandy Bride family processors: Processor Stepping Model Update Name – ICL-U/Y D1 6-7e-5/80 00000046->00000078 Core Gen10 Mobile

ThreatList: People Know Reusing Passwords Is Dumb, But Still Do It
70 Percent of Mobile, Desktop Apps Contain Open-Source Bugs

An update that contains security fixes can now be installed.

What is the dark web? Your questions answered, in plain English
Pre-authentication, remote root hole in call-center software? Thanks, Cisco. Just what a long weekend needs
The Civil Service’s rogue tweet about “Truth Twisters”

### python-markdown2 2.3.9 ### – [pull #335] Added header support for wiki tables – [pull #336] Reset _toc when convert is run – [pull #353] XSS fix – [pull #350] XSS fix

An update that fixes one vulnerability is now available.

The 5.6.14 stable kernel update contains a number of important fixes across the tree

### python-markdown2 2.3.9 ### – [pull #335] Added header support for wiki tables – [pull #336] Reset _toc when convert is run – [pull #353] XSS fix – [pull #350] XSS fix

An update that fixes two vulnerabilities is now available.

Georgi Guninski and the Qualys Research Labs discovered multiple vulnerabilities in qmail (shipped in Debian as netqmail with additional patches) which could result in the execution of arbitrary code, bypass of mail address verification and a local information leak whether a file

Security fix for CVE-2018-1285

Update to 8.10 release (CVE-2020-12823)

security update

Security fix for CVE-2020-12662 and CVE-2020-12663

– CVE-2020-10957: lmtp/submission: A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn’t start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to crash the submission service without authentication. – CVE-2020-10958: lmtp/submission:

Fake supreme court subpoena phishing scam steals Office 365 credentials
Hackers leak data of 29 million Indian job seekers for download

An update that fixes three vulnerabilities is now available.

An update that fixes three vulnerabilities is now available.

The package chromium before version 83.0.4103.61-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing and insufficient validation.

The package openconnect before version 1:8.10-1 is vulnerable to arbitrary code execution.

The package powerdns-recursor before version 4.2.2-1 is vulnerable to multiple issues including denial of service and insufficient validation.

The package dovecot before version 2.3.10.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service.

Winnti hacking group hits gaming firms with new backdoor malware

security update

It wasn’t just a few credit cards: Entire travel itineraries were stolen by hackers, Easyjet now tells victims
Personal data of 12 million Facebook users exposed online
Chrome 83 arrives with enhanced security and privacy controls

New features include DNS over HTTPS, a Safety Check section and simpler cookie management The post Chrome 83 arrives with enhanced security and privacy controls appeared first on WeLiveSecurity

No “Game over” for the Winnti Group

The notorious APT group continues to play the video game industry with yet another backdoor The post No “Game over” for the Winnti Group appeared first on WeLiveSecurity

As hackers sell 8 million user records, Home Chef confirms data breach
The ransomware that attacks you from inside a virtual machine
Forget BYOD, this is BYOVM: Ransomware tries to evade antivirus by hiding in a virtual machine on infected systems
Signal secure messaging can now identify you without a phone number
‘Coronavirus Report’ Emails Spread NetSupport RAT, Microsoft Warns
Home Chef Serves Up Data Breach for 8 Million Records
EasyJet’s breach notification email to customers – a closer look
Hackers deface 1000+ Israeli websites in attempt to get webcam access
NSO Group Impersonates Facebook Security Team to Spread Spyware — Report
Chafer APT Hits Middle East Govs With Latest Cyber-Espionage Attacks
Apple and Google launch COVID-19 contact tracing API
blog | Hardening QEMU through continuous security testing

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

An update that fixes two vulnerabilities is now available.

An update that fixes three vulnerabilities is now available.

An update that fixes three vulnerabilities is now available.

**PHP version 7.3.18** (14 May 2020) **Core:** * Fixed bug php#78875 (Long filenames cause OOM and temp files are not cleaned). (**CVE-2019-11048**) (cmb) * Fixed bug php#78876 (Long variables in multipart/form-data cause OOM and temp files are not cleaned). (**CVE-2019-11048**) (cmb) * Fixed bug php#79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference on !CS […]

To test its security mid-pandemic, GitLab tried phishing its own work-from-home staff. 1 in 5 fell for it

security update

Long Tail Analysis: A New Hope in the Cybercrime Battle
Amid the pandemic, using trust to fight shadow IT

Several vulnerabilities were discovered in the Dovecot email server, which could cause crashes in the submission, submission-login or lmtp services, resulting in denial of service.

Hacker leaks 2.3 million Indonesian citizenship data for download
These things may be cool, but are they safe?

In the rush to embrace IoT devices, we shouldn’t trade in our privacy and security for the added convenience The post These things may be cool, but are they safe? appeared first on WeLiveSecurity

BlockFi hacked following SIM swap attack, but says no funds lost
Dark Web hackers publish 200GB of Toll Group’s stolen corporate data
Critical Cisco Bug in Unified CCX Allows Remote Code Execution
Silent Night Banking Trojan Charges Top Dollar on the Underground
Campaign groups warn GCHQ can re-identify UK’s phones from COVID-19 contact-tracing app data
Far-right leader walks free from court after conviction for refusing to hand his phone passcode over to police
Adobe “out of band” critical patch – get your update now!
210 days prison for crypto CEO who held 13k child abuse & beastiality files
Mitsubishi hackers may have stolen details of prototype missile
Scammers target COVID-19 CARES Act relief scheme
Supreme Court Phish Targets Office 365 Credentials
Crooks Tap Google Firebase in Fresh Phishing Tactic
Chrome 83 adds DNS-over-HTTPS support and privacy tweaks
DNS this week stands for Drowning Needed Services: Design flaw in name server system can be exploited to flood machines offline
Smashing Security podcast #179: Deepfake Jay-Z, and beer apps spilling your data
Zoom continues its catch-up security sprint with new training, bug bounty tweaks and promise of crypto playbook
Remember when Securus was sued for recording 14,000 calls between prison inmates and lawyers? It just settled

Several security issues were fixed in the Linux kernel.

New upstream release with fixes for CVEs and other enhancements.

New upstream release with fixes for CVEs and other enhancements.

New upstream release with fixes for CVEs and other enhancements.

This update includes a security fix for CVE-2020-10737. Additionally, From 0.34.6: – update license on src/buffer.h – changes “/var/run” to “/run” in systemd service file (Orion Poplawski, #1834511) From 0.34.5: – apply patch from Matthias Gerstner of the SUSE security team to fix a possible race condition in the mkhomedir helper (noted above, this fixes […]

REvil hackers allegedly sold Trump’s data now targeting food distributors

security update

Why typosquatting protection from coronavirus-themed registered domains is a must
NetWalker Ransomware Gang Hunts for Top-Notch Affiliates
Fraudulent Unemployment, COVID-19 Relief Claims Earn BEC Gang Millions
Police arrests man for selling massive combolists on hacker forums
UK’s Ministry of Defence: We’ll harvest and anonymise private COVID-19 apps’ tracing data by handing it to ‘behavioural science’ arm
Beware of emails with “horrible charts” about Covid-19
Ransomware has gone nuclear: To avoid any fallout yourself, tune in online this month to hear from KnowBe4
Houseparty denied it had been hacked… while miscreants were abusing its dot-com domain name infrastructure