Menu

Monthly Archives: October 2022

Fashion brand SHEIN fined $1.9m for lying about data breach
Fine for Shein! Fashion site hit with $1.9 million bill after lying about data breach

This update fixes a wide range of vulnerabilities. A significant portion affects character set conversion. CVE-2016-10228

China-linked Budworm burrows hole in US legislature systems
Kolide, endpoint security for teams that want to meet SOC 2 compliance goals without sacrificing privacy
Choosing the Right Remote Access Solution for Your Linux Environment

An update that fixes 6 vulnerabilities is now available.

An update for .NET 6.0 is available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update for .NET 6.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

Phishing works so well crims won’t bother with deepfakes, says Sophos chap
Xi Jinping hails ‘improved cyber ecology’, says state to direct strategic tech research

security update

Multiple vulnerabilities have been discovered in Rust, the worst of which could result in denial of service.

Multiple vulnerabilities have been discovered in Tcpreplay, the worst of which could result in denial of service.

A vulnerability has been found in Deluge which could result in XSS.

Multiple vulnerabilities have been discovered in libvirt, the worst of which could result in denial of service.

Multiple vulnerabilities have been discovered in virglrenderer, the worst of which could result in remote code execution.

Multiple vulnerabilities have been discovered in Wireshark, the worst of which could result in denial of service.

Several security issues were fixed in the Linux kernel.

ESET research into POLONIUM’s arsenal – Week in security with Tony Anscombe

More than a dozen organizations operating in various verticals were attacked by the threat actor The post ESET research into POLONIUM’s arsenal – Week in security with Tony Anscombe appeared first on WeLiveSecurity

Infosec still (mostly) a boys club

Multiple security issues were found in Django, a Python web development framework, which could result in denial of service, SQL injection or cross-site scripting.

‘Baby Al Capone’ to pay $22m to SIM-swap crypto-heist victim

The package linux-zen before version 6.0.1.zen2-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

The package linux-lts before version 5.15.73-3 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

The package linux before version 6.0.1.arch2-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

The package linux-hardened before version 5.19.15.hardened2-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

security update

FYI: Microsoft Office 365 Message Encryption relies on insecure block cipher
Store credit card numbers in a debug log, lose millions of accounts. Cost? $1.9m
Serious Security: Microsoft Office 365 attacked over feeble encryption
Life in pursuit of answers: In the words of Ada Yonath

From a little girl financially helping her family in Jerusalem to a Nobel Prize laureate. That is the exceptional life of Ada Yonath in a nutshell. The post Life in pursuit of answers: In the words of Ada Yonath appeared first on WeLiveSecurity

Several security issues were fixed in gThumb.

An update that solves 8 vulnerabilities and has 12 fixes is now available.

An update that solves 8 vulnerabilities and has 11 fixes is now available.

An update that solves 5 vulnerabilities and has two fixes is now available.

An update that fixes one vulnerability is now available.

An update that solves 9 vulnerabilities, contains 12 features and has 38 fixes is now available.

Just how critical is data sovereignty?
LockBit 3.0 malware forced NHS tech supplier to shut down hosted sites
India set to extend deadline for absurd infosec reporting requirements
Mormon Church IT ransacked, data stolen by ‘state-sponsored’ cyber-thieves
Banks face their ‘darkest hour’ as malware steps up, maker of antivirus says

security update

How scammers target Zelle users – and how you can stay safe

Fraudsters use various tactics to separate people from their hard-earned cash on Zelle. Here’s how to keep your money safe while using the popular P2P payment service. The post How scammers target Zelle users – and how you can stay safe appeared first on WeLiveSecurity

S3 Ep104: Should hospital ransomware attackers be locked up for life? [Audio + Text]
Insurer Medibank hit by targeted cyberattack

Several security issues were fixed in unzip.

XML Security Library could be made to crash if it opened a specially crafted file.

Heat left by users’ fingertips could help hackers crack passwords, researchers claim

An update that fixes two vulnerabilities is now available.

An update is now available for the Red Hat build of Quarkus Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each

Get ready to defend your data against cyber warfare
Financial watchdogs want to know what traders are talking about on WhatsApp

An update that fixes one vulnerability is now available.

Scanning phones to detect child abuse evidence is harmful, ‘magical’ thinking

Red Hat OpenShift Container Platform release 4.8.51 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.8.

Prison inmate accused of orchestrating $11M fraud using cell cellphone
Smashing Security podcast #293: Massive crypto bungle, and the slave scammers
US election workers slammed with phishing, malware-stuffed emails
Hospital giant’s IT still poorly a week after suspected ransomware infection
Patch Tuesday in brief – one 0-day fixed, but no patches for Exchange!
POLONIUM targets Israel with Creepy malware

ESET researchers analyzed previously undocumented custom backdoors and cyberespionage tools deployed in Israel by the POLONIUM APT group The post POLONIUM targets Israel with Creepy malware appeared first on WeLiveSecurity

Microsoft tries to Ignite interest in DevOps cloud security tweaks
Internet outages hit Ukraine following Russian missile strikes

It was discovered that insufficient validation of “vnd.libreoffice.command” URI schemes could result in the execution of arbitrary macro commands.

Patch your iPhone now against mystery Mail crash bug

Several security issues were fixed in AdvanceCOMP.

A command injection vulnerability was found in Rexical, a lexical scanner generator for the Ruby programming language. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user

Multiple vulnerabilities were discovered in Nokogiri, an HTML/XML/SAX/Reader parser for the Ruby programming language, leading to command injection, XML external entity injection (XXE), and denial-of-service (DoS).

Red Hat AMQ Broker 7.10.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update for expat is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

How Wi-Fi spy drones snooped on financial firm
Crypto exchange Bittrex coughs up $53m to end claims of US sanctions busting
“Stealing the crown jewels” – see me talk at UK Cyber Week
It’s Patch Tuesday and still no fix for ProxyNotShell Microsoft Exchange holes
Steam account stolen? Here’s how to get it back

Has your Steam account been hacked? Here are the signs to look for and what you can do to get your account back. The post Steam account stolen? Here’s how to get it back appeared first on WeLiveSecurity

Move over Patch Tuesday – it’s Ada Lovelace Day!
China could use Digital Yuan to swerve Russia-style sanctions
If you’re wondering why Google blew $5b on Mandiant, this may shed some light

An update that fixes one vulnerability is now available.

An update that fixes 6 vulnerabilities is now available.

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

The Most Important Things you Can do to Quickly Secure Ubuntu Linux

An update for kernel is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Fortinet warns of critical flaw in its security appliance OSes, admin panels
Cloud security is the new battle zone
Kolide gives you real-time fleet visibility across Mac, Windows, and Linux, answering questions MDMs can’t
Can IAM help save on cyber insurance?
Optus data breach prompts pincer movement of twin regulatory probes
Toyota dev left key to customer info on public GitHub page for five years
Mystery iPhone update patches against iOS 16 mail crash-attack
Pro-Putin goons claim responsibility for blowing US airport websites offline
Intel Alder Lake BIOS code leak may contain vital secrets
Red Hat backs CNCF project, spills TEE support over Kubernetes
Endor Labs offers dependency management platform for open source software