Menu

Category Archives: All

Everything

No Patch for High-Severity Bug in Legacy IBM System X Servers
Don’t miss Predict 21 – Recorded Future’s intelligence summit, October 12-13 2021
WhatsApp announces end‑to‑end encrypted backups

The Facebook-owned messaging service plans to roll out the feature to both iOS and Android users in the coming weeks. The post WhatsApp announces end‑to‑end encrypted backups appeared first on WeLiveSecurity

What is a cyberattack surface and how can you reduce it?

Discover the best ways to mitigate your organization’s attack surface, in order to maximize cybersecurity. The post What is a cyberattack surface and how can you reduce it? appeared first on WeLiveSecurity

S3 Ep50: Two 0-days plus another 0-day plus a fast food bug [Podcast]

Squashfs-Tools could be made to overwrite files.

Attackers Impersonate DoT in Two-Day Phishing Scam
Ransomware crims saying ‘We’ll burn your data if you get a negotiator’ can’t be legally paid off anyway
Advanced automation and management of Network Bound Disk Encryption with RHEL System Roles

An update that fixes one vulnerability is now available.

An update that solves one vulnerability and has one errata is now available.

Several security issues were fixed in curl.

Squashfs-Tools could be made to overwrite files.

The container ses/7/rook/ceph was updated. The following patches have been included in this update:

Ex-US intel, military trio were cyber-mercenaries for UAE, say prosecutors
Microsoft’s end-of-summer software security cleanse crushes more than 80 bugs
Adobe Snuffs Critical Bugs in Acrobat, Experience Manager
Microsoft Patches Actively Exploited Windows Zero-Day Bug
2021’s Most Dangerous Software Weaknesses
Krita art app users targeted by ransomware posing as paid ‘collaboration’ opportunities
ZLoader’s Back, Abusing Google AdWords, Disabling Windows Defender
Beware of these 5 common scams you can encounter on Instagram

From cybercriminal evergreens like phishing to the verification badge scam we look at the most common tactics fraudsters use to trick their victims The post Beware of these 5 common scams you can encounter on Instagram appeared first on WeLiveSecurity

Security bods boost Apple iPhone hardware attack research with iTimed toolkit
Brits open doors for tech-enabled fraudsters because they ‘don’t want to seem rude’
Pair of Google Chrome Zero-Day Bugs Actively Exploited
Unpatched Bugs Plague Databases; Your Data Is Probably Not Secure – Podcast
Romance, BEC Scams Lands Soldier in Jail for 46 Months
Thousands of internet-connected databases contain high or critical CVEs, says report by cloud security biz

An update that fixes four vulnerabilities is now available.

BlackMatter Ransomware Hits Japanese Tech Giant Olympus

An update that fixes one vulnerability is now available.

An update that fixes four vulnerabilities is now available.

An update that fixes four vulnerabilities is now available.

Open-Source Tool of the Month: Uptycs Addresses Modern Cloud-Native & Containerization Security Challenges with its Uptycs Security Analytics Platform>
SPDX becomes internationally recognized standard>

The 5.13.15 stable kernel update contains a number of important fixes across the tree.

update to 1.1.1l

ExpressVPN bought for $1bn by Brit biz with an intriguing history in adware
Apple products vulnerable to FORCEDENTRY zero-day attack – patch now!
Apple emergency patches fix zero-click iMessage bug used to inject NSO spyware
Apple Issues Emergency Fix for NSO Zero-Click Zero Day
How a glitch in the Matrix led to apps potentially exposing encrypted chats
REvil’s Back; Coder Fat-Fingered Away Its Decryptor Key?
WhatsApp’s End-to-End Encryption Isn’t Actually Broken
Honing Cybersecurity Strategy When Everyone’s a Target for Ransomware
WooCommerce Multi Currency Bug Allows Shoppers to Change eCommerce Pricing
Serious Security: How to make sure you don’t miss bug reports!
“Foolish” university hacker jailed after selling exam papers to fellow students
Open redirect on UK council website was being used for Royal Mail-themed parcel payments scam

This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2 code base. NOTE: This advisory is informational only. There are no code changes

Time is running out for CentOS 8>
CloudLinux Adds TuxCare Support for CentOS 8 Through 2025>

This update upgrades Thunderbird to version 78.14.0. * Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 – thunderbird-78.14.0-1.el7_9.x86_64.rpm – thunderbird-debuginfo-78.1 [More…]

This update upgrades Firefox to version 78.14.0 ESR. * Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 – firefox-78.14.0-1.el7_9.i686.rpm – firefox-78.14.0-1.el7_9.x86_64.r [More…]

An update that contains security fixes can now be installed.

Several security issues were fixed in the kernel.

You can ‘go your own way’ over GDPR, says UK’s new Information Commissioner

Update to Chromium 93. There have been … a few security fixes since the last Fedora chromium update. This update fixes the following CVEs: CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30577 CVE-2021-30578 CVE-2021-30579 CVE-2021-30580 CVE-2021-30581

security update

It was found that the patch for CVE-2021-3592 introduced a regression which prevented ssh connections to the host system. Since there is no imminent solution for the problem, the patch for CVE-2021-3592 has been reverted. Updated qemu packages are now available to correct this issue.

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For the oldstable distribution (buster), this problem has been fixed

WhatsApp to offer end-to-end encrypted backups in iCloud, Google Drive with user-managed keys

security update

security update

security update

MyRepublic Data Breach Raises Data-Protection Questions
Top Steps for Ransomware Recovery and Preparation
Hey – how did you get in here? Number one app security weakness of 2021 was borked access control, says OWASP

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Yandex Pummeled by Potent Meris DDoS Botnet
SOVA, Worryingly Sophisticated Android Trojan, Takes Flight
5 Steps For Securing Your Remote Work Space

* New upstream version (92.0)

Update to latest upstream release 2.0.12

Applying DevSecOps practices to Kubernetes: software supply chain
Stolen Credentials Led to Data Theft at United Nations

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.

Ghostscript could be made to crash, access files, or run programs if it opened a specially crafted file.

It was discovered that Ghostscript, the GPL PostScript/PDF interpreter, does not properly validate access for the “%pipe%”, “%handle%” and “%printer%” io devices, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER

security update

Thousands of Fortinet VPN Account Credentials Leaked
McDonald’s Email Blast Includes Password to Monopoly Game Database
Howard University suffers cyberattack, suspends online classes in aftermath

The university suffered a ransomware attack, however there is no evidence so far of data being accessed or stolen. The post Howard University suffers cyberattack, suspends online classes in aftermath appeared first on WeLiveSecurity

Financial Cybercrime: Why Cryptocurrency is the Perfect ‘Getaway Car’
S3 Ep49: Poison PACs, pointless alarms and phunky bugs [Podcast]
‘Azurescape’ Kubernetes Attack Allows Cross-Container Cloud Compromise
SideWalk Backdoor Linked to China-Linked Spy Group ‘Grayfly’
Microsoft warns of a Windows zero-day security hole that is being actively exploited

Kevin Israel discovered that Postorius, the administrative web frontend for Mailman 3, didn’t validate whether a logged-in user owns the email address when unsubscribing.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.

Update to CVE release 3003.3-1 https://saltproject.io/security_announcements/salt-security- advisory-2021-sep-02/ CVE-2021-21996 CVE-2021-22004 CVE-2021-31607

Build of libtpms 0.8.5

8u302 update

Update to CVE release 3003.3-1 https://saltproject.io/security_announcements/salt-security- advisory-2021-sep-02/ CVE-2021-21996 CVE-2021-22004 CVE-2021-31607

Zoho Password Manager Zero-Day Bug Under Active Attack Gets a Fix
McDonald’s email blunder broadcasts database creds to comedy competition winners
BladeHawk Attackers Target Kurds with Android Apps
Why distroless containers aren’t the security solution you think they are
Hear me speak about endpoint security and ransomware at two free webinars next week
Smashing Security podcast #242: ProtonMail privacy questioned, and Banksy blunder