Artwork

内容由Paul Torgersen提供。所有播客内容(包括剧集、图形和播客描述)均由 Paul Torgersen 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品,您可以按照此处概述的流程进行操作https://zh.player.fm/legal
Player FM -播客应用
使用Player FM应用程序离线!

Drupal Updates, Zyxel Firewall Patches, Candiru’s DevilsTongue, and more.

3:03
 
分享
 

已归档的系列专辑 ("不活跃的收取点" status)

When? This feed was archived on May 25, 2023 16:09 (10M ago). Last successful fetch was on July 29, 2022 18:35 (1+ y ago)

Why? 不活跃的收取点 status. 我们的伺服器已尝试了一段时间,但仍然无法截取有效的播客收取点

What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.

Manage episode 335171095 series 2478053
内容由Paul Torgersen提供。所有播客内容(包括剧集、图形和播客描述)均由 Paul Torgersen 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品,您可以按照此处概述的流程进行操作https://zh.player.fm/legal
A daily look at the relevant information security news from overnight - 22 July, 2022
Episode 271 - 22 July 2022
Drupal Updates- https://www.securityweek.com/code-execution-and-other-vulnerabilities-patched-drupal
Zyxel Firewall Patches -
https://portswigger.net/daily-swig/zyxel-firewall-vulnerabilities-left-business-networks-open-to-abuse
PayPal Double Spear Phishing -
https://www.infosecurity-magazine.com/news/paypal-used-send-malicious-double/
Okta Too Open- https://threatpost.com/risks-okta-sso/180249/
Candiru’s DevilsTongue -
https://www.bleepingcomputer.com/news/security/chrome-zero-day-used-to-infect-journalists-with-candiru-spyware/
Hi, I’m Paul Torgersen. It’s Friday July 22nd, 2022, and from Victoria one last time, this is a look at the information security news from overnight.
From SecurityWeek.com:
Drupal has released patches for four vulnerabilities. The most critical flaw affects Drupal 9.3 and 9.4. and it can lead to arbitrary PHP code execution on Apache web servers. The other three vulnerabilities also impact the Drupal core and can lead to cross-site scripting attacks, information disclosure, or access bypass. Get your patch on kids.
From PortSwigger.net:
Zyxel has released patches for several of its firewall products following the discovery of two security vulnerabilities that left business networks open to exploitation. One is an authenticated directory traversal vulnerability in the Common Gateway Interface, and the other is a local privilege escalation vulnerability that was identified in the command-line interface. You should update to the latest versions as soon as you can.
From Infosecurity-Magazine.com:
Threat actors are using PayPal to send out phishing invoices. PayPal domains are usually “allow-listed” by organizations’ email filters, so cyber-criminals are registering accounts and composing malicious invoices on the platform. Many are spoofing Norton products, but substituting their own information for payments. They even have someone answering the included Customer Service number to continue the charade to extract dollars from their victims.
From ThreatPost.com:
Four newly discovered attack paths in the products for IAM vendor Okta could lead to PII exposure, account takeover, or even organizational data destruction. Note that the researchers call these “attack paths” and not vulnerabilities. Okta says this is a non issue and all you need to do is tweak up your security profile a little, which is beyond what they offer as their default settings. You can see the details in the article.
And last, from BleepingComputer.com:
The Israeli spyware vendor Candiru was found using a Google Chrome zero day to spy on journalists and other high-interest individuals in the Middle East with their 'DevilsTongue' spyware. Threat researchers from Avast, who discovered the vulnerability and reported it to Google, revealed that they unearthed the flaw after investigating spyware attacks on their clients. The vuln was patched on July 4. Details and a link to the research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until next next time, be safe out there.
  continue reading

221集单集

Artwork
icon分享
 

已归档的系列专辑 ("不活跃的收取点" status)

When? This feed was archived on May 25, 2023 16:09 (10M ago). Last successful fetch was on July 29, 2022 18:35 (1+ y ago)

Why? 不活跃的收取点 status. 我们的伺服器已尝试了一段时间,但仍然无法截取有效的播客收取点

What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.

Manage episode 335171095 series 2478053
内容由Paul Torgersen提供。所有播客内容(包括剧集、图形和播客描述)均由 Paul Torgersen 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品,您可以按照此处概述的流程进行操作https://zh.player.fm/legal
A daily look at the relevant information security news from overnight - 22 July, 2022
Episode 271 - 22 July 2022
Drupal Updates- https://www.securityweek.com/code-execution-and-other-vulnerabilities-patched-drupal
Zyxel Firewall Patches -
https://portswigger.net/daily-swig/zyxel-firewall-vulnerabilities-left-business-networks-open-to-abuse
PayPal Double Spear Phishing -
https://www.infosecurity-magazine.com/news/paypal-used-send-malicious-double/
Okta Too Open- https://threatpost.com/risks-okta-sso/180249/
Candiru’s DevilsTongue -
https://www.bleepingcomputer.com/news/security/chrome-zero-day-used-to-infect-journalists-with-candiru-spyware/
Hi, I’m Paul Torgersen. It’s Friday July 22nd, 2022, and from Victoria one last time, this is a look at the information security news from overnight.
From SecurityWeek.com:
Drupal has released patches for four vulnerabilities. The most critical flaw affects Drupal 9.3 and 9.4. and it can lead to arbitrary PHP code execution on Apache web servers. The other three vulnerabilities also impact the Drupal core and can lead to cross-site scripting attacks, information disclosure, or access bypass. Get your patch on kids.
From PortSwigger.net:
Zyxel has released patches for several of its firewall products following the discovery of two security vulnerabilities that left business networks open to exploitation. One is an authenticated directory traversal vulnerability in the Common Gateway Interface, and the other is a local privilege escalation vulnerability that was identified in the command-line interface. You should update to the latest versions as soon as you can.
From Infosecurity-Magazine.com:
Threat actors are using PayPal to send out phishing invoices. PayPal domains are usually “allow-listed” by organizations’ email filters, so cyber-criminals are registering accounts and composing malicious invoices on the platform. Many are spoofing Norton products, but substituting their own information for payments. They even have someone answering the included Customer Service number to continue the charade to extract dollars from their victims.
From ThreatPost.com:
Four newly discovered attack paths in the products for IAM vendor Okta could lead to PII exposure, account takeover, or even organizational data destruction. Note that the researchers call these “attack paths” and not vulnerabilities. Okta says this is a non issue and all you need to do is tweak up your security profile a little, which is beyond what they offer as their default settings. You can see the details in the article.
And last, from BleepingComputer.com:
The Israeli spyware vendor Candiru was found using a Google Chrome zero day to spy on journalists and other high-interest individuals in the Middle East with their 'DevilsTongue' spyware. Threat researchers from Avast, who discovered the vulnerability and reported it to Google, revealed that they unearthed the flaw after investigating spyware attacks on their clients. The vuln was patched on July 4. Details and a link to the research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until next next time, be safe out there.
  continue reading

221集单集

所有剧集

×
 
Loading …

欢迎使用Player FM

Player FM正在网上搜索高质量的播客,以便您现在享受。它是最好的播客应用程序,适用于安卓、iPhone和网络。注册以跨设备同步订阅。

 

快速参考指南