All posts in Uncategorized

■■■■■ Cloudflare has fixed a critical vulnerability in its free and open-source CDNJS potentially impacting 12.7% of all websites on the internet. CDNJS serves millions of websites with over 4,000 JavaScript and CSS libraries stored publicly on GitHub, making it the second-largest JavaScript CDN. https://www.bleepingcomputer.com/news/security/cloudflare-fixes-cdn-code-execution-bug-affecting-127-percent-of-all-sites/ https://t.me/cKure/8584

■■■■□ Zero-Day Attacks on Critical WooCommerce Bug Threaten Databases across wordpress platform. https://threatpost.com/zero-day-attacks-woocommerce-databases/167846/ https://t.me/cKure/8581

■■■■■ Microsoft, Google, Citizen Lab blow lid off zero-day bug-exploiting spyware sold to governments as 100+ dissidents, politicians, journos targeted by Israeli espionage toolkit https://go.theregister.com/feed/www.theregister.com/2021/07/16/microsoft_candiru_malware/ https://t.me/cKure/8579

■■■■□ CVE-2021-30563: Google has pushed out a new security update to Chrome browser for Windows, Mac, and Linux with multiple fixes, including a zero-day that it says is being exploited in the wild. https://thehackernews.com/2021/07/update-your-chrome-browser-to-patch-new.html https://t.me/cKure/8578

■■■■□ Facebook on Thursday disclosed it dismantled a “sophisticated” online cyber espionage campaign conducted by Iranian hackers targeting about 200 military personnel and companies in the defense and aerospace sectors in the U.S., U.K., and Europe using fake online personas on its platform. The social media giant pinned the attacks to a threat actor known as Tortoiseshell (aka Imperial…

■■■□□ Google Details iOS, Chrome, IE Zero-Day Flaws Exploited Recently in the Wild. https://thehackernews.com/2021/07/google-details-ios-chrome-ie-zero-day.html https://t.me/cKure/8576

■■□□□ Data-Leak / India as actor sells 4.2M record ‘Book my Show’ data online. https://t.me/cKure/8574

■■■■□ Safari Zero-Day Used in Malicious LinkedIn Campaign. Researchers shed light on how attackers exploited Apple web browser vulnerabilities to target government officials in Western Europe. https://threatpost.com/safari-zero-day-linkedin/167814/ https://t.me/cKure/8573

■□□□□ CVE to be assigned for the issue. It is a non typical case of privilege escalation via XXE. This is not a remote attack. https://t.me/cKure/8572

■■■□□ Linux PoC / Google. https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 https://t.me/cKure/8571