Cyber Security Alerts & Threat Intelligence

Chipmaker patches nine high-severity bugs in its Jetson SoC framework tied to the way it handles low-level cryptographic algorithms.

An unsophisticated campaign shows that the pandemic still has long legs when it comes to being social-engineering bait.

… until you reset network settings and stop connecting to a weirdly named network, that is. FUD is spreading. iOS Wi-Fi demolition is not.

Original release date: June 21, 2021   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info bloofox — bloofoxcms bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files). 2021-06-16 7.5 CVE-2020-35760 MISC google — android In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-177611958 2021-06-11 10 CVE-2021-0474 MISC google —…

What’s the low-hanging fruit for ransomware attackers? What steps could help to fend them off, and what’s stopping organizations from implementing those steps?

The intro-level networking gear for SMBs could allow remote attacks designed to steal information, drop malware and disrupt operations.

The incident showcases basic steps that organizations can take to protect themselves as ransomware gangs get smarter.

A supply-chain component lays open camera feeds to remote attackers thanks to a critical security vulnerability.

An attacker with initial physical access (say, at a gym) could gain root entry to the interactive tablet, making for a bevy of remote attack scenarios.

Original release date: June 15, 2021 Apple has released security updates to address vulnerabilities in iOS 12.5.4. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Apple security update and apply the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Apple patched two bugs impacting its Safari browser WebKit engine that it said are actively being exploited.

Attackers could have used the bug to get read/write privileges for a victim user’s email, Teams chats, OneDrive, Sharepoint and loads of other services.