Cyber Security Alerts & Threat Intelligence

VMware explained it has no patch for a critical escalation-of-privileges bug that impacts both Windows and Linux operating systems and its Workspace One.

‘Vishing’ attack on GoDaddy employees gave fraudsters access to cryptocurrency service domains NiceHash, Liquid.

Original release date: November 23, 2020 VMware has released workarounds to address a vulnerability—CVE-2020-4006—in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency encourages users and administrators to review VMware Security Advisory VMSA-2020-0027 and apply the necessary workarounds. This product is provided subject to this Notification and this Privacy & Use policy.

Original release date: November 23, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info golang — go Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. 2020-11-18 7.5 CVE-2020-28367 MISC CONFIRM MLIST MLIST FEDORA golang — go Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. 2020-11-18…

The popular U.K. soccer club confirmed an attack but said personal fan data remains secure.

The critical and important-severity flaws were found by a team at the China-based Tiunfu Cup hacking challenge.

The company patched a vulnerability that could connected video and audio calls without the knowledge of the person receiving them.

Bug hunters at GitHub Security Labs help shore up German contact tracing app security, crediting open source collaboration.

The vulnerable version of the app, which has 100 million users, uses easily predictable URLs to link to private content.

Security experts praised the newly approved IoT law as a step in the right direction for insecure connected federal devices.

Original release date: November 19, 2020<br/><p>VMware has released security updates to address multiple vulnerabilities in VMware SD-WAN Orchestrator. An attacker could exploit some of these vulnerabilities to take control of an affected system.</p> <p>The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory <a href=”https://www.vmware.com/security/advisories/VMSA-2020-0025.html”>VMSA-2020-0025</a> and apply the necessary updates.</p> <div class=”field field–name-body field–type-text-with-summary field–label-hidden field–item”><p class=”privacy-and-terms”>This product is provided subject to this <a href=”https://us-cert.cisa.gov/privacy/notification”>Notification</a> and this <a href=”https://www.dhs.gov/privacy-policy”>Privacy &amp; Use</a> policy.</p> </div>

Original release date: November 19, 2020<br/><p>Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these vulnerabilities to take control of an affected system.</p> <p>The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Mozilla Security Advisories for <a href=”https://www.mozilla.org/en-US/security/advisories/mfsa2020-50″>Firefox 83</a>, <a href=”https://us-cert.cisa.gov https://www.mozilla.org/en-US/security/advisories/mfsa2020-51″>Firefox ESR 78.5</a>, and <a href=”https://www.mozilla.org/en-US/security/advisories/mfsa2020-52″>Thunderbird 78.5</a> and apply the necessary updates.</p> <div class=”field field–name-body field–type-text-with-summary field–label-hidden field–item”><p class=”privacy-and-terms”>This product is provided subject to this <a href=”https://us-cert.cisa.gov/privacy/notification”>Notification</a> and this <a href=”https://www.dhs.gov/privacy-policy”>Privacy &amp; Use</a> policy.</p> </div>