WordPress Akismet Privacy Policies plugin <= 2.0.1- Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Akismet Privacy Policies plugin versions = 2.0.1. Solution Deactivate and delete. This plugin has been closed as of January 18, 2022 and is not available for download. This closure is temporary, pending a...

Mozilla Releases Security Updates for Multiple Products

Mozilla has released security updates to address vulnerabilities in multiple products. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Mozilla security advisory MFSA 2022-09 and apply the necessary updates...

Akismet Privacy Policies <= 2.0.1- Reflected Cross-Site Scripting

The plugin does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

Tips to protect your data, security, and privacy from a hands-on expert

This post was authored by one of the most active helpers on the Malwarebytes forums who wishes to remain anonymous. Back in the early days of personal computing, perhaps one of the only real concerns was data loss from a drive failure. That risk still exists, but we all face many other threats...

Researchers Demonstrate New Side-Channel Attack on Homomorphic Encryption

A group of academics from the North Carolina State University and Dokuz Eylul University have demonstrated what they say is the "first side-channel attack" on homomorphic encryption that could be exploited to leak data as the encryption process is underway. "Basically, by monitoring power...

NSA Releases Network Infrastructure Security Guidance

The National Security Agency NSA has released a new Cybersecurity Technical Report CTR: Network Infrastructure Security Guidance. The report captures best practices based on the depth and breadth of experience in supporting customers and responding to threats. Recommendations include perimeter an...

Biden wants stronger privacy protections, no targeted ads for children

On March 1, US President Joe Biden gave his first State of the Union Address SOTU speech to Congress. In it, Biden highlighted the dire need to get help for teens with mental health issues. He demanded tech companies implement more robust privacy protections for kids and teens using their online...

5 Ways to Determine if you do Cybersecurity or Cybersecurity Theater

For a sentient species, humans, in general, have curious ideas when it comes to reckoning and responding to risk. For example, studies show using seat belts when driving in automobiles save lives. Studies also show when cyclists use helmets more cyclists’ lives are saved. This research drives...

Powering and Protecting Online Privacy: iCloud Private Relay and Information for Akamai Customers

See how Apple worked with Akamai to launch iCloud Private Relay. Learn about the service and how it can be best leveraged for Akamai customers...

Google Releases Security Updates for Chrome

Google has released Chrome version 99.0.4844.51 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. CISA encourages users and administrators to review the Chrome Release Note and apply the necessary updates. Thi...

Data breaches leave customers very shaky, report says

Data breaches are one of the most reported cyberattacks against businesses—regardless of size and industry. And while this has highlighted cybersecurity gaps on so many fronts, some companies are still not prioritizing them as they should. Some have scrambled to be compliant but then find...

Covid app’s privacy information ruled not clear enough

The UKs data watchdog has issued a reprimand to both the Scottish government and NHS National Services Scotland about their Covid Status app. The Information Commissioners Office ICO urged both to act swiftly to address its concerns about the app that, according to the ICO, failed to provide peop...

How Crisis Text Line crossed the line in the public’s mind: Lock and Code S03E05

Last month, Politico reported that Crisis Text Line, a national mental health support nonprofit whose volunteers help people through text-based chats, was sharing those chats with a for-profit company that Crisis Text Line spun-off in an attempt to boost funding for itself. That for-profit ventur...

A week in security (February 21 – February 27)

Last week on Malwarebytes Labs: Potential cybersecurity impacts of Russia’s invasion of Ukraine Cyber lures and threats in the context of the war in Ukraine CISA warns of cyberespionage by Iranian APT “MuddyWater” Google and Microsoft accused of feeding smaller search engines spam ads Cyclops Bli...

WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin <= 3.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin versions = 3.1.0. Solution Update the WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin to the latest available version at least 3.2.0...

Broadcom Software Discloses APT Actors Deploying Daxin Malware in Global Espionage Campaign

Broadcom Software—an industry member of CISA’s Joint Cyber Defense Collaborative JCDC—uncovers an advanced persistent threat APT campaign against select governments and other critical infrastructure targets in a publication titled Daxin: Stealthy Backdoor Designed for Attacks Against Hardened...

WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin <= 3.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin versions = 3.1.0. Solution Update the WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin to the latest availab...

Insecure Storage of Sensitive Information

Vulnerability name: EXIF Geolocation Data Not Stripped From Uploaded Images vulnerability Description:- When the user uploads his profile picture, the uploaded image’s EXIF Geolocation Data does not get stripped. As a result, anyone can get sensitive information of microweber users like their...

CVE-2022-22908

Summary: CVE-2022-22908 affects Sangfor VDI Client (SangforCSClient.exe) 5.4.2.1006. The issue arises when an attacker can read the process memory, enabling disclosure of the contents of the Username and Password fields (credential leakage). The connected documents corroborate the affected produc...

CISA Releases Advisory on Destructive Malware Targeting Organizations in Ukraine

CISA and the Federal Bureau of Investigation have released an advisory on destructive malware targeting organizations in Ukraine. The advisory also provides recommendations and strategies to prepare for and respond to destructive malware. Additionally, CISA has created a new Shields Up Technical...