December 2022 Patch Tuesday: Get Latest Security Updates from Microsoft and More

December 2022 Patch Tuesday: Get Latest Security Updates from Microsoft and More,

Tech giant Microsoft released its last set of monthly security updates for 2022 with fixes for 49 vulnerabilities across its software products.
Of the 49 bugs, six are rated Critical, 40 are rated Important, and three are rated Moderate in severity. The updates are in addition to 24 vulnerabilities that have been addressed in the Chromium-based Edge browser since the start of the month.

,

Tech giant Microsoft released its last set of monthly security updates for 2022 with fixes for 49 vulnerabilities across its software products.
Of the 49 bugs, six are rated Critical, 40 are rated Important, and three are rated Moderate in severity. The updates are in addition to 24 vulnerabilities that have been addressed in the Chromium-based Edge browser since the start of the month.

, ,
https://thehackernews.com/2022/12/december-2022-patch-tuesday-get-latest.html

Hackers Actively Exploiting Citrix ADC and Gateway Zero-Day Vulnerability

Hackers Actively Exploiting Citrix ADC and Gateway Zero-Day Vulnerability,

The U.S. National Security Agency (NSA) on Tuesday said a threat actor tracked as APT5 has been actively exploiting a zero-day flaw in Citrix Application Delivery Controller (ADC) and Gateway to take over affected systems.
The critical remote code execution vulnerability, identified as CVE-2022-27518, could allow an unauthenticated attacker to execute commands remotely on vulnerable devices and

,

The U.S. National Security Agency (NSA) on Tuesday said a threat actor tracked as APT5 has been actively exploiting a zero-day flaw in Citrix Application Delivery Controller (ADC) and Gateway to take over affected systems.
The critical remote code execution vulnerability, identified as CVE-2022-27518, could allow an unauthenticated attacker to execute commands remotely on vulnerable devices and

, ,
https://thehackernews.com/2022/12/hackers-actively-exploiting-citrix-adc.html

Attention, des applications Android « zombies » se propagent sur les smartphones

Attention, des applications Android « zombies » se propagent sur les smartphones,

Android malware virus

Des applications dites « zombies » se propagent sur les smartphones Android. D’après ThreatFabric, les pirates utilisent un programme malveillant pour cacher un malware dans le code d’applications populaires. Celui-ci s’empare ensuite de données sensibles…

,

Android malware virus

Des applications dites « zombies » se propagent sur les smartphones Android. D’après ThreatFabric, les pirates utilisent un programme malveillant pour cacher un malware dans le code d’applications populaires. Celui-ci s’empare ensuite de données sensibles…

, ,
https://www.01net.com/actualites/android-applications-zombies-propagent-smartphones.html

New Actively Exploited Zero-Day Vulnerability Discovered in Apple Products

New Actively Exploited Zero-Day Vulnerability Discovered in Apple Products,

Apple on Tuesday rolled out security updates to iOS, iPadOS, macOS, tvOS, and Safari web browser to address a new zero-day vulnerability that could result in the execution of malicious code.
Tracked as CVE-2022-42856, the issue has been described by the tech giant as a type confusion issue in the WebKit browser engine that could be triggered when processing specially crafted content, leading to

,

Apple on Tuesday rolled out security updates to iOS, iPadOS, macOS, tvOS, and Safari web browser to address a new zero-day vulnerability that could result in the execution of malicious code.
Tracked as CVE-2022-42856, the issue has been described by the tech giant as a type confusion issue in the WebKit browser engine that could be triggered when processing specially crafted content, leading to

, ,
https://thehackernews.com/2022/12/new-actively-exploited-zero-day.html

Google Launches Largest Distributed Database of Open Source Vulnerabilities

Google Launches Largest Distributed Database of Open Source Vulnerabilities,

Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects.
The Go-based tool, powered by the Open Source Vulnerabilities (OSV) database, is designed to connect « a project’s list of dependencies with the vulnerabilities that affect them, » Google software engineer Rex Pan in a post shared

,

Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects.
The Go-based tool, powered by the Open Source Vulnerabilities (OSV) database, is designed to connect « a project’s list of dependencies with the vulnerabilities that affect them, » Google software engineer Rex Pan in a post shared

, ,
https://thehackernews.com/2022/12/google-launches-largest-distributed.html

Serious Attacks Could Have Been Staged Through This Amazon ECR Public Gallery Vulnerability

Serious Attacks Could Have Been Staged Through This Amazon ECR Public Gallery Vulnerability,

A critical security flaw has been disclosed in Amazon Elastic Container Registry (ECR) Public Gallery that could have been potentially exploited to stage a multitude of attacks, according to cloud security firm Lightspin.
« By exploiting this vulnerability, a malicious actor could delete all images in the Amazon ECR Public Gallery or update the image contents to inject malicious code, » Gafnit

,

A critical security flaw has been disclosed in Amazon Elastic Container Registry (ECR) Public Gallery that could have been potentially exploited to stage a multitude of attacks, according to cloud security firm Lightspin.
« By exploiting this vulnerability, a malicious actor could delete all images in the Amazon ECR Public Gallery or update the image contents to inject malicious code, » Gafnit

, ,
https://thehackernews.com/2022/12/serious-attacks-could-have-been-staged.html

Cybersecurity Experts Uncover Inner Workings of Destructive Azov Ransomware

Cybersecurity Experts Uncover Inner Workings of Destructive Azov Ransomware,

Cybersecurity researchers have published the inner workings of a new wiper called Azov Ransomware that’s deliberately designed to corrupt data and « inflict impeccable damage » to compromised systems.
Distributed through another malware loader known as SmokeLoader, the malware has been described as an « effective, fast, and unfortunately unrecoverable data wiper, » by Israeli cybersecurity company

,

Cybersecurity researchers have published the inner workings of a new wiper called Azov Ransomware that’s deliberately designed to corrupt data and « inflict impeccable damage » to compromised systems.
Distributed through another malware loader known as SmokeLoader, the malware has been described as an « effective, fast, and unfortunately unrecoverable data wiper, » by Israeli cybersecurity company

, ,
https://thehackernews.com/2022/12/cybersecurity-experts-uncover-inner.html

Malware Strains Targeting Python and JavaScript Developers Through Official Repositories

Malware Strains Targeting Python and JavaScript Developers Through Official Repositories,

An active malware campaign is targeting the Python Package Index (PyPI) and npm repositories for Python and JavaScript with typosquatted and fake modules that deploy a ransomware strain, marking the latest security issue to affect software supply chains.
The typosquatted Python packages all impersonate the popular requests library: dequests, fequests, gequests, rdquests, reauests, reduests,

,

An active malware campaign is targeting the Python Package Index (PyPI) and npm repositories for Python and JavaScript with typosquatted and fake modules that deploy a ransomware strain, marking the latest security issue to affect software supply chains.
The typosquatted Python packages all impersonate the popular requests library: dequests, fequests, gequests, rdquests, reauests, reduests,

, ,
https://thehackernews.com/2022/12/malware-strains-targeting-python-and.html

Windows : ces 6 antivirus ont été détournés pour supprimer vos fichiers

Windows : ces 6 antivirus ont été détournés pour supprimer vos fichiers,

Antivirus gratuit

Lors de la conférence « Black Hat Europe », un chercheur en sécurité a révélé une vulnérabilité inédite (zero-day) qui touche plusieurs antivirus très populaires sous Windows. Une faille qui permet de détourner les logiciels pour effacer des fichiers système.

,

Antivirus gratuit

Lors de la conférence « Black Hat Europe », un chercheur en sécurité a révélé une vulnérabilité inédite (zero-day) qui touche plusieurs antivirus très populaires sous Windows. Une faille qui permet de détourner les logiciels pour effacer des fichiers système.

, ,
https://www.01net.com/actualites/windows-ces-6-antivirus-ont-ete-detournes-pour-supprimer-vos-fichiers.html

Cette application d’espionnage siphonne les données de milliers de smartphones

Cette application d’espionnage siphonne les données de milliers de smartphones,

espion

Des dizaines de milliers d’utilisateurs d’iPhone et de smartphones Android ont peut-être vu leurs données personnelles volées sans même le savoir. En cause, une application d’espionnage compromise par des failles de sécurité.

,

espion

Des dizaines de milliers d’utilisateurs d’iPhone et de smartphones Android ont peut-être vu leurs données personnelles volées sans même le savoir. En cause, une application d’espionnage compromise par des failles de sécurité.

, ,
https://www.01net.com/actualites/cette-application-despionnage-siphonne-les-donnees-de-milliers-de-smartphones.html