Tag: cisa
-
CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation
Tags: access, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday placed two security flaws impacting Microsoft Partner Center and Synacor Zimbra Collaboration Suite (ZCS) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerabilities in question are as follows -CVE-2024-49035 (CVSS score: 8.7) – An improper access control First seen on…
-
Incoming deputy head of Homeland Security says CISA needs to be reined in
Tags: cisaPlus: New figurehead of DOGE emerges and they aren’t called Elon First seen on theregister.com Jump to article: www.theregister.com/2025/02/26/dhs_cisa_doge/
-
Active Exploitation Of Craft CMS Flaw Under Way
First seen on scworld.com Jump to article: www.scworld.com/brief/cisa-active-exploitation-of-craft-cms-flaw-under-way
-
Trump’s CISA Cutbacks Worry Cybersecurity Pros
First seen on scworld.com Jump to article: www.scworld.com/brief/trumps-cisa-cutbacks-worry-cybersecurity-pros
-
CISA Confirms Microsoft Partner Center Flaw Exploited In Attacks
A ‘critical’ vulnerability in Microsoft’s partner program website has seen exploitation in cyberattacks, according to CISA. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-confirms-microsoft-partner-center-flaw-exploited-in-attacks
-
Critical deserialization bugs in Adobe, Oracle software actively exploited, warns CISA
Oracle Agile PLM flaw open to N-days: The other vulnerability, fixed in January 2024, is a high severity (CVSS 8.8/10) flaw in the export component of the Oracle’s PLM software, and stems from the improper handling of serialized data. It’s tracked as CVE-2024-20953. Successful exploitation could enable a low-privileged attacker with network access via HTTP…
-
CISA Warns of Attacks Exploiting Oracle Agile PLM Vulnerability
CISA has added CVE-2024-20953, an Oracle Agile PLM vulnerability patched in January 2024, to its KEV catalog. The post CISA Warns of Attacks Exploiting Oracle Agile PLM Vulnerability appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cisa-warns-of-attacks-exploiting-oracle-agile-plm-vulnerability/
-
U.S. CISA adds Adobe ColdFusion and Oracle Agile PLM flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM)vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)added SonicWall SonicOS and Palo Alto PAN-OS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The two vulnerabilities are: CVE-2017-3066(CVSS score of 9.8) is a…
-
CISA KEV Catalog Updated with Adobe ColdFusion and Oracle Agile PLM Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) catalog by adding two significant security flaws one affecting Adobe ColdFusion and the other impacting Oracle Agile Product Lifecycle Management (PLM). CVE-2017-3066 in… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cisa-kev-catalog-adobe-coldfusion-oracle-vulnerabilities/
-
CISA Warns of Actively Exploited Adobe ColdFusion and Oracle Agile PLM Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) Catalog by adding two critical vulnerabilities, both actively being exploited in the wild. These vulnerabilities, related to Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM), have been identified as security risks to federal agencies and organizations worldwide. First seen…
-
CISA Alerts: Oracle Agile Vulnerability Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding active exploitation of a severe deserialization vulnerability (CVE-2024-20953) in Oracle Agile Product Lifecycle Management (PLM) software. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on February 24, 2025, the flaw allows attackers with low-privileged access to execute arbitrary code on unpatched…
-
Two Actively Exploited Security Flaws in Adobe and Oracle Products Flagged by CISA
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws impacting Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerabilities in question are listed below -CVE-2017-3066 (CVSS score: 9.8) – A deserialization vulnerability impacting First seen on thehackernews.com…
-
US Dept of Housing screens sabotaged to show deepfake of Trump sucking Elon’s toes
‘Appropriate action will be taken,’ we’re told as federal HR email sparks uproar, ax falls on CISA staff First seen on theregister.com Jump to article: www.theregister.com/2025/02/24/hud_trump_toe_sucking/
-
Active exploitation of Craft CMS flaw underway
First seen on scworld.com Jump to article: www.scworld.com/brief/cisa-active-exploitation-of-craft-cms-flaw-underway
-
Why we need an expanded CISA to fight today’s cyber threats
First seen on scworld.com Jump to article: www.scworld.com/perspective/why-we-need-an-expanded-cisa-to-fight-todays-cyber-threats
-
ISAC chief on CISA security rollbacks: ‘The sky isn’t falling, yet’
Tags: cisaFirst seen on scworld.com Jump to article: www.scworld.com/feature/isac-chief-on-cisa-election-security-rollbacks-the-sky-isnt-falling
-
FBI and CISA warn about continuing attacks by Chinese ransomware group Ghost
Attacks are more focused on encryption than exfiltration: The Ghost attackers have sometimes exfiltrated data back to their Cobalt Strike Team servers or to the Mega.nz file-sharing service, but this has been rare and the amount of information stolen has been limited.According to FBI investigations, the group doesn’t regularly exfiltrate intellectual property or personally identifiable…
-
No, that’s not the acting head of the Social Security Administration. That’s a former CISA employee.
As CISA removes anti-disinformation personnel, one of its own former employees has fallen victim to a case of mistaken identity. First seen on cyberscoop.com Jump to article: cyberscoop.com/leland-dudek-ross-foard-social-security-cisa-misinformation/
-
CISA flags Craft CMS code injection flaw as exploited in attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns that a Craft CMS remote code execution flaw is being exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-flags-craft-cms-code-injection-flaw-as-exploited-in-attacks/
-
Firing of 130 CISA staff worries cybersecurity industry
Cybersecurity concerns: Alexander Garcia-Tobar, CEO of email authentication provider Valimail, said the new administration’s actions are causing significant concern among security professionals. “Many of us are advocating for cybersecurity to be seen as the bi-partisan effort it should be,” he said via emai, but “the Trump administration has taken a sledgehammer to cancelling or disbanding…
-
Cybersecurity-Experten der US-Regierung entlassen
Doge hat Zugang zur US-Behörde für Cybersicherheit und pausiert die Bekämpfung von Falschinformation sowie die Sicherung der Wahlen. First seen on golem.de Jump to article: www.golem.de/news/cisa-cybersecurity-experten-der-us-regierung-entlassen-2502-193595.html
-
CISA Warns of Attacks Exploiting Craft CMS Vulnerability
CISA has added a Craft CMS flaw tracked as CVE-2025-23209 to its Known Exploited Vulnerabilities (KEV) catalog. The post CISA Warns of Attacks Exploiting Craft CMS Vulnerability appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cisa-warns-of-attacks-exploiting-craft-cms-vulnerability/
-
U.S. CISA adds Craft CMS and Palo Alto Networks PAN-OS flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Craft CMS and Palo Alto Networks PAN-OS vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SonicWall SonicOS and Palo Alto PAN-OS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The two vulnerabilities are: Craft is a flexible, user-friendly CMS, affected…
-
CISA, FBI warn of Ghost/Cring ransomware attacks
Ghost is a China-based financially motivated ransomware group that has launched attacks against organizations in more than 70 countries — including its own. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619496/CISA-FBI-warn-of-Ghost-Cring-ransomware-attacks
-
CISA and FBI Warn of Global Threat from Ghost Ransomware
CISA and the FBI have released a joint advisory detailing the activity of China’s Ghost ransomware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-fbi-warn-global-threat-ghost/
-
Ghost ransomware crew continues to haunt IT depts with scarily bad infosec
FBI and CISA issue reminder – deep sigh – about the importance of patching and backups First seen on theregister.com Jump to article: www.theregister.com/2025/02/20/fbi_beware_of_ghost_ransomware/
-
CISA FBI Warns that Ghost Ransomware Hits Over 70 Organizations
Tags: advisory, cisa, cyber, cybersecurity, government, healthcare, infrastructure, network, ransomwareThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued a joint advisory warning about the widespread impact of the Ghost ransomware, also known as Cring. Since its emergence in early 2021, this ransomware has compromised over 70 organizations globally, spanning critical infrastructure, healthcare, education, government networks, and private…
-
CISA and FBI Issue Alert as Ghost Ransomware Targets 70+ Organizations
Tags: access, advisory, cisa, cyber, cybersecurity, exploit, infrastructure, malicious, ransomware, software, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued a joint advisory warning about the increasing threat posed by Ghost ransomware. This malicious campaign has already impacted more than 70 organizations across various sectors, exploiting vulnerabilities in widely-used software to gain access to targeted networks. Exploitation of Vulnerabilities…
-
Patch Now: CISA Warns of Palo Alto Flaw Exploited in the Wild
The authentication bypass vulnerability in the OS for the company’s firewall devices is under increasing attack and being chained with other bugs, making it imperative for organizations to mitigate the issue ASAP. First seen on darkreading.com Jump to article: www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild