Tag: cve
-
PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)
Horizon3.ai researches have released proof-of-concept (PoC) exploits for CVE-2024-23108 and CVE-2023-34992, vulnerabilities that allow remote, unauthe… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/29/cve-2024-23108-cve-2023-34992-poc/
-
NIST Getting Outside Help for National Vulnerability Database
NIST is receiving support to get the NVD and CVE processing back on track within the next few months. The post receiving support to get the NVD and CV… First seen on securityweek.com Jump to article: www.securityweek.com/nist-getting-outside-help-for-national-vulnerability-database/
-
CVE-2023-47610 – Sicherheitslücken in Cinterion-Modems gefunden
Tags: cveFirst seen on security-insider.de Jump to article: www.security-insider.de/sicherheitsforscher-entdecken-gefaehrliche-schwachstellen-bei-cinterion-modems-a-41e0b207f49b227e47800cf502aa4107/
-
Experts released PoC exploit code for RCE in Fortinet SIEM
Researchers released a proof-of-concept (PoC) exploit for remote code execution flaw CVE-2024-23108 in Fortinet SIEM solution. Security researchers at… First seen on securityaffairs.com Jump to article: securityaffairs.com/163797/hacking/fortinet-siem-critical-rce-poc.html
-
Check Point VPN Attacks Involve Zero-Day Exploited Since April
The recently disclosed Check Point VPN attacks involve the zero-day vulnerability CVE-2024-24919, which allows hackers to obtain passwords. The post n… First seen on securityweek.com Jump to article: www.securityweek.com/check-point-vpn-attacks-involve-zero-day-exploited-since-april/
-
PoC Exploit Released For macOS Privilege Escalation Vulnerability
A new vulnerability has been discovered in macOS Sonoma that is associated with privilege escalation. This vulnerability has been assigned with CVE-20… First seen on gbhackers.com Jump to article: gbhackers.com/poc-exploit-macos-privilege-escalation/
-
Defending Your Commits From Known CVEs With GitGuardian SCA And Git Hooks
Tags: cveAll developers want to create secure and dependable software. They should feel proud to release their code with the full confidence they did not intro… First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/defending-your-commits-from-known-cves.html
-
Google Patches Chrome Zero-Day: Type Confusion in V8 JavaScript
Google has released a patch for a zero-day exploit in its Chrome browser. The vulnerability, identified as CVE-2024-5274, involves a confusion issue i… First seen on gbhackers.com Jump to article: gbhackers.com/patches-chrome-zero-day/
-
New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs
A new report from XM Cyber has found among other insights – a dramatic gap between where most organizations focus their security efforts, and where th… First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/new-xm-cyber-research-80-of-exposures.html
-
Google Patches Fourth Chrome Zero-Day in Two Weeks
Exploited in the wild, Chrome vulnerability CVE-2024-5274 is a high-severity flaw described as a type confusion in the V8 JavaScript and WebAssembly e… First seen on securityweek.com Jump to article: www.securityweek.com/google-patches-fourth-chrome-zero-day-in-two-weeks/
-
Schwachstellen im ZScaler Client Connector
Noch eine kurze Information für Leser, die den Client-Connector von ZScaler in ihrer Umgebung einsetzen. Dort sind gleich drei Schwachstellen CVE-2023… First seen on borncity.com Jump to article: www.borncity.com/blog/2024/05/28/schwachstellen-im-zscaler-client-connector/
-
New Chrome Zero-Day Vulnerability CVE-2024-4761 Under Active Exploitation
Google on Monday shipped emergency fixes to address a new zero-day flaw in the Chrome web browser that has come under active exploitation in the wild…. First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/new-chrome-zero-day-vulnerability-cve.html
-
GitHub warns of SAML auth bypass flaw in Enterprise Server
GitHub has fixed a maximum severity (CVSS v4 score: 10.0) authentication bypass vulnerability tracked as CVE-2024-4986, which impacts GitHub Enterpris… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-warns-of-saml-auth-bypass-flaw-in-enterprise-server/
-
PoC exploit for Ivanti EPMM privilege escalation flaw released (CVE 2024-22026)
Technical details about and a proof-of-concept (PoC) exploit for CVE-2024-22026, a privilege escalation bug affecting Ivanti EPMM, has been released b… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/20/cve-2024-22026-poc/
-
CISA Warns of Attacks Exploiting NextGen Healthcare Mirth Connect Flaw
CISA has added CVE-2023-43208, an unauthenticated remote code execution vulnerability, to its KEV catalog. The post added CVE-2023-43208, an unauthen… First seen on securityweek.com Jump to article: www.securityweek.com/cisa-warns-of-attacks-exploiting-nextgen-healthcare-mirth-connect-flaw/
-
Chrome Zero-Day Alert, Update Your Browser to Patch New Vulnerability
Google on Thursday released security updates to address a zero-day flaw in Chrome that it said has been actively exploited in the wild.Tracked as CVE-… First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/chrome-zero-day-alert-update-your.html
-
Critical Git Vulnerability Let Attackers Execute Remote Code : PoC Published
A critical remote code execution vulnerability has been discovered in the git clone which was assigned with CVE-2024-32002 and the severity has been g… First seen on gbhackers.com Jump to article: gbhackers.com/git-flaw-remote-code-execution/
-
CVE-2023-34992: Fortinet FortiSIEM Command Injection Deep-Dive
In early 2023, given some early success in auditing Fortinet appliances, I continued the effort and landed upon the Fortinet FortiSIEM. Several issues… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/05/cve-2023-34992-fortinet-fortisiem-command-injection-deep-dive/
-
Mitre breached by nation-state threat actor via Ivanti flaws
An unnamed nation-state threat actor breached Mitre through two Ivanti Connect Secure zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, dis… First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366581853/Mitre-breached-by-nation-state-threat-actor-via-Ivanti-flaws
-
Critical Flaw in AI Python Package Can Lead to System and Data Compromise
A critical vulnerability tracked as CVE-2024-34359 and dubbed Llama Drama can allow hackers to target AI product developers. The post al vulnerability… First seen on securityweek.com Jump to article: www.securityweek.com/critical-flaw-in-ai-python-package-can-lead-to-system-and-data-compromise/
-
NIST Confusion Continues as Cyber Pros Complain CVE Uploads Stalled
Several software security experts have told Infosecurity that no new vulnerabilities have been added to the US National Vulnerability Database (NVD) s… First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nist-cve-stop-questioned/
-
Dangerous Google Chrome Zero-Day Allows Sandbox Escape
Exploit code is circulating for CVE-2024-4761, disclosed less than a week after a similar security vulnerability was disclosed as being used in the wi… First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/dangerous-google-chrome-zero-day-sandbox-escape
-
Microsoft Windows DWM Zero-Day Poised for Mass Exploit
CVE-2024-30051, under active exploit, is the most concerning out of this month’s Patch Tuesday offerings, and already being abused by several QakBot a… First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/microsoft-windows-dwm-zero-day-mass-exploit
-
May 2024 Patch Tuesday: Microsoft fixes exploited zero-days (CVE-2024-30051, CVE-2024-30040)
For May 2024 Patch Tuesday, Microsoft has released fixes for 59 CVE-numbered vulnerabilities, including two zero-days (CVE-2024-30051, CVE-2024-30040)… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/14/patch-tuesday-cve-2024-30051-cve-2024-30040/
-
Apple backports iOS zero-day patch, adds Bluetooth tracker alert
Apple has backported the patch for CVE-2024-23296 to the iOS 16 branch and has fixed a bug (CVE-2024-27852) in MarketplaceKit that may allow malicious… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/14/ios-bluetooth-tracker-alert/
-
Log4Shell shows no sign of fading, spotted in 30% of CVE exploits
Organizations continue to run insecure protocols across their wide access networks (WAN), making it easier for cybercriminals to move across networks,… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/14/log4j-wan-insecure-protocols/
-
Veeam Schwachstelle CVE-2024-29212 (Mai 2024)
Kleiner Nachtrag von dieser Woche. Veeam, der Anbieter von Backup-Lösungen hat die Woche (7. Mai 2024) eine Sicherheitswarnung veröffentlicht. In älte… First seen on borncity.com Jump to article: www.borncity.com/blog/2024/05/12/veeam-schwachstelle-cve-2024-29212-mai-2024/
-
Google fixes Chrome zero-day with in-the-wild exploit (CVE-2024-4671)
Google has fixed a Chrome zero-day vulnerability (CVE-2024-4671), an exploit for which exists in the wild. About CVE-2024-4671 CVE-2024-4671 is a use … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/10/cve-2024-4671/
-
Log4J shows no sign of fading, spotted in 30% of CVE exploits
Organizations continue to run insecure protocols across their wide access networks (WAN), making it easier for cybercriminals to move across networks,… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/05/14/log4j-wan-insecure-protocols/
-
Microsoft Edge Zero-Day Vulnerability Exploited in the Wild
A zero-day vulnerability in Microsoft Edge, which has been tagged as CVE-2024-4671, has been aggressively exploited by evil organizations, according t… First seen on gbhackers.com Jump to article: gbhackers.com/microsoft-edge-zero-day-2/