Tag: cve
-
Microsoft Patches Xbox Vulnerability Following Public Disclosure
Microsoft patches Xbox Gaming Services vulnerability CVE-2024-28916 after initially saying it was not a security issue. The post t patches Xbox Gaming… First seen on securityweek.com Jump to article: www.securityweek.com/microsoft-patches-xbox-vulnerability-following-public-disclosure/
-
CVE-2023-48788: Fortinet FortiClientEMS SQL Injection Deep Dive
Introduction In a recent PSIRT, Fortinet acknowledged CVE-2023-48788 a SQL injection in FortiClient EMS that can lead to remote code execution. Forti… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/03/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive/
-
Aiohttp Vulnerability in Attacker Crosshairs
A recently patched Aiohttp vulnerability tracked as CVE-2024-23334 is being targeted by threat actors, including by a ransomware group. The post ly pa… First seen on securityweek.com Jump to article: www.securityweek.com/aiohttp-vulnerability-in-attacker-crosshairs/
-
Hackers exploit Aiohttp bug to find vulnerable networks
The ransomware actor ‘ShadowSyndicate’ was observed scanning for servers vulnerable to CVE-2024-23334, a directory traversal vulnerability in the aioh… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-aiohttp-bug-to-find-vulnerable-networks/
-
Kubernetes Vulnerability Let Attackers Take Full System Control
A new vulnerability, CVE-2023-5528, has been discovered with Kubernetes. This vulnerability is associated with a command injection vulnerability that … First seen on gbhackers.com Jump to article: gbhackers.com/kubernetes-vulnerability-full-system-control/
-
NIST National Vulnerability Database Disruption Sees CVE Enrichment on Hold
Vulnerability data has stopped being added to the most widely used software vulnerability database for over a month, putting organizations at risk an… First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nist-vulnerability-database/
-
Sicherheitsforscher genervt: Lücken-Datenbank NVD seit Wochen unvollständig
Die von der US-Regierung betriebene Datenbank reichert im CVE-System gemeldete Sicherheitslücken mit wichtigen Metadaten an. Das blieb seit Februar au… First seen on heise.de Jump to article: www.heise.de/news/Sicherheitsforscher-genervt-Luecken-Datenbank-NVD-seit-Wochen-unvollstaendig-9656574.html
-
Hackers Exploit Windows SmartScreen Vulnerability to Install DarkGate Malware
The operators of DarkGate successfully leveraged a patched Windows Defender SmartScreen vulnerability, identified as CVE-2024-21412, as a zero-day att… First seen on gbhackers.com Jump to article: gbhackers.com/hackers-exploit-windows-smartscreen/
-
PoC for critical Arcserve UDP vulnerabilities published (CVE-2024-0799, CVE-2024-0800)
Arcserve has fixed critical security vulnerabilities (CVE-2024-0799, CVE-2024-0800) in its Unified Data Protection (UDP) solution that can be chained … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/03/14/cve-2024-0799-cve-2024-0800/
-
Single RCE Bug Features Among 60 CVEs in March Patch Tuesday
First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/rce-bug-60-cves-patch-tuesday/
-
Magnet-Goblin Hackers Attack Public Services Using 1-Day Exploits
A new threat actor, Magnet Goblin, emerged by rapidly exploiting recently disclosed vulnerabilities (CVE-2023-46805 & CVE-2023-21887) in Ivanti Co… First seen on gbhackers.com Jump to article: gbhackers.com/magnet-goblin/
-
March 2024 Patch Tuesday: Microsoft fixes critical bugs in Windows Hyper-V
On this March 2024 Patch Tuesday, Microsoft has released fixes for 59 CVE-numbered vulnerabilities, but welcome news! none of them are currently pub… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/03/12/march-2024-patch-tuesday/
-
BianLian Hackers Hijacked TeamCity Servers To Install GO Backdoor
BianLian attackers exploited a TeamCity vulnerability (CVE-2024-27198 or CVE-2023-42793) to gain initial access and move laterally within the network…. First seen on gbhackers.com Jump to article: gbhackers.com/bianlians-go-backdoor/
-
Critical Fortinet flaw may impact 150,000 exposed devices
Scans on the public web show that approximately 150,000 Fortinet FortiOS and FortiProxy secure web gateway systems are vulnerable to CVE-2024-21762, a… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-fortinet-flaw-may-impact-150-000-exposed-devices/
-
LockBit Ransomware Affiliates Leverage Citrix Bleed Vulnerability (CVE-2023-4966)
Citrix Bleed is being leveraged by LockBit ransomware affiliates to compromise organizations using CVE-2023-4966. The post leed is being leveraged by … First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/03/lockbit-ransomware-affiliates-leverage-citrix-bleed-vulnerability-cve-2023-4966/
-
VMware patches critical flaws in ESXi, Workstation, Fusion and Cloud Foundation
VMware has fixed four vulnerabilities (CVE-2024-22252, CVE-2024-22253, CVE-2024-22254, CVE-2024-22255) in ESXi, Workstation, Fusion and Cloud Foundati… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/03/07/cve-2024-22252-cve-2024-22253/
-
Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)
Apple has fixed two iOS zero-day vulnerabilities (CVE-2024-23225, CVE-2024-23296) exploited by attackers in the wild. CVE-2024-23225 and CVE-2024-2329… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/03/06/cve-2024-23225-cve-2024-23296/
-
ScreenConnect flaws exploited to drop new ToddlerShark malware
The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a n… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/screenconnect-flaws-exploited-to-drop-new-toddlershark-malware/
-
ScreenConnect flaws exploited to drop new ToddleShark malware
The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a n… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/screenconnect-flaws-exploited-to-drop-new-toddleshark-malware/
-
Critical vulnerabilities in TeamCity JetBrains fixed, release of technical details imminent, patch quickly! (CVE-2024-27198, CVE-2024-27199)
JetBrains has fixed two critical security vulnerabilities (CVE-2024-27198, CVE-2024-27199) affecting TeamCity On-Premises and is urging customers to p… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/03/04/cve-2024-27198-cve-2024-27199/
-
Update für CVE-2024-0819 schnellstmöglich installieren! – Teamviewer-Sicherheitslücke ermöglicht Admin-Zugriff
First seen on security-insider.de Jump to article: www.security-insider.de/teamviewer-sicherheitsluecke-ermoeglicht-admin-zugriff-a-e63f09ddbaff6707f11a72e4e6e747ab/
-
Critical Atlassian Bug Exploit Now Available; Immediate Patching Needed
In-the-wild exploit activity from dozens of cyberattacker networks is ramping up for the security vulnerability in Confluence, tracked as CVE-2023-225… First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/critical-atlassian-bug-exploit-immediate-patching
-
Zero-Day Alert: Thousands of Cisco IOS XE Systems Now Compromised
Just a day after Cisco disclosed CVE-2023-20198, it remains unpatched, and one vendor says a Shodan scan shows at least 10,000 Cisco devices with an i… First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/ten-thousand-cisco-ios-xe-systems-compromised-zero-day-bug
-
ScreenConnect Authentication Bypass (CVE-2024-1709 CVE-2024-1708)
Uncover critical security flaws in ConnectWise ScreenConnect (CVE-2024-1709 & CVE-2024-1708) posing remote code execution risks. Actively exploite… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/02/screenconnect-authentication-bypass-cve-2024-1709-cve-2024-1708/
-
ScreenConnect flaws exploited to deliver all kinds of malware (CVE-2024-1709, CVE-2024-1708)
The recently patched vulnerabilities (CVE-2024-1709, CVE-2024-1708) in ConnectWise ScreenConnect software are being exploited by numerous attackers to… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/02/26/cve-2024-1709-exploited/
-
CVE count set to rise by 25% in 2024
The report from Coalition indicates an anticipated 25% rise in the total count of published common vulnerabilities and exposures (CVEs) for 2024, reac… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/02/26/cve-count-rise-2024/
-
Zero-Click Apple Shortcuts Vulnerability Allows Silent Data Theft
Vulnerability CVE-2024-23204, affecting Apple’s popular Shortcuts app, suggests a critical need for ongoing security awareness in the macOS and iOS ec… First seen on darkreading.com Jump to article: www.darkreading.com/application-security/zero-click-apple-shortcuts-vulnerability-allows-silent-data-theft
-
ConnectWise ScreenConnect Mass Exploitation Delivers Ransomware
Hundreds of initial access brokers and cybercrime gangs are jumping on the max-critical CVE-2024-1709 authentication bypass, threatening orgs and down… First seen on darkreading.com Jump to article: www.darkreading.com/remote-workforce/connectwise-screenconnect-mass-exploitation-delivers-ransomware
-
Attackers exploiting ConnectWise ScreenConnect flaws, fixes available for all users (CVE-2024-1709, CVE-2024-1708)
The two ScreenConnect vulnerabilities ConnectWise has recently urged customers to patch have finally been assigned CVE numbers: CVE-2024-1709 for the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/02/22/cve-2024-1709-cve-2024-1708/
-
CVE volumes set to increase 25% this year
The number of reported Common Vulnerabilities and Exposures is likely to grow significantly in 2024, hitting a new high of almost 35,000, according to… First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366570913/CVE-volumes-set-to-increase-25-this-year