Collecting Cyber-News from over 60 sources

Tag: flaw

Actively exploited firewall flaws now abused for DoS attacks

Nov 7, 2025 5:19 PM

Tags: attack, cisco, dos, exploit, firewall, flaw, vulnerability, zero-day

Cisco warned this week that two vulnerabilities, which have been exploited in zero-day attacks, are now being abused to force ASA and FTD firewalls into reboot loops. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-actively-exploited-firewall-flaws-now-abused-for-dos-attacks/
Actively exploited firewall flaws now abused for DoS attacks

Nov 7, 2025 5:19 PM

Tags: attack, cisco, dos, exploit, firewall, flaw, vulnerability, zero-day

Cisco warned this week that two vulnerabilities, which have been exploited in zero-day attacks, are now being abused to force ASA and FTD firewalls into reboot loops. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-actively-exploited-firewall-flaws-now-abused-for-dos-attacks/
Cisco Issues Critical Warning Over New Unified Contact Center Express Vulnerabilities

Nov 7, 2025 3:19 PM

Tags: access, advisory, authentication, cisco, flaw, vulnerability

Cisco has issued an urgent security advisory detailing two critical vulnerabilities affecting its Unified Contact Center Express (Unified CCX) platform. The flaws, identified as CVE-2025-20354 and CVE-2025-20358, could allow unauthenticated remote attackers to execute arbitrary code, bypass authentication, and potentially gain root-level access to affected systems. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisco-warns-of-cve-2025-20354/
Cisco Issues Critical Warning Over New Unified Contact Center Express Vulnerabilities

Nov 7, 2025 3:19 PM

Tags: access, advisory, authentication, cisco, flaw, vulnerability

Cisco has issued an urgent security advisory detailing two critical vulnerabilities affecting its Unified Contact Center Express (Unified CCX) platform. The flaws, identified as CVE-2025-20354 and CVE-2025-20358, could allow unauthenticated remote attackers to execute arbitrary code, bypass authentication, and potentially gain root-level access to affected systems. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisco-warns-of-cve-2025-20354/
Critical CVE-2025-12779 Vulnerability Exposes Amazon WorkSpaces for Linux Users to Token Theft

Nov 7, 2025 3:19 PM

Tags: access, authentication, cve, flaw, linux, theft, unauthorized, vulnerability

A newly disclosed security flaw in the Amazon WorkSpaces client for Linux has raised serious concerns across organizations relying on AWS virtual desktop infrastructure. The vulnerability, identified as CVE-2025-12779, enables local attackers to extract valid authentication tokens and gain unauthorized access to other users’ WorkSpace sessions. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/amazon-workspaces-cve-2025-12779/
Critical CVE-2025-12779 Vulnerability Exposes Amazon WorkSpaces for Linux Users to Token Theft

Nov 7, 2025 3:19 PM

Tags: access, authentication, cve, flaw, linux, theft, unauthorized, vulnerability

A newly disclosed security flaw in the Amazon WorkSpaces client for Linux has raised serious concerns across organizations relying on AWS virtual desktop infrastructure. The vulnerability, identified as CVE-2025-12779, enables local attackers to extract valid authentication tokens and gain unauthorized access to other users’ WorkSpace sessions. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/amazon-workspaces-cve-2025-12779/
Ollama, Nvidia Flaws Put AI Infrastructure at Risk

Nov 7, 2025 3:19 PM

Tags: ai, flaw, infrastructure, nvidia, risk, vulnerability

Security researchers discovered multiple vulnerabilities in AI infrastructure products, including one capable of remote code execution. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/ollama-nvidia-flaws-ai-infrastructure-risk
Critical CVE-2025-12779 Vulnerability Exposes Amazon WorkSpaces for Linux Users to Token Theft

Nov 7, 2025 3:19 PM

Tags: access, authentication, cve, flaw, linux, theft, unauthorized, vulnerability

A newly disclosed security flaw in the Amazon WorkSpaces client for Linux has raised serious concerns across organizations relying on AWS virtual desktop infrastructure. The vulnerability, identified as CVE-2025-12779, enables local attackers to extract valid authentication tokens and gain unauthorized access to other users’ WorkSpace sessions. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/amazon-workspaces-cve-2025-12779/
9 top bug bounty programs launched in 2025

Nov 7, 2025 2:20 PM

Tags: ai, api, apple, attack, best-practice, browser, bug-bounty, chatgpt, chrome, cloud, computer, corporate, cyber, cybersecurity, data, defense, exploit, finance, flaw, framework, google, government, hacker, hacking, healthcare, identity, infrastructure, injection, intelligence, iphone, macOS, microsoft, mitigation, mobile, nis-2, nvidia, openai, phishing, risk, service, spyware, strategy, technology, theft, threat, unauthorized, update, vulnerability, zero-day

Bug bounty programs focus in 2025: For ethical hackers, best practice for bug bounty hunting in 2025 involves thorough reconnaissance of a target organization’s technology stack, rather than just running automated tools.Leading bug bounty platforms such as Bugcrowd, HackerOne, Synack, YesWeHack, and Intigriti offer rewards for identifying and reporting security vulnerabilities. Platforms connect ethical hackers…
9 top bug bounty programs launched in 2025

Nov 7, 2025 2:20 PM

Tags: ai, api, apple, attack, best-practice, browser, bug-bounty, chatgpt, chrome, cloud, computer, corporate, cyber, cybersecurity, data, defense, exploit, finance, flaw, framework, google, government, hacker, hacking, healthcare, identity, infrastructure, injection, intelligence, iphone, macOS, microsoft, mitigation, mobile, nis-2, nvidia, openai, phishing, risk, service, spyware, strategy, technology, theft, threat, unauthorized, update, vulnerability, zero-day

Bug bounty programs focus in 2025: For ethical hackers, best practice for bug bounty hunting in 2025 involves thorough reconnaissance of a target organization’s technology stack, rather than just running automated tools.Leading bug bounty platforms such as Bugcrowd, HackerOne, Synack, YesWeHack, and Intigriti offer rewards for identifying and reporting security vulnerabilities. Platforms connect ethical hackers…
9 top bug bounty programs launched in 2025

Nov 7, 2025 2:20 PM

Tags: ai, api, apple, attack, best-practice, browser, bug-bounty, chatgpt, chrome, cloud, computer, corporate, cyber, cybersecurity, data, defense, exploit, finance, flaw, framework, google, government, hacker, hacking, healthcare, identity, infrastructure, injection, intelligence, iphone, macOS, microsoft, mitigation, mobile, nis-2, nvidia, openai, phishing, risk, service, spyware, strategy, technology, theft, threat, unauthorized, update, vulnerability, zero-day

Bug bounty programs focus in 2025: For ethical hackers, best practice for bug bounty hunting in 2025 involves thorough reconnaissance of a target organization’s technology stack, rather than just running automated tools.Leading bug bounty platforms such as Bugcrowd, HackerOne, Synack, YesWeHack, and Intigriti offer rewards for identifying and reporting security vulnerabilities. Platforms connect ethical hackers…
Cisco fixes critical UCCX flaw allowing Root command execution

Nov 7, 2025 2:20 PM

Tags: cisco, exploit, flaw, software, update, vulnerability

Cisco patched a critical flaw in its Unified Contact Center Express (UCCX) software that allowed attackers to execute commands with root privileges. Cisco released security updates to address a critical vulnerability, tracked as CVE-2025-20354 (CVSS score 9.8), in the Unified Contact Center Express (UCCX) software. An attacker can exploit the flaw to execute commands with root…
Cisco fixes critical UCCX flaw allowing Root command execution

Nov 7, 2025 2:20 PM

Tags: cisco, exploit, flaw, software, update, vulnerability

Cisco patched a critical flaw in its Unified Contact Center Express (UCCX) software that allowed attackers to execute commands with root privileges. Cisco released security updates to address a critical vulnerability, tracked as CVE-2025-20354 (CVSS score 9.8), in the Unified Contact Center Express (UCCX) software. An attacker can exploit the flaw to execute commands with root…
Cisco fixes critical UCCX flaw allowing Root command execution

Nov 7, 2025 2:20 PM

Tags: cisco, exploit, flaw, software, update, vulnerability

Cisco patched a critical flaw in its Unified Contact Center Express (UCCX) software that allowed attackers to execute commands with root privileges. Cisco released security updates to address a critical vulnerability, tracked as CVE-2025-20354 (CVSS score 9.8), in the Unified Contact Center Express (UCCX) software. An attacker can exploit the flaw to execute commands with root…
Cisco fixes critical flaws in Unified Contact Center Express

Nov 7, 2025 2:20 PM

Tags: access, attack, cisco, cve, endpoint, exploit, flaw, hacker, remote-code-execution, service, unauthorized, vpn

New attack variant for ASA and FTD: Separately, Cisco warned that hackers have developed a new attack variant for CVE-2025-20333 and CVE-2025-20362, two actively exploited flaws in Cisco ASA and FTD originally patched in September. While the flaws were initially exploited for unauthorized access to VPN endpoints and remote code execution, the new attack variation…
Cisco fixes critical flaws in Unified Contact Center Express

Nov 7, 2025 2:20 PM

Tags: access, attack, cisco, cve, endpoint, exploit, flaw, hacker, remote-code-execution, service, unauthorized, vpn

New attack variant for ASA and FTD: Separately, Cisco warned that hackers have developed a new attack variant for CVE-2025-20333 and CVE-2025-20362, two actively exploited flaws in Cisco ASA and FTD originally patched in September. While the flaws were initially exploited for unauthorized access to VPN endpoints and remote code execution, the new attack variation…
Flaw in React Native CLI opens dev servers to attacks

Nov 7, 2025 2:20 PM

Tags: access, api, attack, flaw, malicious, network, tool, vulnerability

What developers must do now?: Developers using @react-native-community/cli (or the bundled cli-server-api) in their React Native projects should check for the vulnerable package version on the npm list. The vulnerability is fixed in version 20.0.0 of cli-server-api, so immediate updating is recommended.The stakes include an attacker remotely executing commands on the victim’s development machine, potentially…
Flaw in React Native CLI opens dev servers to attacks

Nov 7, 2025 2:20 PM

Tags: access, api, attack, flaw, malicious, network, tool, vulnerability

What developers must do now?: Developers using @react-native-community/cli (or the bundled cli-server-api) in their React Native projects should check for the vulnerable package version on the npm list. The vulnerability is fixed in version 20.0.0 of cli-server-api, so immediate updating is recommended.The stakes include an attacker remotely executing commands on the victim’s development machine, potentially…
Flaw in React Native CLI opens dev servers to attacks

Nov 7, 2025 2:20 PM

Tags: access, api, attack, flaw, malicious, network, tool, vulnerability

What developers must do now?: Developers using @react-native-community/cli (or the bundled cli-server-api) in their React Native projects should check for the vulnerable package version on the npm list. The vulnerability is fixed in version 20.0.0 of cli-server-api, so immediate updating is recommended.The stakes include an attacker remotely executing commands on the victim’s development machine, potentially…
Flaw in React Native CLI opens dev servers to attacks

Nov 7, 2025 2:20 PM

Tags: access, api, attack, flaw, malicious, network, tool, vulnerability

What developers must do now?: Developers using @react-native-community/cli (or the bundled cli-server-api) in their React Native projects should check for the vulnerable package version on the npm list. The vulnerability is fixed in version 20.0.0 of cli-server-api, so immediate updating is recommended.The stakes include an attacker remotely executing commands on the victim’s development machine, potentially…
9 top bug bounty programs launched in 2025

Nov 7, 2025 2:20 PM

Tags: ai, api, apple, attack, best-practice, browser, bug-bounty, chatgpt, chrome, cloud, computer, corporate, cyber, cybersecurity, data, defense, exploit, finance, flaw, framework, google, government, hacker, hacking, healthcare, identity, infrastructure, injection, intelligence, iphone, macOS, microsoft, mitigation, mobile, nis-2, nvidia, openai, phishing, risk, service, spyware, strategy, technology, theft, threat, unauthorized, update, vulnerability, zero-day

Bug bounty programs focus in 2025: For ethical hackers, best practice for bug bounty hunting in 2025 involves thorough reconnaissance of a target organization’s technology stack, rather than just running automated tools.Leading bug bounty platforms such as Bugcrowd, HackerOne, Synack, YesWeHack, and Intigriti offer rewards for identifying and reporting security vulnerabilities. Platforms connect ethical hackers…
9 top bug bounty programs launched in 2025

Nov 7, 2025 2:20 PM

Tags: ai, api, apple, attack, best-practice, browser, bug-bounty, chatgpt, chrome, cloud, computer, corporate, cyber, cybersecurity, data, defense, exploit, finance, flaw, framework, google, government, hacker, hacking, healthcare, identity, infrastructure, injection, intelligence, iphone, macOS, microsoft, mitigation, mobile, nis-2, nvidia, openai, phishing, risk, service, spyware, strategy, technology, theft, threat, unauthorized, update, vulnerability, zero-day

Bug bounty programs focus in 2025: For ethical hackers, best practice for bug bounty hunting in 2025 involves thorough reconnaissance of a target organization’s technology stack, rather than just running automated tools.Leading bug bounty platforms such as Bugcrowd, HackerOne, Synack, YesWeHack, and Intigriti offer rewards for identifying and reporting security vulnerabilities. Platforms connect ethical hackers…
9 top bug bounty programs launched in 2025

Nov 7, 2025 2:20 PM

Tags: ai, api, apple, attack, best-practice, browser, bug-bounty, chatgpt, chrome, cloud, computer, corporate, cyber, cybersecurity, data, defense, exploit, finance, flaw, framework, google, government, hacker, hacking, healthcare, identity, infrastructure, injection, intelligence, iphone, macOS, microsoft, mitigation, mobile, nis-2, nvidia, openai, phishing, risk, service, spyware, strategy, technology, theft, threat, unauthorized, update, vulnerability, zero-day

Bug bounty programs focus in 2025: For ethical hackers, best practice for bug bounty hunting in 2025 involves thorough reconnaissance of a target organization’s technology stack, rather than just running automated tools.Leading bug bounty platforms such as Bugcrowd, HackerOne, Synack, YesWeHack, and Intigriti offer rewards for identifying and reporting security vulnerabilities. Platforms connect ethical hackers…
Amazon WorkSpaces for Linux Vulnerability Exposes Valid Auth Tokens to Attackers

Nov 7, 2025 7:19 AM

Tags: access, authentication, cve, cyber, flaw, linux, service, unauthorized, vulnerability

A recently disclosed vulnerability in the Amazon WorkSpaces client for Linux exposes a critical security flaw that could allow attackers to gain unauthorized access to user environments due to improper handling of authentication tokens. The issue, tracked as CVE-2025-12779, has prompted urgent action from Amazon Web Services (AWS) and serves as an essential reminder for…
Amazon WorkSpaces for Linux Vulnerability Exposes Valid Auth Tokens to Attackers

Nov 7, 2025 7:19 AM

Tags: access, authentication, cve, cyber, flaw, linux, service, unauthorized, vulnerability

A recently disclosed vulnerability in the Amazon WorkSpaces client for Linux exposes a critical security flaw that could allow attackers to gain unauthorized access to user environments due to improper handling of authentication tokens. The issue, tracked as CVE-2025-12779, has prompted urgent action from Amazon Web Services (AWS) and serves as an essential reminder for…
Claude Desktop Hit by Critical RCE Flaws Allowing Remote Code Execution

Nov 7, 2025 6:19 AM

Tags: apple, browser, chrome, cyber, flaw, marketplace, rce, remote-code-execution, vulnerability

Security researchers have uncovered severe remote code execution vulnerabilities in three official Claude Desktop extensions developed and published by Anthropic. The Chrome, iMessage, and Apple Notes connectors, which collectively boast over 350,000 downloads and occupy prominent positions in Claude Desktop’s extension marketplace, all contained the same critical security flaw: unsanitized command injection. The vulnerabilities, confirmed…
Django Flaws Enable SQL Injection and DoS Attacks

Nov 6, 2025 10:19 PM

Tags: attack, dos, flaw, injection, sql

New Django flaws expose sites to SQL injection and DoS attacks, underscoring the need for stronger security practices. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-django-vulnerability-sqli-dos-attacks/
ChatGPT Bugs Put Private Data at Risk

Nov 6, 2025 9:19 PM

Tags: chatgpt, data, flaw, injection, risk, theft

Tenable found seven ChatGPT flaws that enable stealthy data theft through chained prompt injection attacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/artificial-intelligence/new-chatgpt-vulnerabilities-data-privacy/
AI Engine Flaw Exposes 100,000 WordPress Sites to Attack

Nov 6, 2025 8:23 PM

Tags: ai, attack, data-breach, flaw, wordpress

A flaw in the AI Engine plugin exposed 100,000 WordPress sites to takeover attacks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-wordpress-vulnerability-100k-impact/
Cisco fixes critical UCCX flaws, patch ASAP! (CVE-2025-20358, CVE-2025-20354)

Nov 6, 2025 5:19 PM

Tags: cisco, cve, flaw, update, vulnerability

Cisco has fixed two critical vulnerabilities (CVE-2025-20358, CVE-2025-20354) affecting Unified Contact Center Express (UCCX), which may allow attackers to bypass … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/06/cisco-fixes-critical-uccx-flaws-patch-asap-cve-2025-20358-cve-2025-20354/