Tag: flaw
-
Confidential Virtual Machine Flaw: AMD Patch Push Underway
Chipmaker Confirms Vulnerability, Which Poses Risk to Confidential Cloud Computing. Chipmaker Advanced Micro Devices is issuing fixes for a vulnerability in multiple types of processors, dubbed RMPocalypse, that attackers could exploit to access data being transmitted to, processed or stored in confidential virtual machines provided by cloud service providers. First seen on govinfosecurity.com Jump to…
-
Microsoft Patch Tuesday October 2025 172 Vulnerabilities Fixed Along with 4 Zero-days
In its October 2025 Patch Tuesday release, Microsoft addressed a staggering 172 security vulnerabilities across its vast ecosystem, with four zero-day flaws stealing the spotlight, two of which are already being exploited in the wild. This massive security update targets a wide range of products, from Windows operating systems and Microsoft Office to Azure cloud…
-
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
Today is Microsoft’s October 2025 Patch Tuesday, which includes security updates for 172 flaws, including six zero-day vulnerabilities. Get patching! First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-october-2025-patch-tuesday-fixes-6-zero-days-172-flaws/
-
CamoLeak: GitHub Copilot Flaw Allowed Silent Data Theft
A GitHub Copilot Chat bug let attackers steal private code via prompt injection. Learn how CamoLeak worked and how to defend against AI risks. The post CamoLeak: GitHub Copilot Flaw Allowed Silent Data Theft appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-github-copilot-data-theft/
-
Microsoft Limits IE Mode in Edge After Chakra Zero-Day Activity Detected
Microsoft restricted access to Edge’s IE Mode in August 2025 after hackers used a Chakra zero-day flaw to bypass security and take over user devices. Check out the new steps for enabling IE Mode. First seen on hackread.com Jump to article: hackread.com/microsoft-limits-ie-mode-edge-chakra-zero-day/
-
Oracle rushes out another emergency E-Business Suite patch as Clop fallout widens
Latest in a long line of EBS flaws leta miscreants remotely compromise enterprise systems to pinch sensitive data First seen on theregister.com Jump to article: www.theregister.com/2025/10/14/oracle_rushes_out_another_emergency/
-
Oracle rushes out another emergency E-Business Suite patch as Clop fallout widens
Latest in a long line of EBS flaws leta miscreants remotely compromise enterprise systems to pinch sensitive data First seen on theregister.com Jump to article: www.theregister.com/2025/10/14/oracle_rushes_out_another_emergency/
-
RMPocalypse: Single 8-Byte Write Shatters AMD’s SEV-SNP Confidential Computing
Chipmaker AMD has released fixes to address a security flaw dubbed RMPocalypse that could be exploited to undermine confidential computing guarantees provided by Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP).The attack, per ETH Zürich researchers Benedict Schlüter and Shweta Shinde, exploits AMD’s incomplete protections that make it possible to perform a single memory First…
-
New Pixnapping Android Flaw Lets Rogue Apps Steal 2FA Codes Without Permissions
Tags: 2fa, android, attack, authentication, data, exploit, flaw, google, group, mfa, side-channel, vulnerabilityAndroid devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication (2FA) codes, Google Maps timelines, and other sensitive data without the users’ knowledge pixel-by-pixel.The attack has been codenamed Pixnapping by a group of academics from the University of California (Berkeley), University of…
-
SAP NetWeaver Memory Corruption Flaw Lets Attackers Send Corrupted Logon Tickets
A newly disclosed vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (CVE-2025-42902) allows unauthenticated attackers to crash server processes by sending malformed SAP Logon or SAP Assertion Tickets. RatedMediumseverity with a5.3CVSS 3.1 score, the flaw stems from a NULL pointer dereference that triggers memory corruption and process termination. Affected versions include all supported releases…
-
SAP NetWeaver Memory Corruption Flaw Lets Attackers Send Corrupted Logon Tickets
A newly disclosed vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (CVE-2025-42902) allows unauthenticated attackers to crash server processes by sending malformed SAP Logon or SAP Assertion Tickets. RatedMediumseverity with a5.3CVSS 3.1 score, the flaw stems from a NULL pointer dereference that triggers memory corruption and process termination. Affected versions include all supported releases…
-
SAP NetWeaver Memory Corruption Flaw Lets Attackers Send Corrupted Logon Tickets
A newly disclosed vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (CVE-2025-42902) allows unauthenticated attackers to crash server processes by sending malformed SAP Logon or SAP Assertion Tickets. RatedMediumseverity with a5.3CVSS 3.1 score, the flaw stems from a NULL pointer dereference that triggers memory corruption and process termination. Affected versions include all supported releases…
-
Happy DOM Security Flaw (CVE-2025-61927) Enables VM Context Escape and Remote Code Execution
A critical security flaw has been identified in Happy DOM, a widely used JavaScript library primarily employed for server-side rendering and testing frameworks. The vulnerability, cataloged as CVE-2025-61927, allows attackers to escape the library’s virtual machine (VM) context, leading to potential remote code execution on vulnerable systems. This flaw threatens millions of applications that depend…
-
SonicWall VPNs face a breach of their own after the September cloud-backup fallout
What defenders should watch out for: Huntress highlighted that, in a few cases, successful SSLVPN authentication was followed by internal reconnaissance traffic or access attempts to Windows administrative accounts. Additionally, logins originating from a single recurring public IP may suggest a coordinated campaign rather than random credential reuse.On top of the steps outlined in SonicWall’s…
-
PoC Released for Sudo chroot Flaw Allowing Local Privilege Escalation
A new proof-of-concept (PoC) exploit has been published for a critical flaw in the widely usedsudoutility. This vulnerability enables any local user to escape a chroot jail and execute commands with root privileges. Organizations relying on sudo are urged to audit and update their installations immediately. Chroot Escape Enables Root Access The flaw resides insudo’s handling of…
-
PoC Released for Sudo chroot Flaw Allowing Local Privilege Escalation
A new proof-of-concept (PoC) exploit has been published for a critical flaw in the widely usedsudoutility. This vulnerability enables any local user to escape a chroot jail and execute commands with root privileges. Organizations relying on sudo are urged to audit and update their installations immediately. Chroot Escape Enables Root Access The flaw resides insudo’s handling of…
-
Oracle issued an emergency security update to fix new E-Business Suite flaw CVE-2025-61884
Oracle issued an emergency security update to address a new E-Business Suite (EBS) vulnerability tracked as CVE-2025-61884. Oracle released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS Score of 7.5), in E-Business Suite’s Runtime UI component (versions 12.2.312.2.14). >>Oracle has just released Security Alert CVE-2025-61884. This vulnerability affects some deployments of Oracle E-Business…
-
Oracle issued an emergency security update to fix new E-Business Suite flaw CVE-2025-61884
Oracle issued an emergency security update to address a new E-Business Suite (EBS) vulnerability tracked as CVE-2025-61884. Oracle released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS Score of 7.5), in E-Business Suite’s Runtime UI component (versions 12.2.312.2.14). >>Oracle has just released Security Alert CVE-2025-61884. This vulnerability affects some deployments of Oracle E-Business…
-
Ivanti Patches 13 Endpoint Manager Flaws Allowing Remote Code Execution
Tags: cyber, endpoint, exploit, flaw, injection, ivanti, mitigation, remote-code-execution, sql, vulnerabilityIvanti has disclosed 13 vulnerabilities in Ivanti Endpoint Manager (EPM), including two high-severity issues that could enable privilege escalation and remote code execution, and eleven medium-severity SQL injection flaws. While there is no evidence of in-the-wild exploitation, Ivanti urges customers to move to the latest supported release and apply recommended mitigations as patches are still…
-
Ivanti Patches 13 Endpoint Manager Flaws Allowing Remote Code Execution
Tags: cyber, endpoint, exploit, flaw, injection, ivanti, mitigation, remote-code-execution, sql, vulnerabilityIvanti has disclosed 13 vulnerabilities in Ivanti Endpoint Manager (EPM), including two high-severity issues that could enable privilege escalation and remote code execution, and eleven medium-severity SQL injection flaws. While there is no evidence of in-the-wild exploitation, Ivanti urges customers to move to the latest supported release and apply recommended mitigations as patches are still…
-
Elastic Cloud Enterprise Flaw Lets Attackers Run Malicious Commands
Elastic has released a critical security update for Elastic Cloud Enterprise (ECE) addressing a template engine injection flaw that could allow attackers with admin privileges to execute arbitrary commands and exfiltrate sensitive data. Tracked as CVE-2025-37729 and rated CVSS 9.1 (Critical), the issue affects ECE versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1. Users are…
-
Simple Prompt Injection Lets Hackers Bypass OpenAI Guardrails Framework
Security researchers have discovered a fundamental vulnerability in OpenAI’s newly released Guardrails framework that can be exploited using basic prompt injection techniques. The vulnerability enables attackers to circumvent the system’s safety mechanisms and generate malicious content without triggering any security alerts, raising serious concerns about the effectiveness of AI self-regulation approaches. Critical Flaw in LLM-Based…
-
Elastic Cloud Enterprise Flaw Lets Attackers Run Malicious Commands
Elastic has released a critical security update for Elastic Cloud Enterprise (ECE) addressing a template engine injection flaw that could allow attackers with admin privileges to execute arbitrary commands and exfiltrate sensitive data. Tracked as CVE-2025-37729 and rated CVSS 9.1 (Critical), the issue affects ECE versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1. Users are…
-
Elastic Cloud Enterprise Flaw Lets Attackers Run Malicious Commands
Elastic has released a critical security update for Elastic Cloud Enterprise (ECE) addressing a template engine injection flaw that could allow attackers with admin privileges to execute arbitrary commands and exfiltrate sensitive data. Tracked as CVE-2025-37729 and rated CVSS 9.1 (Critical), the issue affects ECE versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1. Users are…
-
Simple Prompt Injection Lets Hackers Bypass OpenAI Guardrails Framework
Security researchers have discovered a fundamental vulnerability in OpenAI’s newly released Guardrails framework that can be exploited using basic prompt injection techniques. The vulnerability enables attackers to circumvent the system’s safety mechanisms and generate malicious content without triggering any security alerts, raising serious concerns about the effectiveness of AI self-regulation approaches. Critical Flaw in LLM-Based…
-
Critical Oracle EBS Flaw Could Expose Sensitive Data
Oracle patches a high-severity EBS flaw that could let attackers bypass authentication and access sensitive enterprise data. The post Critical Oracle EBS Flaw Could Expose Sensitive Data appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-oracle-ebs-vulnerability/
-
Critical Oracle EBS Flaw Could Expose Sensitive Data
Oracle patches a high-severity EBS flaw that could let attackers bypass authentication and access sensitive enterprise data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/oracle-ebs-vulnerability/
-
Gladinet file sharing zero-day brings patched flaw back from the dead
What to do: All versions of CentreStack and Triofox file sharing servers up to and including 16.7.10368.56560 are vulnerable to CVE-2025-11371.The bad news is that Gladinet has yet to issue a patch for this, which means that for the time being the best customers can do is to apply the recommended mitigation.Luckily, according to Huntress,…
-
Hidden Cost of MFT Vulnerabilities: Why CVE-2025-10035 Demands a New Security Playbook
When Fortra disclosed CVE-2025-10035 in GoAnywhere MFT last month, many security teams likely experienced a familiar sinking feeling. Another critical vulnerability. Another emergency patch cycle. Another race against ransomware operators. But this latest maximum-severity flaw reveals something more troubling than a single vendor’s coding error. It exposes the fundamental fragility of how organisations handle their…
-
Oracle releases emergency patch for new E-Business Suite flaw
Oracle has issued an emergency security update over the weekend to patch another E-Business Suite (EBS) vulnerability that can be exploited remotely by unauthenticated attackers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/oracle-releases-emergency-patch-for-new-e-business-suite-flaw/