Tag: flaw
-
Free Autoswagger Tool Finds the API Flaws Attackers Hope You Miss
Exposed API documentation is a gift-wrapped roadmap for threat actors. The free Autoswagger tool from Intruder scans for exposed docs and flags endpoints with broken access controls”, before attackers find them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/free-tool-autoswagger-finds-the-api-flaws-attackers-hope-you-miss/
-
Critical Flaws in WordPress Plugin Leave 10,000 Sites Vulnerable
10,000 WordPress sites vulnerable to takeover due to critical flaws in HT Contact Form Widget plugin First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/flaws-wordpress-plugin-expose/
-
Critical WordPress Post SMTP plugin flaw exposes 200K+ sites to full takeover
Critical vulnerability in Post SMTP plugin risks full site takeover, over 400k sites use it, and nearly half remain unpatched. A critical vulnerability, tracked as CVE-2025-24000 (CVSS of 8.8) in the Post SMTP WordPress plugin, used by 400k sites, allows full site takeover. The plugin Post SMTP is an email delivery plugin that allows site owners…
-
Free Tool Autoswagger Finds The API Flaws Attackers Hope You Miss
Exposed API documentation is a gift-wrapped roadmap for threat actors. The free Autoswagger tool from Intruder scans for exposed docs and flags endpoints with broken access controls”, before attackers find them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/free-tool-autoswagger-finds-the-api-flaws-attackers-hope-you-miss/
-
China-linked group Fire Ant exploits VMware and F5 flaws since early 2025
Tags: access, breach, china, cyberespionage, cybersecurity, exploit, flaw, group, infrastructure, vcenter, vmware, vulnerabilityChina-linked group Fire Ant exploits VMware and F5 flaws to stealthily breach secure systems, reports cybersecurity firm Sygnia. China-linked cyberespionage group Fire Ant is exploiting VMware and F5 vulnerabilities to stealthily access secure, segmented systems, according to Sygnia. Since early 2025, the group has targeted virtualization and networking infrastructure, primarily VMware ESXi and vCenter environments.…
-
LG Innotek Camera Flaws Could Give Hackers Full Admin Access
Tags: access, authentication, cctv, control, cve, cyber, cybersecurity, flaw, hacker, risk, vulnerabilityA critical security vulnerability has been discovered in LG Innotek’s LNV5110R CCTV camera model that could allow remote attackers to gain complete administrative control over affected devices. The vulnerability, designated as CVE-2025-7742, represents a significant authentication bypass flaw that poses serious risks to organizations using these security cameras worldwide. Critical Authentication Bypass Vulnerability The Cybersecurity…
-
Critical Flaws in Niagara Framework Threaten Smart Buildings and Industrial Systems Worldwide
Cybersecurity researchers have discovered over a dozen security vulnerabilities impacting Tridium’s Niagara Framework that could allow an attacker on the same network to compromise the system under certain circumstances.”These vulnerabilities are fully exploitable if a Niagara system is misconfigured, thereby disabling encryption on a specific network device,” Nozomi Networks Labs said in a First seen…
-
Post SMTP plugin flaw exposes 200K WordPress sites to hijacking attacks
More than 200,000 WordPress websites are using a vulnerable version of the Post SMTP plugin that allows hackers to take control of the administrator account. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/post-smtp-plugin-flaw-exposes-200k-wordpress-sites-to-hijacking-attacks/
-
Microsoft Investigates Leak in Early Warning System Used by Chinese Hackers to Exploit SharePoint Vulnerabilities
Tags: breach, china, cyber, cybersecurity, exploit, flaw, government, hacker, international, law, leak, microsoft, software, vulnerabilityChinese laws requiring vulnerability disclosure to the government create transparency issues and potential conflicts for international cybersecurity efforts. Microsoft is probing whether a leak from its confidential early warning system enabled Chinese state-sponsored hackers to exploit significant flaws in its SharePoint software, leading to breaches at over 400 organizations, including the U.S. agency responsible for…
-
Unpatched flaw in EoL LG LNV5110R cameras lets hackers gain Admin access
Hundreds of LG LNV5110R cameras are affected by an unpatched auth bypass flaw that allows hackers to gain admin access. US Cybersecurity and Infrastructure Security Agency warns that hundreds of LG LNV5110R cameras are impacted by an unpatched authentication bypass vulnerability. The flaw, tracked asCVE-2025-7742 (CVSS score of 8.3), can allow attackers to gain admin…
-
Fire Ant Hackers Target VMware ESXi and vCenter Flaws to Infiltrate Organizations
Cybersecurity firm Sygnia has been tracking and mitigating a sophisticated espionage operation dubbed Fire Ant, which zeroes in on virtualization and networking infrastructure, particularly VMware ESXi hypervisors and vCenter management servers, alongside network appliances. The threat actors behind Fire Ant employ multilayered kill chains, blending advanced persistence mechanisms with stealthy techniques to breach segmented networks…
-
Tridium Niagara Framework Flaws Expose Sensitive Network Data
Tags: automation, cve, cyber, cybersecurity, data, encryption, flaw, framework, infrastructure, network, vulnerabilityCybersecurity researchers at Nozomi Networks Labs have discovered 13 critical vulnerabilities in Tridium’s widely-used Niagara Framework, potentially exposing sensitive network data across building management, industrial automation, and smart infrastructure systems worldwide. The vulnerabilities, consolidated into 10 distinct CVEs, could allow attackers to compromise systems when encryption is misconfigured, raising significant concerns for critical infrastructure security.…
-
Critical VGAuth Flaw in VMware Tools Grants Full System Access
Security researchers have uncovered critical vulnerabilities in VMware Tools’ Guest Authentication Service (VGAuth) that allow attackers to escalate privileges from any user account to full SYSTEM access on Windows virtual machines. The flaws, tracked as CVE-2025-22230 and CVE-2025-22247, affect VMware Tools 12.5.0 and earlier versions across ESXi-managed environments and standalone VMware Workstation deployments. Authentication Bypass…
-
Multiple Hacker Groups Exploit SharePoint 0-Day Vulnerability in the Wild
Tags: cve, cyber, cybercrime, exploit, flaw, group, hacker, microsoft, remote-code-execution, threat, vulnerability, zero-dayMicrosoft has confirmed that a pair of zero-day vulnerabilities in on-premises SharePoint Server, collectively dubbed ToolShell, are under active exploitation by diverse threat actors ranging from opportunistic cybercriminals to sophisticated nation-state advanced persistent threat (APT) groups. ToolShell encompasses CVE-2025-53770, a critical remote code execution (RCE) flaw allowing unauthenticated attackers to execute arbitrary code on vulnerable…
-
Scavenger Trojan Targets Crypto Wallets via Game Mods and Browser Flaws
New Scavenger Trojan steals crypto wallet data using fake game mods and browser flaws, targeting MetaMask, Exodus, Bitwarden, and other popular apps. First seen on hackread.com Jump to article: hackread.com/scavenger-trojan-crypto-wallets-game-mods-browser-flaws/
-
Weidmueller Industrial Routers Exposed to Remote Code Execution Flaws
Multiple high-severity security vulnerabilities have been discovered in Weidmueller Industrial Routers, potentially allowing attackers to execute arbitrary code with root privileges on affected devices. The German industrial automation company has released security patches to address five critical flaws affecting its IE-SR-2TX router series. Critical Security Advisory Details The vulnerabilities, tracked under advisory VDE-2025-052, were first…
-
Autoswagger: Open-source tool to expose hidden API authorization flaws
Autoswagger is a free, open-source tool that scans OpenAPI-documented APIs for broken authorization vulnerabilities. These flaws are still common, even at large enterprises … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/24/autoswagger-open-source-tool-expose-hidden-api-authorization-flaws/
-
SonicWall SMA 100 Vulnerabilities Allow Remote Execution of Arbitrary JavaScript
Cybersecurity vendor SonicWall issued a critical advisory highlighting three serious vulnerabilities affecting its Secure Mobile Access (SMA) 100 series appliances. Impacting SMA 210, SMA 410, and SMA 500v models running firmware version 10.2.1.15-81sv and earlier, the flaws could allow unauthenticated remote attackers to trigger denial-of-service conditions or execute arbitrary code and JavaScript. CVE ID Vulnerability…
-
CISA Alerts on Google Chromium Input Validation Flaw Actively Exploited
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, google, infrastructure, risk, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a severe input validation vulnerability in Google Chromium that is currently being actively exploited by threat actors. The vulnerability, designated as CVE-2025-6558, poses significant risks to millions of users across multiple web browsers and has prompted urgent action from federal cybersecurity authorities.…
-
U.S. CISA urges FCEB agencies to fix two Microsoft SharePoint flaws immediately and added them to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds two Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Microsoft SharePoint flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: This week, Microsoft warned of a SharePoint zero-day vulnerability, tracked as…
-
Honeywell Smart Building Middleware Vulnerable
Researchers Find Flaws in Tridium Niagara Framework. Vulnerabilities in Honeywell smart building middleware could allow hackers to manipulate physical systems or disable security alarms, warn security researchers. Hackers would already need access to the network. An attack would also depend on the Tridium Niagara customer not encrypting Syslog data. First seen on govinfosecurity.com Jump to…
-
Microsoft Patches SharePoint Flaws as Hackers Rush to Exploit Them
As Microsoft puts the final patch in place, a growing number of hackers, including several China state-sponsored threat groups, are quickly pushing forward to exploit the security flaws that will allow them compromise on-premises SharePoint servers to steal data and maintain persistence. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/microsoft-patches-sharepoint-flaws-as-hackers-rush-to-exploit-them/
-
Microsoft SharePoint On-Premise Vulnerability (CVE-2025-53770) Under Active Exploitation
Summary A critical zero-day vulnerability (now assigned CVE-2025-53770) has been identified in Microsoft SharePoint Server, affecting multiple on-premises versions. The flaw allows unauthenticated remote code First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2025/07/23/microsoft-sharepoint-on-premise-vulnerability-cve-2025-53770-under-active-exploitation/
-
Microsoft Reveals Chinese State Hackers Exploiting SharePoint Flaws
Microsoft reveals Chinese state-backed hacker groups, including Linen Typhoon, Violet Typhoon, and Storm-2603, are exploiting SharePoint flaws, breaching over 100 organisations. Discover threat actors, their tactics and Microsoft’s urgent security guidance. First seen on hackread.com Jump to article: hackread.com/microsoft-chinese-state-hackers-exploit-sharepoint-flaws/
-
Hackers Exploit Microsoft SharePoint Flaws in Global Breaches
Hackers are exploiting critical SharePoint flaws (CVE-2025-53770/53771) to breach global targets, including governments and corporations. Microsoft urges immediate action. Learn about the active attacks and how to protect your network from credential theft and backdoors. First seen on hackread.com Jump to article: hackread.com/hackers-exploit-microsoft-sharepoint-flaws-breaches/