Tag: flaw
-
Google Released Second Fix for Quick Share Flaws After Patch Bypass
Google’s patches for Quick Share for Windows vulnerabilities leading to remote code execution were incomplete and could be easily bypassed. The post Google Released Second Fix for Quick Share Flaws After Patch Bypass appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/google-released-second-fix-for-quick-share-flaws-after-patch-bypass/
-
Google Patches Quick Share Vulnerability Enabling Silent File Transfers Without Consent
Cybersecurity researchers have disclosed details of a new vulnerability impacting Google’s Quick Share data transfer utility for Windows that could be exploited to achieve a denial-of-service (DoS) or send arbitrary files to a target’s device without their approval.The flaw, tracked as CVE-2024-10668 (CVSS score: 5.9), is a bypass for two of the 10 shortcomings that…
-
Cisco Smart Licensing Utility Flaws Allowed Attackers to Gain Admin Access
Cisco has disclosed critical vulnerabilities in its Smart Licensing Utility software, identified as CVE-2024-20439 and CVE-2024-20440, which could allow unauthenticated, remote attackers to gain administrative access or collect sensitive information from compromised systems. These flaws, rated with a severity score of 9.8 in the Common Vulnerability Scoring System (CVSS), pose significant security risks to organizations…
-
Verizon Call Filter API flaw exposed customers’ incoming call history
A vulnerability in Verizon’s Call Filter feature allowed customers to access the incoming call logs for another Verizon Wireless number through an unsecured API request. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/verizon-call-filter-api-flaw-exposed-customers-incoming-call-history/
-
U.S. CISA adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apache Tomcat path equivalence vulnerability, tracked as CVE-2025-24813, to its Known Exploited Vulnerabilities (KEV) catalog. The Apache Tomcat vulnerability CVE-2025-24813 was recently disclosed and is being actively exploited just 30…
-
Microsoft’s AI tool catches critical GRUB2, U-boot bootloader flaws
Tags: access, ai, control, cybersecurity, exploit, firmware, flaw, Hardware, microsoft, mitigation, monitoring, risk, soc, supply-chain, tool, update, vulnerability, vulnerability-management, zero-dayAI-powered discovery changes the cybersecurity landscape: Microsoft’s Security Copilot tool significantly accelerated the vulnerability identification process, with a particular focus on filesystem implementations due to their high vulnerability potential.”Using Security Copilot, we were able to identify potential security issues in bootloader functionalities, focusing on filesystems due to their high vulnerability potential,” the blog stated. “This…
-
Canon Printer Drivers Flaw Could Let Hackers Run Malicious Code
A critical vulnerability (CVE-2025-1268) in Canon printer drivers allows remote code execution. See which drivers are affected, how to patch them. First seen on hackread.com Jump to article: hackread.com/canon-printer-drivers-flaw-hackers-run-malicious-code/
-
Google fixes GCP flaw that could expose sensitive container images
run.services.update and iam.serviceAccounts.actAspermissions they could modify a Cloud Run service and deploy a new revision.”In doing so, they could specify (through malicious code injection) any private container image stored in a victim’s registries, Matan added.According to a Tenable statement to CSO, an attacker could use this vulnerability for data theft or espionage in a real-world…
-
Google Cloud Platform Vulnerability Exposes Sensitive Data to Attackers
A privilege escalation vulnerability in Google Cloud Platform (GCP), dubbed >>ImageRunner,
-
Firefox 137 Launches with Patches for High-Severity Security Flaws
Mozilla has officially launched Firefox 137 with crucial security fixes aimed at addressing several high-severity vulnerabilities reported by security researchers. As part of its April 1, 2025, Mozilla Foundation Security Advisory (MFSA 2025-20), the foundation detailed three significant Common Vulnerabilities and Exposures (CVEs), which could have permitted attackers to exploit users’ machines through various means,…
-
Exploited: Critical Unauthenticated Access Vulnerability in CrushFTP (CVE-2025-2825)
In the ever-evolving landscape of web application vulnerabilities, a new critical flaw has emerged. CVE-2025-2825 is a high-severity vulnerability that allows attackers to bypass authentication on CrushFTP servers. This popular enterprise file transfer solution is often used in corporate environments to manage sensitive data, making this vulnerability particularly concerning. Attackers are actively exploiting this flaw……
-
20,000 WordPress Sites at Risk of File Upload Deletion Exploits
A critical security alert has been issued to WordPress site administrators following the discovery of two high-severity vulnerabilities in the >>WP Ultimate CSV Importer
-
ImageRunner Flaw Exposed Sensitive Information in Google Cloud
Google has patched a Cloud Run vulnerability dubbed ImageRunner that could have been exploited to gain access to sensitive data. The post ImageRunner Flaw Exposed Sensitive Information in Google Cloud appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/imagerunner-flaw-exposed-sensitive-information-in-google-cloud/
-
Apple backported fixes for three actively exploited flaws to older devices
Apple backports three critical vulnerabilities actively exploited in attacks against older iOS and macOS models. Apple has backported fixes for three actively exploited vulnerabilities to older devices and OS versions. The three vulnerabilities are: Apple released the following updates: that are available for the following devices: Follow me on Twitter:@securityaffairsandFacebookandMastodon PierluigiPaganini (SecurityAffairs hacking, newsletter) First seen on…
-
CISA Alerts on Active Exploitation of Apache Tomcat Vulnerability
Tags: apache, cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, open-source, risk, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding the active exploitation of CVE-2025-24813, a critical vulnerability within Apache Tomcat. This newly identified flaw poses a significant risk to organizations using affected versions of the popular open-source web server. CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813, classified as a >>Path Equivalence…
-
BlueToolkit: Open-source Bluetooth Classic vulnerability testing framework
BlueToolkit is an open-source tool that helps find security flaws in Bluetooth Classic devices. It runs known and custom exploits to test if a device is vulnerable. Right now, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/02/bluetoolkit-open-source-bluetooth-classic-vulnerability-testing-framework/
-
Plantronics Hub Flaw Allows Attackers to Gain Elevated Privileges
A critical vulnerability has been identified in the Plantronics Hub software, a client application commonly used to configure Plantronics audio devices such as headsets. The flaw, classified as an unquoted search path vulnerability, allows attackers to execute arbitrary files and escalate privileges to administrative levels under certain conditions. This issue is particularly concerning as the…
-
Microsoft warns of critical flaw in Canon printer drivers
Microsoft’s offensive security team discovered a critical code execution vulnerability impacting Canon printer drivers. Researchers at Microsoft’s Offensive Research and Security Engineering (MORSE) team have discovered a critical code execution vulnerability, tracked as CVE-2025-1268 (CVSS score of 9.4), impacting Canon printer drivers. The vulnerability is an out-of-bounds issue that resides in certain printer drivers for…
-
Canon Printer Flaw Enables Remote Code Execution
Critical Vulnerability in Drivers Affects Multiple Canon Printers. The office printer could mete out more than ordinary frustration now that researchers discovered a vulnerability in drivers for Canon printer enabling attackers to execute arbitrary code. The flaw is an out-of-bounds vulnerability in Enhanced Metafile Recode processing. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/canon-printer-flaw-enables-remote-code-execution-a-27894
-
Sam’s Club investigating attack claim linked to Clop ransomware
The prolific gang is linked to the exploitation of critical flaws in Cleo file transfer software. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/sams-club-clop-ransomware/744093/
-
WP Ultimate CSV Importer Flaws Expose 20,000 Websites to Attacks
WP Ultimate CSV Importer flaws expose 20,000 websites to attacks enabling attackers to achieve full site compromise First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/wp-ultimate-csv-importer-flaws/
-
CrushFTP CVE-2025-2825 flaw actively exploited in the wild
Attackers exploit CrushFTP CVE-2025-2825 flaw, enabling unauthenticated access to unpatched devices using public proof-of-concept code. Threat actors are exploiting a critical authentication bypass vulnerability, tracked as CVE-2025-2825, in the CrushFTP file transfer software. Attackers are using exploits based on publicly available proof-of-concept exploit code. The vulnerability impacts CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0, it…
-
Nearly 24,000 IPs behind wave of Palo Alto Global Protect scans
A significant spike in scanning activity targeting Palo Alto Network GlobalProtect login portals has been observed, with researchers concerned it may be a prelude to an upcoming attack or flaw being exploited. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nearly-24-000-ips-behind-wave-of-palo-alto-global-protect-scans/
-
Google ‘ImageRunner’ Bug Enabled Privilege Escalation
Tenable released details of a Google Cloud Run flaw that prior to remediation allowed a threat actor to escalate privileges. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-imagerunner-bug-enabled-privilege-escalation
-
Researchers Uncover 46 Critical Flaws in Solar Power Systems From Sungrow, Growatt, and SMA
Cybersecurity researchers have disclosed 46 new security flaws in products from three solar power system vendors, Sungrow, Growatt, and SMA, that could be exploited by a bad actor to seize control of devices or execute code remotely, posing severe risks to electrical grids. The vulnerabilities have been collectively codenamed SUN:DOWN by Forescout Vedere Labs.”The new…
-
Microsoft Discovers GRUB2, U-Boot, and Barebox Bootloader Flaws with Copilot
Microsoft has disclosed the discovery of multiple critical vulnerabilities within the GRUB2, U-Boot, and Barebox bootloaders, leveraging its AI-driven Security Copilot platform for advanced threat analysis. These bootloaders, integral to the Unified Extensible Firmware Interface (UEFI) Secure Boot framework and widely deployed in embedded systems, were found to contain exploitable flaws that could compromise system…