Tag: flaw
-
GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks
Two high-severity security flaws have been disclosed in the open-source ruby-saml library that could allow malicious actors to bypass Security Assertion Markup Language (SAML) authentication protections.SAML is an XML-based markup language and open-standard used for exchanging authentication and authorization data between parties, enabling features like single sign-on (SSO), which allows First seen on thehackernews.com Jump…
-
Zoom Fixes Critical Security Flaws Affecting Workplace Apps and SDK
Zoom has released important security patches addressing several vulnerabilities that affect its applications, including four high-severity flaws. These Zoom vulnerabilities was discovered by the company’s offensive security team and quickly acted to secure its platform. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/multiple-zoom-vulnerabilities-detected/
-
Microsoft Finally Patches 2-Year-Old Windows Kernel Security Flaw
Microsoft has released a critical patch for a 2-year-old Windows kernel security vulnerability. This vulnerability, identified as CVE-2025-24983, allows attackers to exploit a weakness in the Windows Win32 Kernel Subsystem, leading to an elevation of privilege. The patch comes after extensive research by security experts, who first detected the exploit in the wild in March…
-
Meta warns of actively exploited flaw in FreeType library
Meta warned that a vulnerability, tracked as CVE-2025-27363, impacting the FreeType library may have been exploited in the wild. Meta warned that an out-of-bounds write flaw, tracked as CVE-2025-27363 (CVSS score of 8.1), in the FreeType library may have been actively exploited in attacks. >>An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to…
-
Meta Warns of FreeType Vulnerability (CVE-2025-27363) With Active Exploitation Risk
Meta has warned that a security vulnerability impacting the FreeType open-source font rendering library may have been exploited in the wild.The vulnerability has been assigned the CVE identifier CVE-2025-27363, and carries a CVSS score of 8.1, indicating high severity. Described as an out-of-bounds write flaw, it could be exploited to achieve remote code execution when…
-
Facebook discloses FreeType 2 flaw exploited in attacks
Facebook is warning that a FreeType vulnerability in all versions up to 2.13 can lead to arbitrary code execution, with reports that the flaw has been exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/facebook-discloses-freetype-2-flaw-exploited-in-attacks/
-
Microsoft’s March Patch Tuesday fixes 67 flaws, including 6 zero-days
First seen on scworld.com Jump to article: www.scworld.com/news/microsofts-march-patch-tuesday-fixes-67-flaws-including-6-zero-days
-
U.S. CISA adds six Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, update, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds six Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the descriptions of these flaws that Microsoft addressed with the release of Microsoft Patch Tuesday security updates for…
-
iPhone, iPad update fixes critical WebKit flaw
iPhone and iPad users are advised to update their devices as Apple addresses an out-of-bounds write issue in the WebKit browser engine that appears to have been exploited in targeted cyber attacks First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366620470/iPhone-iPad-update-fixes-critical-WebKit-flaw
-
March Patch Tuesday brings 57 fixes, multiple zero-days
The third Patch Tuesday of 2025 brings fixes for 57 flaws and a hefty number of zero-days First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366620545/March-Patch-Tuesday-brings-57-fixes-multiple-zero-days
-
Patch Tuesday: Microsoft Fixes 57 Security Flaws Including Active Zero-Days
Microsoft’s March 2025 Patch Tuesday includes six actively exploited zero-day vulnerabilities. Learn about the critical vulnerabilities and why immediate updates are essential. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-patch-tuesday-march-2025/
-
Picklescan Vulnerabilities Could Let Hackers Bypass AI Security Checks
Sonatype researchers uncover critical vulnerabilities in picklescan. Learn how these flaws impact AI model security, Hugging Face, and… First seen on hackread.com Jump to article: hackread.com/picklescan-vulnerabilities-bypass-ai-security-checks/
-
Emerging botnet exploits TP-Link router flaw posing risk to US organizations
Ballista’s attacks on TP-Link devices comes as U.S. lawmakers consider banning the company’s products over suspected links to China. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/-botnet-exploits-tp-link-router/742319/
-
iOS 18.3.2 Patches Actively Exploited WebKit Vulnerability
iOS 18.3.2 patches actively exploited WebKit flaw, addressing critical security risks for users First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ios-1832-patches-exploited-webkit/
-
Apple patches zero-day bugs used in targeted iPhone attacks
Three zero-days within months: This marks Apple’s third zero-day fix since the start of the year, following patches for CVE-2025-24085 in January and CVE-2025-24200 in February.Apple’s leading market share attracts frequent adversarial interest, making a development or configurational mishap extremely punishing. The company suffered a total of twenty bugs in 2023, including the RCE bugs,…
-
Microsoft patches privilege escalation flaw exploited since 2023
Vulnerabilities in file system drivers: Several of the other zero-day vulnerabilities are related to the Windows NT File System (NTFS) driver. One is a remote code execution flaw that can be triggered by the user mounting a specially crafted VHD (virtual hard disk) that triggers a buffer overflow (CVE-2025-24993).A similar vulnerability, CVE-2025-24985, that can be…
-
CVE-2025-24201: Apple Addresses Zero-Day Exploit in WebKit
Apple has released an important security update to fix a newly discovered zero-day vulnerability that has reportedly been exploited in >>extremely sophisticated
-
Apple Rolls Out Critical Security Fixes: iOS 18.3.2, macOS Ventura, and More Receive Important Updates
Apple has released a series of crucial security updates designed to patch vulnerabilities across its ecosystem of devices. On March 11, 2025, the tech giant rolled the Apple security update with iOS 18.3.2, iPadOS 18.3.2, macOS Ventura, macOS Sonoma, macOS Sequoia, visionOS 2.3.2, and tvOS 18.3.1, addressing multiple security flaws that could potentially have been…
-
New Ballista Botnet spreads using TP-Link flaw. Is it an Italian job?
The Ballista botnet is exploiting an unpatched TP-Link vulnerability, targeting over 6,000 Archer routers, Cato CTRL researchers warn. Cato CTRL researchers observed a new botnet, called Ballista botnet, which is exploiting a remote code execution (RCE) vulnerability, tracked as CVE-2023-1389 (CVSS score 8.8), in TP-Link Archer routers. The CVE-2023-1389 flaw is an unauthenticated command injection…
-
Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks
Apple on Tuesday released a security update to address a zero-day flaw that it said has been exploited in “extremely sophisticated” attacks.The vulnerability has been assigned the CVE identifier CVE-2025-24201 and is rooted in the WebKit web browser engine component.It has been described as an out-of-bounds write issue that could allow an attacker to craft…
-
URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero-Days
Microsoft on Tuesday released security updates to address 57 security vulnerabilities in its software, including a whopping six zero-days that it said have been actively exploited in the wild.Of the 56 flaws, six are rated Critical, 50 are rated Important, and one is rated Low in severity. Twenty-three of the addressed vulnerabilities are remote code…
-
Ivanti EPM vulnerabilities actively exploited in the wild, CISA warns
Tags: apt, china, cisa, cyberespionage, exploit, flaw, group, ivanti, remote-code-execution, vpn, vulnerability, zero-dayIvanti products in attackers’ crosshairs: Multiple Ivanti products have been targeted by attackers over the past year, especially by state-sponsored cyberespionage groups who developed zero-day exploits for them.Back in January Ivanti patched a critical remote code execution flaw in its Connect Secure SSL VPN appliance that a Chinese APT group had exploited as a zero-day…
-
Microsoft Discloses ‘Extraordinary’ Number Of Actively Exploited Vulnerabilities: Researcher
Microsoft’s monthly release of security fixes addresses vulnerabilities including six flaws that are believed to be under active attack, according to Trend Micro’s Dustin Childs. First seen on crn.com Jump to article: www.crn.com/news/security/2025/microsoft-discloses-extraordinary-number-of-actively-exploited-vulnerabilities-researcher
-
3 Ivanti flaws added to CISA list of known exploited vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/news/3-ivanti-flaws-added-to-cisa-list-of-known-exploited-vulnerabilities
-
Advantive VeraCore, Ivanti EPM flaws added to CISA vulnerabilities catalog
First seen on scworld.com Jump to article: www.scworld.com/brief/advantive-veracore-ivanti-epm-flaws-added-to-cisa-vulnerabilities-catalog
-
Apple fixes new security flaw used in ‘extremely sophisticated attack’
The flaw was in the browser engine WebKit, used by Safari and other apps. First seen on techcrunch.com Jump to article: techcrunch.com/2025/03/11/apple-fixes-new-security-flaw-used-in-extremely-sophisticated-attack/
-
Microsoft Flags Six Active Zero-Days, Patches 57 Flaws: Patch Tuesday
Redmond ships major security updates with warnings that a half-dozen Windows vulnerabilities have already been exploited in the wild. The post Microsoft Flags Six Active Zero-Days, Patches 57 Flaws: Patch Tuesday appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/patch-tuesday-microsoft-patches-57-flaws-flags-six-active-zero-days/