Tag: flaw
-
Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability
Cisco on Monday updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance (ASA).The vulnerability, tracked as CVE-2014-2120 (CVSS score: 4.3), concerns a case of insufficient input validation in ASA’s WebVPN login page that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)…
-
SmokeLoader picks up ancient MS Office bugs to pack fresh credential stealer
Threat actors are using a well-known modular malware loader, SmokeLoader, to exploit known Microsoft Office vulnerabilities and steal sensitive browser credentials.The loader which runs a framework to deploy multiple malware modules, was observed by Fortinet’s FortiGuard Labs in attacks targeting manufacturing, healthcare, and IT companies in Taiwan.”SmokeLoader, known for its ability to deliver other malicious…
-
NachoVPN Tool Exploits Flaws in Popular VPN Clients for System Compromise
Tags: access, cybersecurity, exploit, flaw, macOS, network, remote-code-execution, tool, vpn, windowsCybersecurity researchers have disclosed a set of flaws impacting Palo Alto Networks and SonicWall virtual private network (VPN) clients that could be potentially exploited to gain remote code execution on Windows and macOS systems.”By targeting the implicit trust VPN clients place in servers, attackers can manipulate client behaviours, execute arbitrary commands, and gain high levels…
-
BootKitty Linux UEFI bootkit spotted exploiting LogoFAIL flaws
The ‘Bootkitty’ Linux UEFI bootkit exploits the LogoFAIL flaws (CVE-2023-40238) to target systems using vulnerable firmware. Cybersecurity researchers from ESET recently discovered the first UEFI bootkit designed to target Linux systems, called by its authors Bootkitty. The bootkit allows attackers to disable the kernel’s signature verification feature and to preload two as yet unknown ELF…
-
Actively exploited Partner Network site flaw, others addressed by Microsoft
First seen on scworld.com Jump to article: www.scworld.com/brief/actively-exploited-partner-network-site-flaw-others-addressed-by-microsoft
-
SmokeLoader Malware Exploits MS Office Flaws to Steal Browser Credentials
SmokeLoader malware has resurfaced with enhanced capabilities and functionalities, targeting your personal data. First seen on hackread.com Jump to article: hackread.com/smokeloader-malware-ms-office-flaws-browser-data/
-
Windows Server 2012 0-day Vulnerability Exposes Critical Security Flaw
Cybersecurity researchers have identified a critical 0-day vulnerability in Windows Server 2012 and Server 2012 R2. This previously unknown security flaw allows attackers to bypass the Mark of the Web (MoTW) verification on certain files, posing a significant threat to affected systems. Vulnerability Details The vulnerability, which was introduced over two years ago, has managed…
-
Apple Safari JavaScriptCore Remote Code Execution Flaw Exploited in the Wild
Tags: apple, cve, cyber, exploit, flaw, macOS, remote-code-execution, software, threat, vulnerabilityA critical vulnerability identified as CVE-2024-44308 has been actively exploited in the wild, affecting multiple versions of Apple Safari across iOS, visionOS, and macOS platforms. This flaw, located within WebKit’s DFG JIT compiler, poses a significant threat by allowing remote code execution (RCE). Affected Software and Versions Here’s a table summarizing the affected software and…
-
Operation >>Code on Toast<<: A Deep Dive into TA-RedAnt's Exploitation of Zero-Day Flaw (CVE-2024-38178)
North Korean-linked hacking group TA-RedAnt has been implicated in a sophisticated large-scale cyber attack dubbed >>Operation Code on Toast,
-
FYSA Critical RCE Flaw in GNU-Linux Systems
Summary A severe, unauthenticated remote code execution (RCE) flaw has been discovered in GNU Linux systems. The vulnerability, rated CVSS 9.9, affect… First seen on securityintelligence.com Jump to article: securityintelligence.com/news/fysa-critical-rce-flaw-in-gnu-linux-systems/
-
Week in review: Exploitable flaws in corporate VPN clients, malware loader created with gaming engine
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Researchers reveal exploitable flaws in corporate VPN clients Researchers … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/12/01/week-in-review-exploitable-flaws-in-corporate-vpn-clients-malware-loader-created-with-gaming-engine/
-
CVE-2024-4956 Unauthenticated Path Traversal in Nexus Repository Manager 3
Nexus Repository Manager serves as a hub for managing, storing, and disseminating development artifacts. A critical security flaw, identified as a pat… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2024/06/03/cve-2024-4956-unauthenticated-path-traversal-in-nexus-repository-manager-3/
-
Critical Security Updates for Palo Alto Networks: CVE-2024-5910 CVE-2024-3596
Summary Palo Alto Networks has released critical security updates addressing several vulnerabilities, including a high-severity flaw in the Expedition… First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2024/07/15/critical-security-updates-for-palo-alto-networks-cve-2024-5910-cve-2024-3596/
-
Hacking Millions of Modems: A Critical Wake-Up Call for Network Security
Recently, renowned security researcher Sam Curry exposed a critical security flaw affecting millions of modems, particularly those used by Cox Communi… First seen on thefinalhop.com Jump to article: www.thefinalhop.com/hacking-millions-of-modems-a-critical-wake-up-call-for-network-security/
-
Apache Fixes OFBiz Remote Code Execution Flaw
First seen on duo.com Jump to article: duo.com/decipher/apache-fixes-ofbiz-remote-code-execution-flaw
-
CVE-2023-48022: ShadowRay Flaw a Critical Threat to AI Infrastructure
The Oligo research team recently uncovered an ongoing attack campaign, dubbed ShadowRay, targeting a vulnerability in Ray, a widely utilized open-sour… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2023-48022-shadowray/
-
CVE-2024-28085: Linux Flaw Could Leak Passwords
A recently identified vulnerability affecting the >>wall
-
HTTP/2 Flaw Puts Web Servers at Risk of DoS Attacks [CVE-2024-27983]
A new research conducted by security expert Bartek Nowotarski has unearthed a potential vulnerability in the HTTP/2 protocol. Known as the CONTINUATIO… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/http2-flaw-dos-attacks-cve-2024-27983/
-
CVE-2024-5035: Critical Flaw in TP-Link Archer C5400X Gaming Router
Security researchers identified a critical security vulnerability in the TP-Link Archer C5400X gaming router, which could easily allow remote code exe… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2024-5035-tp-link-archer-c5400x/
-
iPhone Users Urged to Update to Patch 2 Zero-Days
Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack… First seen on threatpost.com Jump to article: threatpost.com/iphone-users-urged-to-update-to-patch-2-zero-days-under-attack/180448/
-
Zabbix urges upgrades after critical SQL injection bug disclosure
US agencies blasted ‘unforgivable’ SQLi flaws earlier this year First seen on theregister.com Jump to article: www.theregister.com/2024/11/29/zabbix_urges_upgrades_after_critical/
-
Warning: Patch Advantech Industrial Wireless Access Points
Researchers Discover 20 Critical Flaws Attackers Could Exploit in a Variety of Ways. Researchers identified 20 critical vulnerabilities in a type of Advantech industrial-grade wireless access point that’s widely deployed across critical infrastructure environments. Attackers could exploit the flaws to remotely executive code and create denials of service. First seen on govinfosecurity.com Jump to article:…
-
Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks
Microsoft has addressed four security flaws impacting its artificial intelligence (AI), cloud, enterprise resource planning, and Partner Center offerings, including one that it said has been exploited in the wild.The vulnerability that has been tagged with an “Exploitation Detected” assessment is CVE-2024-49035 (CVSS score: 8.7), a privilege escalation flaw in partner.microsoft[.]com.”An First seen on thehackernews.com…
-
Design flaw in Fortinet VPN server lets attackers hide logins
First seen on scworld.com Jump to article: www.scworld.com/brief/design-flaw-in-fortinet-vpn-server-lets-attackers-hide-logins
-
High severity RCE flaws among several newly addressed IBM bugs
First seen on scworld.com Jump to article: www.scworld.com/brief/high-severity-rce-flaws-among-several-newly-addressed-ibm-bugs
-
Widespread WordPress compromise possible with critical plugin flaws
First seen on scworld.com Jump to article: www.scworld.com/brief/widespread-wordpress-compromise-possible-with-critical-plugin-flaws
-
Critical Array Networks flaw added to CISA vulnerabilities catalog
First seen on scworld.com Jump to article: www.scworld.com/brief/critical-array-networks-flaw-added-to-cisa-vulnerabilities-catalog