Tag: flaw
-
Report: Over 100M Americans Rely on Vulnerable Water Systems
Inspector General Report Reveals 97 Water Systems with Critical Cybersecurity Risks. The Environmental Protection Agency inspector general said over 100 million Americans depend on drinking water systems exposed to cybersecurity flaws that could allow hackers to disrupt service or cause irreparable physical damage to drinking water infrastructure. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/report-over-100m-americans-rely-on-vulnerable-water-systems-a-26841
-
Critical WordPress Plug-in Flaw Exposes 4M Sites to Takeover
A vulnerability found in the Really Simple Security plug-in allows an attacker to remotely gain access to any account on an affected website, including the administrator, when 2FA is enabled. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/critical-wordpress-plugin-flaw-4m-sites-takeover
-
VMware Discloses Exploitation of HardFix vCenter Server Flaw
The saga of VMWare’s critical CVE-2024-38812 vCenter Server bug has reached the “exploitation detected” stage. The post VMware Discloses Exploitation of Hard-to-Fix vCenter Server Flaw appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/vmware-discloses-exploitation-of-hard-to-fix-vcenter-server-flaw/
-
Mozilla 0Din Warns of ChatGPT Sandbox Flaws Enabling Python Execution
Mozilla’s 0Din uncovers critical flaws in ChatGPT’s sandbox, allowing Python code execution and access to internal configurations. OpenAI… First seen on hackread.com Jump to article: hackread.com/mozilla-0din-chatgpt-sandbox-flaws-python-execution/
-
THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 11 – Nov 17)
What do hijacked websites, fake job offers, and sneaky ransomware have in common? They’re proof that cybercriminals are finding smarter, sneakier ways to exploit both systems and people.This week makes one thing clear: no system, no person, no organization is truly off-limits. Attackers are getting smarter, faster, and more creative”, using everything from human trust…
-
ChatGPT Sandbox Flaws Allow Python Script Execution, File Manipulation
Mozilla’s 0Din uncovers critical flaws in ChatGPT’s sandbox, allowing Python code execution and access to internal configurations. OpenAI… First seen on hackread.com Jump to article: hackread.com/chatgpt-sandbox-flaws-python-script-file-manipulation/
-
Citrix Virtual Apps Desktops Zero-Day Vulnerability Exploited in the Wild
A critical new vulnerability has been discovered in Citrix’s Virtual Apps and Desktops solution, which is widely used to facilitate secure remote access to desktop applications now exploited in the wild. The vulnerability, which remains unpatched, was detailed last week by Watchtowr Labs in a blog post . This flaw poses a significant threat, as…
-
Zohocorp ManageEngine ADAudit Plus SQL Injection Vulnerability
Zohocorp, the company behind ManageEngine, has released a security update addressing a critical SQL injection vulnerability in its ADAudit Plus software. The flaw, identified as CVE-2024-49574, affects all builds of ADAudit Plus before version 8123 and has been classified as high severity. The vulnerability was resolved with the release of version 8123 on November 8, 2024. The SQL…
-
Critical Really Simple Security plugin flaw impacts 4M+ WordPress sites
A Really Simple Security plugin flaw affects 4M+ sites, allowing attackers full admin access. It’s one of the most critical WordPress vulnerabilities ever. Wordfence researchers warn of a vulnerability, tracked as CVE-2024-10924 (CVSS Score of 9.8), in the Really Simple Security plugin that affects 4M+ sites. The Really Simple Security plugin, formerly Really Simple SSL, is…
-
GeoVision 0-Day Vulnerability Exploited in the Wild
Tags: authentication, cve, cvss, cyber, cybersecurity, exploit, flaw, injection, vulnerability, zero-dayCybersecurity researchers have detected the active exploitation of a zero-day vulnerability in GeoVision devices, which the manufacturer no longer supports. The vulnerability, now designated as CVE-2024-11120, has been assigned a high-severity CVSS score of 9.8 and used by a sophisticated botnet. The security flaw is a pre-authentication command injection vulnerability, which allows attackers to execute arbitrary…
-
Security plugin flaw in millions of WordPress sites gives admin access
A critical authentication bypass vulnerability has been discovered impacting the WordPress plugin ‘Really Simple Security’ (formerly ‘Really Simple SSL’), including both free and Pro versions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/security-plugin-flaw-in-millions-of-wordpress-sites-gives-admin-access/
-
Cybersecurity Flaws in US Drinking Water Systems Put 26 Million at Risk
The U.S. Environmental Protection Agency (EPA) Report Exposes Cybersecurity Risks in US Water Systems: Vulnerabilities in Critical Drinking… First seen on hackread.com Jump to article: hackread.com/cybersecurity-flaws-us-drinking-water-systems-risks/
-
Warning: DEEPDATA Malware Exploiting Unpatched Fortinet Flaw to Steal VPN Credentials
A threat actor known as BrazenBamboo has exploited an unresolved security flaw in Fortinet’s FortiClient for Windows to extract VPN credentials as part of a modular framework called DEEPDATA.Volexity, which disclosed the findings Friday, said it identified the zero-day exploitation of the credential disclosure vulnerability in July 2024, describing BrazenBamboo as the developer behind DEEPDATA,…
-
Cloud Platform Bugs Threaten Smart Home Security
Researchers Find Exploitable Flaws in the OvrC Platform. Security flaws in a cloud platform for remotely configuring and monitoring Internet of Things gadgets could expose millions of devices to remote code execution hacks. Security researchers at Claroty’s Team82 uncovered 10 vulnerabilities in the widely used OvrC cloud platform. First seen on govinfosecurity.com Jump to article:…
-
Google fixes 2 Vertex AI flaws that could lead to privilege escalation, model leaks
First seen on scworld.com Jump to article: www.scworld.com/news/google-fixes-2-vertex-ai-flaws-that-could-lead-to-privilege-escalation-model-leaks
-
Palo Alto Reports Firewalls Exploited Using an Unknown Flaw
Tags: attack, cybersecurity, exploit, firewall, flaw, Internet, network, update, vulnerability, zero-dayNo Patch Yet; Management Interface Lockdown Blunts Attacks, Networking Giant Says. Attackers are exploiting a zero-day vulnerability in some types of Palo Alto Networks firewalls, the cybersecurity giant warned. While details of the flaw remain scant – no patch is available – the vendor urged customers to ensure their firewall management interfaces are not internet-exposed.…
-
Five Eyes infosec agencies list 2023’s most exploited software flaws
Slack patching remains a problem which is worrying as crooks increasingly target zero-day vulns First seen on theregister.com Jump to article: www.theregister.com/2024/11/14/five_eyes_2023_top_vulnerabilities/
-
Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitrary Code Remotely
A critical security flaw has been uncovered in certain TP-Link routers, potentially allowing malicious actors to remotely compromise affected devices. The vulnerability, identified as CVE-2024-11237, affects TP-Link VN020 F3v(T) routers running firmware version TT_V6.2.1021, which are primarily deployed through Tunisie Telecom and Topnet ISPs. Similar variants of the router used in Algeria and Morocco are…
-
Fortinet Patches VPN Flaw That Provided Privilege Escalation
First seen on packetstormsecurity.com Jump to article: packetstormsecurity.com/news/view/36600/Fortinet-Patches-VPN-Flaw-That-Provided-Privilege-Escalation.html
-
CISA Warns of Two More Palo Alto Expedition Flaws Exploited in Attacks
CISA has added two more Palo Alto Networks Expedition flaws, CVE-2024-9463 and CVE-2024-9465, to its KEV catalog. The post CISA Warns of Two More Palo Alto Expedition Flaws Exploited in Attacks appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cisa-warns-of-two-more-palo-alto-expedition-flaws-exploited-in-attacks/
-
Critical Plugin Flaw Exposed 4 Million WordPress Websites to Takeover
Over 4 million WordPress websites were impacted by a critical Really Simple Security plugin vulnerability providing full administrative access. The post Critical Plugin Flaw Exposed 4 Million WordPress Websites to Takeover appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/critical-plugin-flaw-exposed-4-million-wordpress-websites-to-takeover/
-
Zero-Day Exploits Surge in 2023, Cisco, Fortinet Vulnerabilities Targeted
A report from the Five Eyes cybersecurity alliance, released by the CISA, highlights the majority of the most exploited vulnerabilities last year were initially zero-day flaws, a significant increase compared to 2022 when less than half of the top vulnerabilities were zero-day exploits. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/11/zero-day-exploits-surge-in-2023-cisco-fortinet-vulnerabilities-targeted/
-
High-Severity Flaw in PostgreSQL Allows Hackers to Exploit Environment Variables
Cybersecurity researchers have disclosed a high-severity security flaw in the PostgreSQL open-source database system that could allow unprivileged users to alter environment variables, and potentially lead to code execution or information disclosure.The vulnerability, tracked as CVE-2024-10979, carries a CVSS score of 8.8.Environment variables are user-defined values that can allow a program First seen on thehackernews.com…
-
CISA Flags Two Actively Exploited Palo Alto Flaws; New RCE Attack Confirmed
Tags: attack, cisa, cybersecurity, exploit, flaw, infrastructure, kev, network, rce, remote-code-execution, update, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday warned that two more flaws impacting the Palo Alto Networks Expedition have come under active exploitation in the wild.To that, it has added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary updates by…
-
CISA Flags Critical Palo Alto Network Flaws Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday warned that two more flaws impacting the Palo Alto Networks Expedition have come under active exploitation in the wild.To that, it has added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary updates by…
-
Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices
Taiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that coul… First seen on thehackernews.com Jump to article: thehackernews.com/2024/11/synology-urges-patch-for-critical-zero.html
-
Hackers target critical flaw CVE-2024-10914 in EOL D-Link NAS Devices
The exploitation of the recently disclosed ‘won’t fix’ issue CVE-2024-10914 in legacy D-Link NAS devices began days after its disclosure. Days after D-Link announced it wouldn’t patch a critical vulnerability, tracked as CVE-2024-10914 (CVSS score of 9.8), in legacy D-Link NAS devices, that threat actors started attempting to exploit. The vulnerability CVE-2024-10914 is a command…