Tag: flaw
-
NIST Still Struggling to Clear Massive Vulnerability Backlog
Agency Calls Former Deadline to Clear Major Vulnerability Backlog Too ‘Optimistic’. The National Institute of Standards and Technology is still struggling with a backlog of over 19,000 security vulnerabilities in its National Vulnerability Database, according to a recent announcement, which acknowledged initial projections to clear the unassessed software flaws were too optimistic. First seen on…
-
NIST Clears Backlog of Known Security Flaws but Not All Vulnerabilities
NIST, the embattled agency that analyzes security vulnerabilities, has cleared the backlog of known CVEs that hadn’t been processed but needs more time to clear the entire backlog of unanalyzed flaws. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/11/nist-clears-backlog-of-known-security-flaws-but-not-all-vulnerabilities/
-
Citrix Session Recording users warned of CVEs that allow hackers to gain control
Security researchers at watchTowr discovered the flaw and claim attackers can gain access without authentication, a finding which Citrix disputes. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/citrix-session-recording-cves-hackers/732794/
-
Zero-day flaw behind Rackspace breach still a mystery
More than two weeks after threat actors exploited a zero-day vulnerability in a third-party utility to breach Rackspace, the details about the flaw an… First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366613555/Zero-day-flaw-behind-Rackspace-breach-still-a-mystery
-
Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System
Google has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.The vulnerability, tracke… First seen on thehackernews.com Jump to article: thehackernews.com/2024/11/google-warns-of-actively-exploited-cve.html
-
Critical Flaws in Ollama AI Framework Could Enable DoS, Model Theft, and Poisoning
Cybersecurity researchers have disclosed six security flaws in the Ollama artificial intelligence (AI) framework that could be exploited by a maliciou… First seen on thehackernews.com Jump to article: thehackernews.com/2024/11/critical-flaws-in-ollama-ai-framework.html
-
Five Eyes infosec agencies list 2024’s most exploited software flaws
Slack patching remains a problem which is worrying as crooks increasingly target zero-day vulns First seen on theregister.com Jump to article: www.theregister.com/2024/11/14/five_eyes_2024_top_vulnerabilities/
-
Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails
A newly patched security flaw impacting Windows NT LAN Manager (NTLM) was exploited as a zero-day by a suspected Russia-linked actor as part of cyber attacks targeting Ukraine.The vulnerability in question, CVE-2024-43451 (CVSS score: 6.5), refers to an NTLM hash disclosure spoofing vulnerability that could be exploited to steal a user’s NTLMv2 hash. It was…
-
Right-Click to Hack: Zero-Day CVE-2024-43451 Vulnerability Targets Windows Users
ClearSky Cyber Security has uncovered a new zero-day vulnerability, CVE-2024-43451, actively exploited in the wild, targeting Windows systems primarily in Ukraine. This flaw enables attackers to exploit URL files for... First seen on securityonline.info Jump to article: securityonline.info/right-click-to-hack-zero-day-cve-2024-43451-vulnerability-targets-windows-users/
-
WeChat devs introduced security flaws when they modded TLS, say researchers
Tags: flawFirst seen on theregister.com Jump to article: www.theregister.com/2024/10/17/wechat_devs_modded_tls_introducing/
-
Citrix, watchTowr clash on new RCE-enabling Citrix Virtual Apps and Desktops flaws
First seen on scworld.com Jump to article: www.scworld.com/brief/citrix-watchtowr-clash-on-new-rce-enabling-citrix-virtual-apps-and-desktops-flaws
-
Half a dozen HPE Aruba Networking Access Point flaws addressed
First seen on scworld.com Jump to article: www.scworld.com/brief/half-a-dozen-hpe-aruba-networking-access-point-flaws-addressed
-
Citrix Patches Zero-Day Recording Manager Bugs
There is some disagreement over whether the remote code execution (RCE) security flaws allow for unauthenticated exploitation or not. Citrix says no, but researchers say the company is downplaying a good old unauthenticated RCE. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/citrix-patches-zero-day-recording-manager-bugs
-
These 20 D-Link Devices Have Critical RCE Bug, but NO Patch NEVER
‘Bobby’ flaw flagged WONTFIX: Company doesn’t make storage devices now; has zero interest in fixing this catastrophic vulnerability. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/11/d-link-nas-wont-fix-richixbw/
-
Zoom addressed two high-severity issues in its platform
Zoom addressed six flaws, including two high-severity issues that could allow remote attackers to escalate privileges or leak sensitive information. Zoom addressed six vulnerabilities in its video conferencing and communication platform. Two of these vulnerabilities, tracked as CVE-2024-45421 and CVE-2024-45419, are high-severity issues that remote attackers could exploit to escalate privileges or leak sensitive information.…
-
Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
Today is Microsoft’s November 2024 Patch Tuesday, which includes security updates for 89 flaws, including four zero-days, two of which are actively exploited. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-november-2024-patch-tuesday-fixes-4-zero-days-89-flaws/
-
Microsoft Fixes 90 New Flaws, Including Actively Exploited NTLM and Task Scheduler Bugs
Microsoft on Tuesday revealed that two security flaws impacting Windows NT LAN Manager (NTLM) and Task Scheduler have come under active exploitation in the wild.The security vulnerabilities are among the 90 security bugs the tech giant addressed as part of its Patch Tuesday update for November 2024. Of the 90 flaws, four are rated Critical,…
-
Microsoft Exchange adds warning to emails abusing spoofing flaw
Microsoft has disclosed a high-severity Exchange Server vulnerability that allows attackers to forge legitimate senders on incoming emails and make malicious messages a lot more effective. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/unpatched-microsoft-exchange-server-flaw-enables-spoofing-attacks/
-
Microsoft Confirms Zero-Day Exploitation of Task Scheduler Flaw
Patch Tuesday: Microsoft patches 90 security flaws across the Windows ecosystem warns of zero-day exploitation and code execution risks. The post Microsoft Confirms Zero-Day Exploitation of Task Scheduler Flaw appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/microsoft-confirms-zero-day-exploitation-of-task-scheduler-flaw/
-
Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 91 flaws
Today is Microsoft’s November 2024 Patch Tuesday, which includes security updates for 91 flaws, including four zero-days, two of which are actively exploited. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-november-2024-patch-tuesday-fixes-4-zero-days-91-flaws/
-
China’s infosec leads accuse Intel of NSA backdoor, cite chip security flaws
First seen on theregister.com Jump to article: www.theregister.com/2024/10/16/china_intel_chip_security/
-
Patch Tuesday: Critical Flaws in Adobe Commerce, Photoshop, InDesign, Illustrator
Adobe patches critical-severity bugs in multiple products, including the Adobe Commerce and Magento Open Source platforms. The post Patch Tuesday: Critical Flaws in Adobe Commerce, Photoshop, InDesign, Illustrator appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/patch-tuesday-critical-flaws-in-adobe-commerce-photoshop-indesign-illustrator/
-
Citrix Issues Patches for Zero-Day Recording Manager Bugs
There is some disagreement over whether the remote code execution (RCE) security flaws allow for unauthenticated exploitation or not. Citrix says no, but researchers say the company is downplaying a good old unauthenticated RCE. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/citrix-patches-zero-day-recording-manager-bugs
-
Critical NAS-ty Flaw Strikes D-Link Storage Boxes
Tags: flawFirst seen on packetstormsecurity.com Jump to article: packetstormsecurity.com/news/view/36583/Critical-NAS-ty-Flaw-Strikes-D-Link-Storage-Boxes.html
-
New Flaws in Citrix Virtual Apps Enable RCE Attacks via MSMQ Misconfiguration
Cybersecurity researchers have disclosed new security flaws impacting Citrix Virtual Apps and Desktop that could be exploited to achieve unauthenticated remote code execution (RCE)The issue, per findings from watchTowr, is rooted in the Session Recording component that allows system administrators to capture user activity, and record keyboard and mouse input, along with a video stream…