Tag: flaw
-
Samsung zero-day flaw actively exploited in the wild
Google’s Threat Analysis Group (TAG) researchers warn of a Samsung zero-day vulnerability that is exploited in the wild. Google’s Threat Analysis Grou… First seen on securityaffairs.com Jump to article: securityaffairs.com/170119/security/samsung-zero-day-activey-exploited.html
-
Hackers Probing Newly Disclosed Fortinet Zero Day
Mandiant Says High-Severity Flaw Could Give Attackers Remote Unauthenticated Access. Researchers at Mandiant say a new threat cluster first observed J… First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-probing-newly-disclosed-fortinet-zero-day-a-26624
-
Roundcube XSS flaw exploited to steal credentials, email (CVE-2024-37383)
Attackers have exploited an XSS vulnerability (CVE-2024-37383) in the Roundcube Webmail client to target a governmental organization of a CIS country,… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/10/22/cve-2024-37383-exploited/
-
Researchers discover flaws in 5 endend encrypted cloud services
First seen on scworld.com Jump to article: www.scworld.com/news/researchers-discover-flaws-in-5-end-to-end-encrypted-cloud-services
-
Fortinet warns of new critical FortiManager flaw used in zero-day attacks
Fortinet publicly disclosed today a critical FortiManager API vulnerability, tracked as CVE-2024-47575, that was exploited in zero-day attacks to stea… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortinet-warns-of-new-critical-fortimanager-flaw-used-in-zero-day-attacks/
-
U.S. CISA adds ScienceLogic SL1 flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ScienceLogic SL1 flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cyber… First seen on securityaffairs.com Jump to article: securityaffairs.com/170104/security/u-s-cisa-adds-sciencelogic-sl1-flaw-to-its-known-exploited-vulnerabilities-catalog.html
-
Severe Flaws Discovered in Major E2EE Cloud Storage Services
First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/flaws-e2ee-cloud-storage-services/
-
Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration
A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance (CSA) a zero-day to perform a … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/nation-state-attackers-exploiting.html
-
VMware fixes bad patch for critical vCenter Server RCE flaw
VMware has released another security update for CVE-2024-38812, a critical VMware vCenter Server remote code execution vulnerability that was not corr… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/vmware-fixes-bad-patch-for-critical-vcenter-server-rce-flaw/
-
Critical OPA Vulnerability Exposes Windows Credentials
Attackers Could Exploit Flaw to Relay Credentials, Compromise Systems. A critical vulnerability in Open Policy Agent could expose NTLM credentials fro… First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/critical-opa-vulnerability-exposes-windows-credentials-a-26590
-
VMware failed to fully address vCenter Server RCE flaw CVE-2024-38812
VMware addressed a remote code execution flaw, demonstrated in a Chinese hacking contest, for the second time in two months. VMware failed to fully ad… First seen on securityaffairs.com Jump to article: securityaffairs.com/170096/security/vmware-failed-to-fix-rce-vcenter-server-cve-2024-38812.html
-
CISA Warns Recent Microsoft SharePoint RCE Flaw Exploited in Attacks
CISA has added a recent Microsoft SharePoint Server remote code execution vulnerability to the KEV catalog. The post CISA Warns Recent Microsoft Share… First seen on securityweek.com Jump to article: www.securityweek.com/cisa-warns-recent-microsoft-sharepoint-rce-flaw-exploited-in-attacks/
-
Hackers exploit Roundcube webmail flaw to steal email, credentials
Threat actors have been exploiting a vulnerability in the Roundcube Webmail client to target government organizations in the Commonwealth of Independe… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-roundcube-webmail-flaw-to-steal-email-credentials/
-
Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware
Threat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware.Cybersec… First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/critical-veeam-vulnerability-exploited.html
-
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf
The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/oilrig-exploits-windows-kernel-flaw-in.html
-
Severe flaws in E2EE cloud storage platforms used by millions
Several end-to-end encrypted (E2EE) cloud storage platforms are vulnerable to a set of security issues that could expose user data to malicious actors… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/severe-flaws-in-e2ee-cloud-storage-platforms-used-by-millions/
-
WeChat Devs Introduced Security Flaws When They Modded TLS
Tags: flawFirst seen on packetstormsecurity.com Jump to article: packetstormsecurity.com/news/view/36483/WeChat-Devs-Introduced-Security-Flaws-When-They-Modded-TLS.html
-
Unknown threat actors exploit Roundcube Webmail flaw in phishing campaign
Hackers exploited a now-patched Roundcube flaw in a phishing attack to steal user credentials from the open-source webmail software. Researchers from … First seen on securityaffairs.com Jump to article: securityaffairs.com/170055/hacking/roundcube-flaw-exploited-in-phishing-attack.html
-
Serious Adversaries Circle Ivanti CSA Zero-Day Flaws
Suspected nation-state actors are spotted stringing together three different zero-days in the Ivanti Cloud Services Application to gain persistent acc… First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/serious-adversaries-circle-ivanti-csa-flaws
-
F5 fixed a high-severity elevation of privilege vulnerability in BIG-IP
Technology firm F5 patches a high-severity elevation of privilege vulnerability in BIG-IP and a medium-severity flaw in BIG-IQ. F5 addressed two vulne… First seen on securityaffairs.com Jump to article: securityaffairs.com/170022/security/f5-patches-big-ip-elevation-of-privilege-bug.html
-
Researchers Debut AI Tool That Helps Detect Zero-Days
Vulnerability Tool Detected Flaws in OpenAI and Nvidia APIs Used in GitHub Projects. Security researchers have developed an AI tool that can detect re… First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/researchers-debut-ai-tool-that-helps-detect-zero-days-a-26575
-
CISA adds SolarWinds flaw to exploited vulnerabilities catalog
First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-flaw-solarwinds-web-help-desk/730003/
-
New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution
GitLab has released security updates for Community Edition (CE) and Enterprise Edition (EE) to address eight security flaws, including a critical bug … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/new-critical-gitlab-vulnerability-could.html
-
VMware Struggles to Fix Flaw Exploited at Chinese Hacking Contest
For the second time in as many months, VMware patches a remote code execution vulnerability first exploited at a Chinese hacking contest in June. The … First seen on securityweek.com Jump to article: www.securityweek.com/vmware-struggles-to-fix-flaw-exploited-at-chinese-hacking-contest/
-
CISA Seeks Feedback on Upcoming Product Security Flaws Guidance
First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-product-security-flaws/
-
North Korean Hackers Exploit Zero-Day Flaw (CVE-2024-38178) in >>Operation Code on Toast<<
A joint report by AhnLab Security Emergency response Center (ASEC) and the National Cyber Security Center (NCSC) has revealed a new zero-day vulnerabi… First seen on securityonline.info Jump to article: securityonline.info/north-korean-hackers-exploit-zero-day-flaw-cve-2024-38178-in-operation-code-on-toast/
-
CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Fortinet products to its Known … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/cisa-warns-of-critical-fortinet-flaw-as.html
-
Firefox Zero-Day Under Attack: Update Your Browser Immediately
Mozilla has revealed that a critical security flaw impacting Firefox and Firefox Extended Support Release (ESR) has come under active exploitation in … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/mozilla-warns-of-active-exploitation-in.html
-
macOS HM Surf flaw in TCC allows bypass Safari privacy settings
Microsoft disclosed a flaw in the macOS Apple’s Transparency, Consent, and Control (TCC) framework that could allow it to bypass privacy settings and … First seen on securityaffairs.com Jump to article: securityaffairs.com/169945/security/macos-hm-surf-flaw-tcc-bypass-safari-privacy-settings.html