Tag: flaw
-
Week in review: MOVEit auth bypass flaws quitely fixed, open-source Rafel RAT targets Androids
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Progress quietly fixes MOVEit auth bypass flaws (CVE… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/06/30/week-in-review-moveit-auth-bypass-flaws-quitely-fixed-open-source-rafel-rat-targets-androids/
-
Juniper Releases Emergency Fix for Maximum-Severity Flaw
Vulnerability Can Allow Authentication Bypass; No Evidence of Exploitation Yet. Juniper Networks released an out-of-band fix for a maximum-severity vu… First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/juniper-releases-emergency-fix-for-maximum-severity-flaw-a-25669
-
Juniper releases outcycle fix for max severity auth bypass flaw
Juniper Networks has released an emergency update to address a maximum severity vulnerability that leads to authentication bypass in Session Smart Rou… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/juniper-releases-out-of-cycle-fix-for-max-severity-auth-bypass-flaw/
-
Hackers exploit critical D-Link DIR-859 router flaw to steal passwords
Hackers are exploiting a critical vulnerability that affects all D-Link DIR-859 WiFi routers to collect account information from the device, including… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-critical-d-link-dir-859-router-flaw-to-steal-passwords/
-
SolarWinds Serv-U Vulnerability Under Active Attack – Patch Immediately
A recently patched high-severity flaw impacting SolarWinds Serv-U file transfer software is being actively exploited by malicious actors in the wild.T… First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/solarwinds-serv-u-vulnerability-under.html
-
Juniper Networks Warns of Critical Authentication Bypass Vulnerability
Juniper Networks warns of a critical authentication bypass flaw impacting Session Smart routers and conductors. The post Networks warns of a critical … First seen on securityweek.com Jump to article: www.securityweek.com/juniper-networks-warns-of-critical-authentication-bypass-vulnerability/
-
regreSSHion RCE Flaw Impacts 700K Linux Systems
The Qualys Threat Research Unit has identified a newly discovered vulnerability in OpenSSH, dubbed >>regreSSHion
-
Researchers Uncover UEFI Vulnerability Affecting Multiple Intel CPUs
Cybersecurity researchers have disclosed details of a now-patched security flaw in Phoenix SecureCore UEFI firmware that affects multiple families of … First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/researchers-uncover-uefi-vulnerability.html
-
PoC exploit for critical Fortra FileCatalyst flaw published (CVE-2024-5276)
A critical SQL injection vulnerability in Fortra FileCatalyst Workflow (CVE-2024-5276) has been patched; a PoC exploit is already available online. Wh… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/06/27/cve-2024-5276-poc/
-
Multiple Vulnerabilities Found in Gas Chromatographs
Critical-Severity Flaws Expose Emerson Devices to Cyberattacks. Multiple critical vulnerabilities in Emerson Rosemount 370XA gas chromatographs could … First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/multiple-vulnerabilities-found-in-gas-chromatographs-a-25655
-
UNC3886 Uses Fortinet, VMware 0-Days and Stealth Tactics in Long-Term Spying
The China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed … First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/chinese-cyber-espionage-group-exploits.html
-
Kraken Crypto Exchange Hit by $3 Million Theft Exploiting Zero-Day Flaw
Crypto exchange Kraken revealed that an unnamed security researcher exploited an extremely critical zero-day flaw in its platform to steal $3 million … First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/kraken-crypto-exchange-hit-by-3-million.html
-
VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi
VMware has released updates to address critical flaws impacting Cloud Foundation, vCenter Server, and vSphere ESXi that could be exploited to achieve … First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/vmware-issues-patches-for-cloud.html
-
ASUS Patches Critical Authentication Bypass Flaw in Multiple Router Models
ASUS has shipped software updates to address a critical security flaw impacting its routers that could be exploited by malicious actors to bypass auth… First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/asus-patches-critical-authentication.html
-
Mailcow Mail Server Flaws Expose Servers to Remote Code Execution
Two security vulnerabilities have been disclosed in the Mailcow open-source mail server suite that could be exploited by malicious actors to achieve a… First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/mailcow-mail-server-flaws-expose.html
-
New MOVEit Transfer Vulnerability Under Active Exploitation – Patch ASAP!
A newly disclosed critical security flaw impacting Progress Software MOVEit Transfer is already seeing exploitation attempts in the wild shortly after… First seen on thehackernews.com Jump to article: thehackernews.com/2024/06/new-moveit-transfer-vulnerability-under.html
-
Ollama AI Platform Flaw Let Attackers Execute Remote Code
â¤Hackers attack AI infrastructure platforms since these systems contain a multitude of valuable data, algorithms that are sophisticated in nature, a… First seen on gbhackers.com Jump to article: gbhackers.com/ollama-ai-platform-remote-code-execution-flaw/
-
Hackers target new MOVEit Transfer critical auth bypass bug
Threat actors are attempting to exploit a critical authentication bypass flaw impacting Progress MOVEit Transfer, which the vendor disclosed yesterday… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-new-moveit-transfer-critical-auth-bypass-bug/
-
Exploit for critical Fortra FileCatalyst Workflow SQLi flaw released
The Fortra FileCatalyst Workflow is vulnerable to an SQL injection vulnerability that could allow remote unauthenticated attackers to create rogue adm… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/exploit-for-critical-fortra-filecatalyst-workflow-sqli-flaw-released/
-
Progress quietly fixes MOVEit auth bypass flaws (CVE-2024-5805, CVE-2024-5806)
Progress Software has patched one critical (CVE-2024-5805) and one high-risk (CVE-2024-5806) vulnerability in MOVEit, its widely used managed file tra… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/06/25/cve-2024-5805-cve-2024-5806/
-
Mirai-like botnet is exploiting recently disclosed Zyxel NAS flaw
Researchers warn that a Mirai-based botnet is exploiting a recently disclosed critical vulnerability in EoL Zyxel NAS devices. Researchers at the Shad… First seen on securityaffairs.com Jump to article: securityaffairs.com/164927/cyber-crime/mirai-like-botnet-zyxel-nas.html
-
Mailcow Patches Critical XSS and File Overwrite Flaws Update NOW
lcow email servers faced critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) allowing potential remote code execution. Update to Mailcow 2024… First seen on hackread.com Jump to article: hackread.com/mailcow-patches-critical-xss-file-overwrite-flaws/
-
Microsoft paid Tenable a bug bounty for an Azure flaw it says doesn’t need a fix, just better documentation
First seen on theregister.com Jump to article: www.theregister.com/2024/06/05/tenable_azure_flaw/
-
POC exploit code published for 9.8-rated Apache HugeGraph RCE flaw
First seen on theregister.com Jump to article: www.theregister.com/2024/06/07/poc_apache_hugegraph/
-
Cisco fixes WebEx flaw that allowed government, military meetings to be spied on
First seen on theregister.com Jump to article: www.theregister.com/2024/06/07/cisco_fixes_webex_flaw_which/
-
New attack uses MSC files and Windows XSS flaw to breach networks
A novel command execution technique dubbed ‘GrimResource’ uses specially crafted MSC (Microsoft Saved Console) and an unpatched Windows XSS flaw to pe… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-grimresource-attack-uses-msc-files-and-windows-xss-flaw-to-breach-networks/
-
Ransomware Attacks Leverage Recent Critical PHP Flaw
First seen on duo.com Jump to article: duo.com/decipher/ransomware-attacks-leverage-recent-critical-php-flaw
-
Hackers Use Windows XSS Flaw To Execute Arbitrary Command In MMC Console
Attackers are leveraging a new infection technique called GrimResource that exploits MSC files. By crafting malicious MSC files, they can achieve full… First seen on gbhackers.com Jump to article: gbhackers.com/windows-xss-flaw-mmc-command-execution/
-
Facebook PrestaShop module exploited to steal credit cards
Hackers are exploiting a flaw in a premium Facebook module for PrestaShop named pkfacebook to deploy a card skimmer on vulnerable e-commerce sites and… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/facebook-prestashop-module-exploited-to-steal-credit-cards/
-
Intel-powered computers affected by serious firmware flaw (CVE-2024-0762)
A vulnerability (CVE-2024-0762) in the Phoenix SecureCore UEFI, which runs on various Intel processors, could be exploited locally to escalate privile… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/06/21/cve-2024-0762/