Tag: flaw
-
TellYouThePass ransomware exploits recent PHP RCE flaw to breach servers
The TellYouThePass ransomware gang has been exploiting the recently patched CVE-2024-4577 remote code execution vulnerability in PHP to deliver webshe… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/tellyouthepass-ransomware-exploits-recent-php-rce-flaw-to-breach-servers/
-
Patch Tuesday: Remote Code Execution Flaw in Microsoft Message Queuing
Tags: cvss, exploit, flaw, malicious, microsoft, remote-code-execution, update, vulnerability, windowsThe Windows vulnerability carries a CVSS severity score of 9.8/10 and can be exploited by via specially crafted malicious MSMQ packets. The post ows v… First seen on securityweek.com Jump to article: www.securityweek.com/patch-tuesday-remote-code-execution-flaw-in-microsoft-message-queuing/
-
Adobe Plugs Code Execution Holes in After Effects, Illustrator
Patch Tuesday: Adobe fixes critical flaws and warns of the risk of code execution attacks on Windows and macOS platforms. The post esday: Adobe fixes … First seen on securityweek.com Jump to article: www.securityweek.com/adobe-plugs-code-execution-holes-in-after-effects-illustrator/
-
Apple Patches Vision Pro Vulnerability Used in Possibly ‘First Ever Spatial Computing Hack’
Apple has released a visionOS update that patches CVE-2024-27812, which may be the first flaw specific to the VR headset. The post s released a vision… First seen on securityweek.com Jump to article: www.securityweek.com/apple-patches-vision-pro-vulnerability-used-in-first-ever-spatial-computing-hack/
-
Arm Warns Of Mali GPU Kernel Driver Flaws Exploited In The Wild
The Mali GPU driver is a widely used Graphical Processing Unit for multiple devices, including Android and Linux. A new vulnerability has been discove… First seen on gbhackers.com Jump to article: gbhackers.com/mali-gpu-kernel-driver-flaw-exploited/
-
Arm warns of actively exploited flaw in Mali GPU kernel drivers
Arm has issued a security bulletin warning of a memory-related vulnerability in Bifrost and Valhall GPU kernel drivers that is being exploited in the … First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arm-warns-of-actively-exploited-flaw-in-mali-gpu-kernel-drivers/
-
Check Point Releases Fix For Zero-Day VPN Flaw
The flaw (CVE-2024-24919) could enable attackers to read certain information on Gateways if they are connected to the Internet and enabled with Remote… First seen on duo.com Jump to article: duo.com/decipher/check-point-releases-fix-for-exploited-vpn-flaw
-
PHP addressed critical RCE flaw potentially impacting millions of servers
A new PHP for Windows remote code execution (RCE) flaw affects version 5.x and earlier versions, potentially impacting millions of servers worldwide. … First seen on securityaffairs.com Jump to article: securityaffairs.com/164302/breaking-news/php-critical-rce.html
-
New EmailGPT Flaw Puts User Data at Risk: Remove the Extension NOW
First seen on hackread.com Jump to article: hackread.com/emailgpt-flaw-user-data-at-risk-remove-extension/
-
Netgear WNR614 flaws allow device takeover, no fix available
Researchers found half a dozen vulnerabilities of varying severity impacting Netgear WNR614 N300, a budget-friendly router that proved popular among h… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/netgear-wnr614-flaws-allow-device-takeover-no-fix-available/
-
Exploit for critical Veeam auth bypass available, patch now
A proof-of-concept (PoC) exploit for a Veeam Backup Enterprise Manager authentication bypass flaw tracked as CVE-2024-29849 is now publicly available,… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/exploit-for-critical-veeam-auth-bypass-available-patch-now/
-
Everything You Need to Know About Cross-Site Scripting
Cross-Site Scripting (XSS) is a sneaky security flaw that lets attackers inject malicious code into seemingly harmless websites. In this article, let’… First seen on itsecurityguru.org Jump to article: www.itsecurityguru.org/2024/06/07/everything-you-need-to-know-about-cross-site-scripting/
-
CISA Alerts Federal Agencies to Patch Actively Exploited Linux Kernel Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a security flaw impacting the Linux kernel to the Known Exploited V… First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/cisa-alerts-federal-agencies-to-patch.html
-
SolarWinds fixed multiple flaws in Serv-U and SolarWinds Platform
SolarWinds addressed multiple vulnerabilities in Serv-U and the SolarWinds Platform, including a bug reported by a pentester working with NATO. SolarW… First seen on securityaffairs.com Jump to article: securityaffairs.com/164270/security/solarwinds-flaws-serv-u-platform.html
-
Cisco Finds 15 Vulnerabilities in AutomationDirect PLCs
Cisco Talos researchers have found over a dozen vulnerabilities in AutomationDirect PLCs, including flaws that could be valuable to attackers. The pos… First seen on securityweek.com Jump to article: www.securityweek.com/cisco-finds-15-vulnerabilities-in-automationdirect-plcs/
-
RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability
The threat actors behind the RedTail cryptocurrency mining malware have added a recently disclosed security flaw impacting Palo Alto Networks firewall… First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/redtail-crypto-mining-malware.html
-
How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet
Thanks to a flaw in a decade-old version of the RoboForm password manager and a bit of luck, researchers were able to unearth the password to a crypto… First seen on wired.com Jump to article: www.wired.com/story/roboform-password-3-million-dollar-crypto-wallet/
-
CVE-2024-29849: Veeam discloses Critical Vulnerability that allows attackers to bypass user authentication on its Backup Enterprise Manager web interface
On May 21, 2024, Veeam revealed a severe flaw across its Veeam Backup Enterprise Manager (VBEM) web interface that enables an unauthenticated attacker… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/06/cve-2024-29849-veeam-discloses-critical-vulnerability-that-allows-attackers-to-bypass-user-authentication-on-its-backup-enterprise-manager-web-interface/
-
Chinese threat actor exploits old ThinkPHP flaws since October 2023
Akamai observed a Chinese-speaking group exploiting two flaws, tracked as CVE-2018-20062 and CVE-2019-9082, in ThinkPHP applications. Akamai researche… First seen on securityaffairs.com Jump to article: securityaffairs.com/164239/hacking/hackers-exploits-old-thinkphp-flaws.html
-
PHP fixes critical RCE flaw impacting all versions for Windows
A new PHP for Windows remote code execution (RCE) vulnerability has been disclosed, impacting all releases since version 5.x, potentially impacting a … First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/php-fixes-critical-rce-flaw-impacting-all-versions-for-windows/
-
Hackers exploit 2018 ThinkPHP flaws to install ‘Dama’ web shells
Chinese threat actors are targeting ThinkPHP applications vulnerable to CVE-2018-20062 and CVE-2019-9082 to install a persistent web shell named Dama…. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-2018-thinkphp-flaws-to-install-dama-web-shells/
-
Zyxel patches critical flaws in EOL NAS devices
Zyxel has released patches for three critical vulnerabilities (CVE-2024-29972, CVE-2024-29973, and CVE-2024-29974) affecting two network-attached stor… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/06/06/cve-2024-29972-cve-2024-29973-cve-2024-29974/
-
Senator: HHS Needs to Require Security Measures for Health Sector
U.S. Senator Ron Wyden, who late last month asked federal agencies to investigate flaws in UnitedHealth Group’s cybersecurity measures that led to the… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/06/senator-hhs-needs-to-require-security-measures-for-health-sector/
-
Old ThinkPHP flaws leveraged by Chinese hackers
First seen on scmagazine.com Jump to article: www.scmagazine.com/brief/old-thinkphp-flaws-leveraged-by-chinese-hackers
-
Cisco addressed Webex flaws used to compromise German government meetings
Cisco addressed vulnerabilities that were exploited to compromise the Webex meetings of the German government. In early May, German media outlet Zeit … First seen on securityaffairs.com Jump to article: securityaffairs.com/164173/breaking-news/cisco-webex-flaws-german-government-meetings.html
-
Researchers Urge Immediate Action on New EmailGPT Vulnerability Exposing Users to Data Breach
The CyRC Vulnerability Advisory has reported a critical security flaw in EmailGPT, an AI-powered email writing assistant and Google Chrome extension t… First seen on thecyberexpress.com Jump to article: thecyberexpress.com/emailgpt-vulnerability/
-
GitHub Server Flaw Causes Critical Authentication Bypass
Recent developments have highlighted a critical security flaw in GitHub Enterprise Server, underscoring the importance of proactive measures to ensure… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/06/github-server-flaw-causes-critical-authentication-bypass/
-
Microsoft Will Switch Off Recall by Default After Researchers Expose Security Flaws
After weeks of withering security and privacy criticisms, Microsoft has vastly scaled back Recall, its ambitions for its AI-enabled silent recording f… First seen on wired.com Jump to article: www.wired.com/story/microsoft-recall-off-default-security-concerns/
-
Check-in terminals used by thousands of hotels leak guest info
Ariane Systems self check-in systems installed at thousands of hotels worldwide are vulnerable to a kiosk mode bypass flaw that could allow access to … First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/check-in-terminals-used-by-thousands-of-hotels-leak-guest-info/
-
Researchers Warn of CatDDoS Botnet and DNSBomb DDoS Attack Technique
The threat actors behind the CatDDoS malware botnet have exploited over 80 known security flaws in various software over the past three months to infi… First seen on thehackernews.com Jump to article: thehackernews.com/2024/05/researchers-warn-of-catddos-botnet-and.html