Tag: flaw
-
Magento flaw exploited to deploy persistent backdoor hidden in XML
Threat actors are exploiting critical Magento vulnerability CVE-2024-20720 to install a persistent backdoor on e-stores. Sansec researchers observed t… First seen on securityaffairs.com Jump to article: securityaffairs.com/161534/hacking/magento-vulnerability-actively-exploited.html
-
Wiz Discovers Flaws in GenAI Models Enabling Customer Data Theft
First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/wiz-discovers-flaws-generative-ai/
-
Over 92,000 exposed D-Link NAS devices have a backdoor account
A threat researcher has disclosed a new arbitrary command injection and hardcoded backdoor flaw in multiple end-of-life D-Link Network Attached Storag… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-92-000-exposed-d-link-nas-devices-have-a-backdoor-account/
-
CISA Warns: Hackers Actively Attacking Microsoft SharePoint Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw impacting Microsoft Sharepoint Server to its Known Exploite… First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/cisa-warns-hackers-actively-attacking.html
-
Microsoft Edge Bug Could Have Allowed Attackers to Silently Install Malicious Extensions
A now-patched security flaw in the Microsoft Edge web browser could have been abused to install arbitrary extensions on users’ systems and carry out m… First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/microsoft-edge-bug-could-have-allowed.html
-
New Ivanti RCE flaw may impact 16,000 exposed VPN gateways
Approximately 16,500 Ivanti Connect Secure and Poly Secure gateways exposed on the internet are likely vulnerable to a remote code execution (RCE) fla… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-ivanti-rce-flaw-may-impact-16-000-exposed-vpn-gateways/
-
Ivanti fixed for 4 new issues in Connect Secure and Policy Secure
Ivanti addressed four flaws impacting Connect Secure and Policy Secure Gateways that could lead to code execution and denial-of-service (DoS) conditio… First seen on securityaffairs.com Jump to article: securityaffairs.com/161465/security/ivanti-code-execution-dos-flaws.html
-
Ivanti CEO Promises Stronger Security After a Year of Flaws
Ivanti CEO Jeff Abbott, in an open letter and a video, outlined the steps the embattled company is taking to improve its security. The post EO Jeff Ab… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/04/ivanti-ceo-promises-stronger-security-after-a-year-of-flaws/
-
Multiple Ivanti Connect Secure Flaw Let Attackers Execute Remote Code
Four new vulnerabilities have been discovered in the Ivanti Connect Secure and Policy Secure Gateways. These vulnerabilities were associated with Heap… First seen on gbhackers.com Jump to article: gbhackers.com/ivanti-connect-secure-remote-code-execution-flaws/
-
Atlassian Flaws Fixes: Critical Bamboo Patch Mitigates Risk
Atlassian, a leading provider of collaboration and productivity software, has recently rolled out a series of patches aimed at fortifying the security… First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/04/atlassian-flaws-fixes-critical-bamboo-patch-mitigates-risk/
-
XSS flaw in WordPress WP-Members Plugin can lead to script injection
A cross-site scripting vulnerability (XXS) in the WordPress WP-Members Membership plugin can lead to malicious script injection. Researchers from Defi… First seen on securityaffairs.com Jump to article: securityaffairs.com/161407/hacking/wordpress-wp-members-plugin-xss.html
-
Arbitrary script injections possible with WP-Members plugin flaw
First seen on scmagazine.com Jump to article: www.scmagazine.com/brief/arbitrary-script-injections-possible-with-wp-members-plugin-flaw
-
Microsoft’s Exchange Server Hack: Key Rotation Flaw Triggers Breach
Storm-0558, a cyberespionage group affiliated with the People’s Republic of China, has reportedly compromised Microsoft Exchange mailboxes of 22 organ… First seen on gbhackers.com Jump to article: gbhackers.com/microsofts-exchange-server-hack/
-
Critical flaw in LayerSlider WordPress plugin impacts 1 million sites
A premium WordPress plugin named LayerSlider, used in over one million sites, is vulnerable to unauthenticated SQL injection, requiring admins to prio… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-flaw-in-layerslider-wordpress-plugin-impacts-1-million-sites/
-
LockBit, Alphv/BlackCat highlight February ransomware activity
With events surrounding the LockBit and Alphv/BlackCat gangs and the ConnectWise ScreenConnect flaws, ransomware activity continues this year after a … First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366572254/LockBit-Alphv-BlackCat-highlight-February-ransomware-activity
-
Google fixes two Pixel zero-day flaws exploited by forensics firms
Google has fixed two Google Pixel zero-days exploited by forensic firms to unlock phones without a PIN and gain access to the data stored within them…. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-fixes-two-pixel-zero-day-flaws-exploited-by-forensics-firms/
-
Google Patches Chrome Flaw That Earned Hackers $42,500 at Pwn2Own
Google pushes a new Chrome update to patch another zero-day vulnerability demonstrated at a hacking contest. The post ushes a new Chrome update to pat… First seen on securityweek.com Jump to article: www.securityweek.com/google-patches-chrome-flaw-that-earned-hackers-42500-at-pwn2own/
-
Google Patches Exploited Pixel Vulnerabilities
Google patches 28 vulnerabilities in Android and 25 bugs in Pixel devices, including two flaws exploited in the wild. The post atches 28 vulnerabiliti… First seen on securityweek.com Jump to article: www.securityweek.com/google-patches-exploited-pixel-vulnerabilities/
-
Ivanti Rushes Patches for 4 New Flaw in Connect Secure and Policy Secure
Ivanti has released security updates to address four security flaws impacting Connect Secure and Policy Secure Gateways that could result in code exec… First seen on thehackernews.com Jump to article: thehackernews.com/2024/04/ivanti-rushes-patches-for-4-new-flaw-in.html
-
Patchless Apple M-Chip Vulnerability Allows Cryptography Bypass
The available options for addressing the flaw are limited, leaving many Macs vulnerable to a GoFetch attack that steals keys ” even quantum-resistant … First seen on darkreading.com Jump to article: www.darkreading.com/application-security/patchless-apple-m-chip-vulnerability-cryptography-bypass
-
China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws
A China-linked threat cluster leveraged security flaws in Connectwise ScreenConnect and F5 BIG-IP software to deliver custom malware capable of delive… First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/china-linked-group-breaches-networks.html
-
Security Flaw in WP-Members Plugin Leads to Script Injection
A cross-site scripting vulnerability in the WP-Members Membership plugin could allow attackers to inject scripts into user profile pages. The post sit… First seen on securityweek.com Jump to article: www.securityweek.com/security-flaw-in-wp-members-plugin-leads-to-script-injection/
-
WordPress Admins Urged to Remove miniOrange Plugins Due to Critical Flaw
WordPress users of miniOrange’s Malware Scanner and Web Application Firewall plugins are being urged to delete them from their websites following the … First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/wordpress-admins-urged-to-remove.html
-
CISA and FBI Urge Renewed Effort to Eliminate SQL Injection Flaws
First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-fbi-renewed-effort-eliminate/
-
Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool
Fortra has released details of a now-patched critical security flaw impacting its;FileCatalyst;file transfer solution that could allow unauthenticated… First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/fortra-patches-critical-rce.html
-
TeamCity Flaw Leads to Surge in Ransomware, Cryptomining, and RAT Attacks
Multiple threat actors are exploiting the recently disclosed security flaws in JetBrains TeamCity software to deploy ransomware, cryptocurrency miners… First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/teamcity-flaw-leads-to-surge-in.html
-
GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws
GitHub on Wednesday announced that it’s making available a feature called code scanning autofix in public beta for all;Advanced Security customers;to … First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html
-
Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability
Ivanti has disclosed details of a critical remote code execution flaw impacting Standalone Sentry, urging customers to apply the fixes immediately to … First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/ivanti-releases-urgent-fix-for-critical.html
-
Atlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo Bug
Atlassian has released patches for;more than two dozen security flaws, including a critical bug impacting Bamboo Data Center and Server that could be … First seen on thehackernews.com Jump to article: thehackernews.com/2024/03/atlassian-releases-fixes-for-over-2.html
-
Fortra Releases Update on Critical Severity RCE Flaw
First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/fortra-releases-update-on-critical-severity-rce-flaw