Tag: update
-
Researchers Reveal macOS Vulnerability Exposing System Passwords
A recent article by Noah Gregory has highlighted a significant vulnerability in macOS, identified as CVE-2024-54471, which was patched in the latest security updates for macOS Sequoia 15.1, macOS Sonoma 14.7.1, and macOS Ventura 13.7.1. This vulnerability could potentially expose system passwords, emphasizing the importance of updating macOS devices to the latest versions. Background and…
-
Oops, they did it again: Microsoft breaks Outlook with another dubious update
Testing? We’ve heard of it First seen on theregister.com Jump to article: www.theregister.com/2025/03/20/outlook_outage_again/
-
ISMG Editors: Impact of Google’s $32B Buy on Cloud Security
Also: Trump’s Cybersecurity Shake-Up, IBM’s X-Force Event Highlights. In this week’s update, ISMG editors explore Google’s record-breaking $32B Wiz acquisition and its impact on cloud security, the shake-up in Trump’s cybersecurity leadership team amid budget cuts, and key takeaways from the IBM X-Force Cyber Range cyber response event. First seen on govinfosecurity.com Jump to article:…
-
Fortinet-Targeting Ransomware Attacks Leave Devices Patched
‘Wave of Ransomware Attacks’ Hitting FortiOS and FortiProxy Devices, Warn Experts. Cyber defenders said they’re seeing a wave of ransomware attacks unleashed by attackers who gain initial access by targeting two known vulnerabilities in Fortinet FortiOS and FortiProxy devices. Hackers sometimes patch the devices to hide their persistent remote access. First seen on govinfosecurity.com Jump…
-
HP Inc settles printer toner lockout lawsuit with a promise to make firmware updates optional
Dynamic Security update blocks 3rd-party cartridges, but keeps printing money First seen on theregister.com Jump to article: www.theregister.com/2025/03/19/hp_printer_lawsuit_settled/
-
CISA marks NAKIVO’s critical backup vulnerability as actively exploited
Tags: access, advisory, backup, cisa, ciso, cloud, cybersecurity, exploit, kev, mitigation, network, service, update, vulnerabilityCISOs advised to push for immediate patching: CISA has advised immediate federal and civilian patching of the flaw. For the Federal Civilian Executive Branch (FCEB) agencies, the US cybersecurity watchdog has stipulated a patching deadline of April 19, 2025, in accordance with the BOD 22-01 directive.”Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance…
-
Hackers Actively Exploit Apache Tomcat Servers via CVE-2025-24813 Patch Now
A concerning development has emerged with the active exploitation of Apache Tomcat servers through the recently disclosed vulnerability, CVE-2025-24813. This vulnerability allows attackers to potentially execute remote code (RCE) if successfully exploited. The cybersecurity firm GreyNoise has identified multiple IPs involved in these attacks across several regions, highlighting the urgency for organizations to update their…
-
KB5053606: Auch das März-Update für Windows 10 verärgert Nutzer
Nicht nur bei Windows 11 macht das März-Update Probleme. Windows-10-Nutzer beklagen Installationsfehler, Bluescreens und Ärger mit dem Drucker. First seen on golem.de Jump to article: www.golem.de/news/kb5053606-auch-das-maerz-update-fuer-windows-10-veraergert-nutzer-2503-194533.html
-
Caido v0.47.0 Released A Web Pentesting Tool Alternative to Burp Suite
Caido has unveiled version 0.47.0 of its web pentesting tool, cementing its position as a robust alternative to Burp Suite. This release is marked by several key enhancements that improve user experience and expand the tool’s capabilities in web application testing. The updates include a complete overhaul of the Match & Replace feature, the introduction…
-
Tomcat RCE Vulnerability Exploited in the Wild Mitigation Steps Outlined
Tags: apache, cve, cyber, cybersecurity, exploit, malicious, mitigation, rce, remote-code-execution, update, vulnerabilityA recent vulnerability in Apache Tomcat, identified as CVE-2025-24813, has sparked concerns among cybersecurity professionals due to its potential for exploitation in unauthenticated remote code execution (RCE), severe information leakage, and malicious content injection. This vulnerability was publicly disclosed on March 10, 2025, along with a patch, and has already seen initial exploit attempts by…
-
Critical remote code execution flaw patched in Veeam backup servers
Tags: backup, cve, exploit, flaw, framework, programming, rce, remote-code-execution, risk, update, veeam, vulnerabilityWhy black lists are bad: Application developers have gotten in the habit of mitigating deserialization risks by creating blacklists of classes that could be dangerous when deserialized, and as watchTowr explains, this was also Veeam’s approach when addressing CVE-2024-40711. However, history has shown that blacklists are rarely complete.”Blacklists (also known as block-lists or deny-lists) are…
-
Veeam RCE bug lets domain users hack backup servers, patch now
Veeam has patched a critical remote code execution vulnerability tracked as CVE-2025-23120 in its Backup & Replication software that impacts domain-joined installations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/veeam-rce-bug-lets-domain-users-hack-backup-servers-patch-now/
-
MSSP Market Update: TrustedSec Acquires Trimarc
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-trustedsec-acquires-trimarc
-
Veeam Update Patches Critical Backup Software Vulnerability
‘Real Danger’ Alert for Unpatched Veeam Servers Attached to a Production Domain. Widely used Veeam Backup & Replication software has been patched to fix a critical vulnerability that could be abused to remotely exploit malicious code. Security experts recommend rapid patching, given ransomware and other groups’ repeated targeting of the software. First seen on govinfosecurity.com…
-
Nation-state groups hit hundreds of organizations with Microsoft Windows zero-day
Trend Micro researchers discovered and reported the eight-year-old defect to Microsoft six months ago. The company hasn’t made any commitments to patch or remediate the issue. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-windows-zero-day-exploits-nation-states/
-
Kein Sicherheitsrisiko – Versteckte Kommandos in Bluetooth-Chip sorgen für Aufregung
Tags: updateFirst seen on security-insider.de Jump to article: www.security-insider.de/sicherheitsluecke-esp32-chip-iot-geraete-a-67b4d0ab0bf289e4a247775d313dc7ef/
-
Veeam and IBM Release Patches for High-Risk Flaws in Backup and AIX Systems
Veeam has released security updates to address a critical security flaw impacting its Backup & Replication software that could lead to remote code execution.The vulnerability, tracked as CVE-2025-23120, carries a CVSS score of 9.9 out of 10.0. It affects 12.3.0.310 and all earlier version 12 builds.”A vulnerability allowing remote code execution (RCE) by authenticated domain…
-
Critical Veeam Backup Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120)
Veeam has released fixes for a critical remote code execution vulnerability (CVE-2025-23120) affecting its enterprise Veeam Backup Replication solution, and is urging … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/20/critical-veeam-backup-replication-rce-vulnerability-cve-2025-23120/
-
China, Russia, North Korea Hackers Exploit Windows Security Flaw
Tags: attack, china, exploit, flaw, government, group, hacker, infrastructure, korea, microsoft, north-korea, russia, threat, update, windowsAmost a dozen state-sponsored threat groups from Russia, China, and North Korea have been exploiting a security flaw in WIndows in attacks on governments and critical infrastructure that date back to 2017. According to Trend Micro’s VDI unit, Microsoft has no plans to patch the vulnerability. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/china-russia-north-korea-hackers-exploit-windows-security-flaw/
-
WSUS ist abgekündigt: Das sind die Nachfolger zur Update-Steuerung – Azure Update Manager und Intune ersetzen WSUS
Tags: updateFirst seen on security-insider.de Jump to article: www.security-insider.de/azure-update-manager-und-intune-ersetzen-wsus-a-a58e6cef4b5334c9c439d795be0f3d1d/
-
Hacker nutzen alte Windows-Sicherheitslücke aus Microsoft tut nichts
Tags: bug, bug-bounty, china, cyberattack, exploit, germany, hacker, iran, microsoft, military, north-korea, update, vulnerability, windowsExperten des Sicherheits-Unternehmens Trend Micro haben eine als ZDI-CAN-25373 bezeichnete Sicherheitslücke in Windows entdeckt, die Angreifer seit mindestens 2017 ausnutzen. Über die Lücke können die Angreifer Schadcode auf den betroffenen Windows-Rechnern ausführen, sofern der Benutzer eine verseuchte Webseite besucht oder eine infizierte Datei öffnet.Die Lücke steckt in der Vorgehensweise, wie Windows .lnk-Dateien (Verknüpfungsdateien) verarbeitet. Angreifer können Kommandozeilen-Befehle, die…
-
Kali Linux 2025.1a drops with theme refresh, Kali NetHunter updates
Kali Linux 2025.1a is now available. This release enhances existing features with improvements designed to streamline your experience. 2025 theme refresh Kali Linux 2025.1a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/20/kali-linux-2025-1a-released/
-
Kali Linux 2025.1a Released: New Tools and Desktop Environment Upgrades
Kali Linux, the renowned cybersecurity-focused Linux distribution, has just ushered in the new year with the release of Kali Linux 2025.1a. This update builds upon the existing features, offering myriad enhancements and improvements designed to give users a streamlined experience. Whether you’re already a seasoned Kali user or about to dive into the world of…
-
11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017
Microsoft refuses to patch serious Windows shortcut vulnerability abused in global espionage campaigns! First seen on hackread.com Jump to article: hackread.com/nation-state-hackers-exploit-windows-unpatched-flaw-2017/
-
Critical vulnerability in AMI MegaRAC BMC allows server’ takeover
Tags: access, advisory, api, apt, attack, authentication, control, credentials, cve, cyberespionage, cybersecurity, data, data-breach, endpoint, exploit, firewall, firmware, flaw, group, infrastructure, Internet, linux, malicious, malware, network, ransomware, supply-chain, technology, training, update, vulnerabilityth vulnerability that Eclypsium researchers found in MegaRAC, the BMC firmware implementation from UEFI/BIOS vendor American Megatrends (AMI). BMCs are microcontrollers present on server motherboards that have their own firmware, dedicated memory, power, and network ports and are used for out-of-band management of servers when their main operating systems are shut down.Administrators can access BMCs…
-
MSSP Market Update: VulnCheck Lands $12M Series A
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-vulncheck-lands-12m-series-a
-
Google Releases Major Update for Open Source Vulnerability Scanner
Google has integrated OSV-SCALIBR features into OSV-Scanner, its free vulnerability scanner for open source developers. The post Google Releases Major Update for Open Source Vulnerability Scanner appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/google-releases-major-update-for-open-source-vulnerability-scanner/
-
GitHub wird immer mehr zu einem digitalen Minenfeld
Tags: access, authentication, cloud, computer, cyberattack, cyberespionage, cybersecurity, github, malware, mfa, north-korea, password, updateZuerst waren nur einzelne GitHub-Repositories mit Malware infiziert. Mittlerweile geraten auch Entwickler und deren Konten direkt in das Visier von Cyberkriminellen.Die Plattform GitHub sorgt seit geraumer Zeit für negative Schlagzeilen, da ihre Repositories vermehrt mit Malware infiziert sind. Hierdurch versuchen Cyberkriminelle auf Geräte und Daten zuzugreifen.Jetzt wurden diese Aktivitäten auf Entwickler direkt ausgeweitet. Ziel dieser…