Tag: authentication

CrushFTP Vulnerability Exploited Following Disclosure Issues

Apr 3, 2025 5:42 PM

by

Andy Stern

in SecurityNews

Tags: authentication, exploit, flaw, vulnerability

A critical authentication bypass flaw in CrushFTP is under active exploitation following a mishandled disclosure process First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/
Evilginx stiehlt Zugangsdaten und trickst die Multi-Faktor-Authentifizierung aus

Apr 3, 2025 3:42 PM

by

Andy Stern

in SecurityNews

Tags: authentication, malware, mfa, open-source, password, sophos

Eine böswillige Mutation des weit verbreiteten Nginx-Webservers erleichtert bösartige Adversary-in-the-Middle-Attacken. Sophos-X-Ops haben in einem Versuchsaufbau das kriminelle Potential von Evilginx analysiert und geben Tipps für den Schutz. Evilginx ist eine Malware, die auf dem legitimen und weit verbreiteten Open-Source-Webserver Nginx basiert. Sie kann dazu verwendet werden, Benutzernamen, Passwörter und Sitzungs-Token zu stehlen und sie bietet…
SonicWall Firewall Vulnerability Enables Unauthorized Access

Apr 3, 2025 3:42 PM

by

Andy Stern

in SecurityNews

Tags: access, authentication, cve, cyber, firewall, flaw, network, risk, unauthorized, vpn, vulnerability

Researchers from Bishop Fox have successfully exploited CVE-2024-53704, an authentication bypass vulnerability that affects SonicWall firewalls. This critical flaw allows remote attackers to hijack active SSL VPN sessions, enabling unauthorized network access without requiring user credentials. If left unpatched, the vulnerability poses significant risks to organizations relying on SonicWall devices for their network security. CVE-2024-53704: The…
Evilginx: Die nginx-Mutation, die MFA-Schutz aushebelt

Apr 3, 2025 12:42 PM

by

Andy Stern

in SecurityNews

Tags: authentication, cyberattack, malware, mfa, open-source, sophos

Sicherheitsforscher von Sophos X-Ops haben die Funktionsweise und das Gefährdungspotenzial von Evilginx untersucht. Die auf dem weit verbreiteten Open-Source-Webserver nginx basierende Malware stellt eine erhebliche Bedrohung für die IT-Sicherheit dar, indem sie gezielte Adversary-in-the-Middle (AitM)-Angriffe ermöglicht und dabei sogar Multi-Faktor-Authentifizierung (MFA) aushebeln kann. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/evilginx-nginx-mutation-mfa-schutz
AI disinformation didn’t upend 2024 elections, but the threat is very real

Apr 3, 2025 12:42 PM

by

Andy Stern

in SecurityNews

Tags: ai, attack, authentication, business, ceo, ciso, control, corporate, credentials, cyber, cyberattack, cybercrime, cybersecurity, data, deep-fake, detection, disinformation, election, email, endpoint, finance, fraud, group, hacking, identity, incident, incident response, intelligence, international, jobs, login, malware, network, phishing, ransomware, RedTeam, risk, scam, soc, social-engineering, tactics, threat, tool, training

Attackers are using AI to distort and undermine threat intelligence: AI-powered disinformation has moved beyond external influence, it is now reshaping adversary tactics inside compromised networks. Attackers can generate false system logs, fabricate network traffic, and manipulate forensic evidence, forcing incident response teams to chase misleading anomalies while real intrusions progress undetected. AI-assisted malware is also…
Exploited: Critical Unauthenticated Access Vulnerability in CrushFTP (CVE-2025-2825)

Apr 2, 2025 2:55 PM

by

Andy Stern

in SecurityNews

Tags: access, authentication, corporate, cve, data, exploit, flaw, vulnerability

In the ever-evolving landscape of web application vulnerabilities, a new critical flaw has emerged. CVE-2025-2825 is a high-severity vulnerability that allows attackers to bypass authentication on CrushFTP servers. This popular enterprise file transfer solution is often used in corporate environments to manage sensitive data, making this vulnerability particularly concerning. Attackers are actively exploiting this flaw……
Malicious actors increasingly put privileged identity access to work across attack chains

Apr 2, 2025 12:55 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, api, apt, attack, authentication, best-practice, breach, cisa, cisco, cloud, corporate, credentials, cybercrime, cyberespionage, data, detection, email, endpoint, exploit, framework, group, healthcare, identity, infrastructure, login, malicious, malware, mfa, microsoft, network, open-source, password, phishing, phone, ransomware, service, social-engineering, strategy, threat, tool, vpn, windows

Lateral movement: Leveraging privileged access to act in plain sight: Once situated on the corporate network, compromised credentials also allow attackers to expand access to other internal systems with a reduced likelihood of being discovered or triggering malware detection.According to Talos, nearly half of investigated identity attacks targeted Active Directory, with another 20% targeting cloud…
Das gehört in Ihr Security-Toolset

Apr 2, 2025 6:55 AM

by

Andy Stern

in SecurityNews

Tags: access, ai, antivirus, authentication, backup, breach, business, cloud, compliance, control, cyberattack, cybersecurity, data, data-breach, defense, detection, edr, firewall, gartner, governance, iam, identity, incident response, intelligence, iot, malware, mfa, ml, mobile, network, password, ransomware, risk, saas, service, software, spyware, threat, tool, update, vulnerability, vulnerability-management

Lesen Sie, welche Werkzeuge essenziell sind, um Unternehmen gegen Cybergefahren abzusichern.Sicherheitsentscheider sind mit einer sich kontinuierlich verändernden Bedrohungslandschaft, einem zunehmend strengeren, regulatorischen Umfeld und immer komplexeren IT-Infrastrukturen konfrontiert. Auch deshalb wird die Qualität ihrer Sicherheits-Toolsets immer wichtiger.Das Problem ist nur, dass die Bandbreite der heute verfügbaren Cybersecurity-Lösungen überwältigend ist. Für zusätzliche Verwirrung sorgen dabei nicht…
Google adds endend email encryption to Gmail

Apr 2, 2025 5:55 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, communications, control, email, encryption, google, identity, service

Google creates new email encryption model: Google took a different approach and created a new model that no longer requires complex user certificate management or exchanging keys with external organizations to decrypt messages.Google’s new E2EE Gmail implementation relies on the existing client-side encryption (CSE) feature in Google Workspace, which allows customers to use their own…
How CISOs can use identity to advance zero trust

Apr 1, 2025 9:55 PM

by

Andy Stern

in SecurityNews

Tags: access, api, attack, authentication, automation, business, ciso, compliance, control, credentials, cyberattack, cybersecurity, data, governance, iam, identity, malware, organized, resilience, risk, risk-assessment, strategy, tactics, threat, unauthorized, vulnerability, zero-trust

Identity: The decision point Perimeter-based security models built to keep attackers out won’t work when 60% of breaches now involve valid credentials. As my colleague Andy Thompson says, “It’s much easier to log in than hack in.”Every entity (human or non-human) accessing a resource (applications, data or other entities) requires an identity. That’s why identities are so…
Critical vulnerability in CrushFTP file transfer software under attack

Apr 1, 2025 6:55 PM

by

Andy Stern

in SecurityNews

Tags: attack, authentication, software, vulnerability

Questions and confusion surround the authentication bypass vulnerability, which was privately disclosed to customers on March 21. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-vulnerability-crushftp-under-attack/744078/
Altgeräte bedrohen Sicherheit in Unternehmen

Apr 1, 2025 4:55 PM

by

Andy Stern

in SecurityNews

Tags: access, apache, authentication, botnet, bug, cisco, cloud, cve, cyberattack, dns, endpoint, firewall, Hardware, intelligence, Internet, ivanti, lazarus, linux, macOS, network, open-source, password, radius, ransomware, risk, router, sans, service, software, supply-chain, threat, update, vulnerability

Schwachstellen in alten Netzwerkgeräten stellen ein erhebliches Sicherheitsrisiko für Unternehmen dar.Eine Analyse von Ciscos Threat-Intelligence-Team Talos zeigt, zwei der drei häufigsten Schwachstellen, auf die es Angreifer im Jahr 2024 abgesehen hatten, waren in alten Netzwerkgeräten zu finden. Das Problem ist, dass Hersteller dazu keine Patches mehr herausgeben.’Dies unterstreicht, wie wichtig es ist, veraltete Komponenten des…
CrushFTP CVE-2025-2825 flaw actively exploited in the wild

Apr 1, 2025 4:55 PM

by

Andy Stern

in SecurityNews

Tags: access, authentication, cve, exploit, flaw, threat, vulnerability

Attackers exploit CrushFTP CVE-2025-2825 flaw, enabling unauthenticated access to unpatched devices using public proof-of-concept code. Threat actors are exploiting a critical authentication bypass vulnerability, tracked as CVE-2025-2825, in the CrushFTP file transfer software. Attackers are using exploits based on publicly available proof-of-concept exploit code. The vulnerability impacts CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0, it…
Critical auth bypass bug in CrushFTP now exploited in attacks

Apr 1, 2025 3:55 PM

by

Andy Stern

in SecurityNews

Tags: attack, authentication, exploit, software, vulnerability

Attackers are now targeting a critical authentication bypass vulnerability in the CrushFTP file transfer software using exploits based on publicly available proof-of-concept code. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-auth-bypass-bug-in-crushftp-now-exploited-in-attacks/
Next.js Vulnerability Exposes Middleware Security Gaps

Apr 1, 2025 11:58 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, cve, cvss, exploit, flaw, framework, unauthorized, vulnerability

On March 21, 2025, a critical authorization bypass vulnerability in Next.js, identified as CVE-2025-29927, was disclosed with a CVSS score of 9.1. This framework’s middleware handling flaw enables attackers to bypass authentication and authorization, exposing sensitive routes to unauthorized access. Exploiting this vulnerability does not require authentication, providing attackers with direct access to protected routes….…
Infostealer malware poses potent threat despite recent takedowns

Apr 1, 2025 11:36 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, awareness, ciso, corporate, credentials, detection, endpoint, infection, least-privilege, malware, mfa, network, phishing, software, theft, threat, training, update

How CISOs can defend against infostealers: To defend against these threats, CISOs should rely on multi-factor authentication MFA and least privilege access to prevent their incursion into the corporate network, as well as endpoint detection and response (EDR) and anti-malware to detect and quarantine infostealers that manage to trick users into running the malware. Regular…
Volume of attacks on network devices shows need to replace end of life devices quickly

Apr 1, 2025 11:36 AM

by

Andy Stern

in SecurityNews

Tags: access, apache, attack, authentication, best-practice, breach, cloud, control, credentials, cve, cyber, dns, endpoint, espionage, exploit, firewall, flaw, government, group, Hardware, infrastructure, injection, Internet, ivanti, lazarus, macOS, monitoring, network, north-korea, open-source, password, risk, router, russia, sans, service, software, threat, tool, update, vulnerability

CVE-2023-1389, a vulnerability in TP-Link Archer AX21 router;CVE-2024-3400, a hole in Palo Alto Networks PAN-OS firewall operating system;CVE-2023-36845, a vulnerability in Juniper Networks Junos OS operating system;CVE-2021-44529, a vulnerability in Ivanti Endpoint Manager Cloud Service Appliance;CVE-2023-38035, a hole in Ivanti Sentry security gateway;CVE-2024-36401, a vulnerability in OSGeo GeoServer;CVE-2024-0012, a vulnerability in Palo Alto Neworks PAN-OS…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Apr 1, 2025 1:19 AM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Apr 1, 2025 12:19 AM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 11:19 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 10:19 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 9:19 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 8:19 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 7:19 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 6:20 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Hewlett Packard RCE Vulnerability Allows Attackers to Bypass Authentication and Execute Remote Commands

Mar 31, 2025 6:20 PM

by

Andy Stern

in SecurityNews

Tags: authentication, computing, cve, cyber, flaw, rce, remote-code-execution, vulnerability

A critical unauthenticated remote code execution (RCE) vulnerability in HPE Insight Cluster Management Utility (CMU) v8.2 allows attackers to bypass authentication and execute commands as root on high-performance computing (HPC) clusters, researchers revealed today. Tracked as CVE-2024-13804, the flaw exposes HPC environments to full cluster compromise through weaponized Java client applications. Technical Breakdown The vulnerability stems from…
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 4:21 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
Available now: 2024 Year in Review

Mar 31, 2025 4:13 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, attack, authentication, email, identity, mfa, network, ransomware, threat, vulnerability

Download Talos’ 2024 Year in Review now, and access key insights on the top targeted vulnerabilities of the year, network-based attacks, email threats, adversary toolsets, identity attacks, multi-factor authentication (MFA) abuse, ransomware and AI-based attacks. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/available-now-2024-year-in-review/
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 4:13 PM

by

Andy Stern

in SecurityNews

Tags: access, api, authentication, control, risk, tool, vulnerability

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss…
CrushFTP Vulnerability Lets Hackers Bypass Security and Seize Server Control

Mar 31, 2025 4:13 PM

by

Andy Stern

in SecurityNews

Tags: authentication, control, cyber, data, exploit, hacker, software, theft, vulnerability

A newly disclosed authentication bypass vulnerability (CVE-2025-2825) in CrushFTP file transfer software enables attackers to gain complete control of servers without valid credentials. The vulnerability affects versions 10.0.0 through 11.3.0 of the popular enterprise file transfer solution, exposing organizations to data theft and system compromise. The Exploit: Bypassing Security in 3 Steps Security researchers have…