Tag: flaw
-
pac4j Java Framework Vulnerable to RCE Attacks
A critical security vulnerability has been discovered in the popular Java framework pac4j. The vulnerability specifically affects versions before 4.0 of the pac4j-core module. This vulnerability, identified as CVE-2023-25581, exposes systems to potential remote code execution (RCE) attacks due to a flaw in the deserialization process. Vulnerability Details CVE-2023-25581 The issue stems from a […]…
-
Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware
Tags: attack, backup, credentials, cve, exploit, flaw, ransomware, sophos, threat, veeam, vpn, vulnerabilityThreat actors are actively attempting to exploit a now-patched security flaw in Veeam Backup & Replication to deploy Akira and Fog ransomware.Cybersecurity vendor Sophos said it has been tracking a series of attacks in the past month leveraging compromised VPN credentials and CVE-2024-40711 to create a local account and deploy the ransomware.CVE-2024-40711, rated 9.8 out…
-
Zendesk Email Spoofing Flaw Let Attackers Access Support Tickets
A security vulnerability in Zendesk, a widely used customer service tool, has been uncovered. This flaw allowed attackers to access support tickets from any company using Zendesk, posing significant risks to sensitive information. Zendesk initially dismissed the vulnerability, which involved email spoofing, but later forced the company to implement critical security fixes. Here’s a detailed…
-
Iranian hackers now exploit Windows flaw to elevate privileges
The Iranian state-sponsored hacking group APT34, aka OilRig, has recently escalated its activities with new campaigns targeting government and critical infrastructure entities in the United Arab Emirates and the Gulf region. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/oilrig-hackers-now-exploit-windows-flaw-to-elevate-privileges/
-
Security Affairs newsletter Round 493 by Pierluigi Paganini INTERNATIONAL EDITION
Tags: attack, backup, cyber, email, exploit, flaw, government, international, iran, ransomware, veeam, WeeklyReviewA new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. A cyber attack hit Iranian government sites and nuclear facilities Ransomware operators exploited Veeam Backup & Replication flaw…
-
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf
The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region.”The group utilizes sophisticated tactics that include deploying a backdoor that leverages Microsoft Exchange servers for credentials theft, and exploiting vulnerabilities…
-
Ransomware operators exploited Veeam Backup Replication flaw CVE-2024-40711 in recent attacks
Sophos reports ransomware operators are exploiting a critical code execution flaw in Veeam Backup & Replication. Sophos researchers warn that ransomware operators are exploiting the critical vulnerability CVE-2024-40711 in Veeam Backup & Replication to create rogue accounts and deploy malware. In early September 2024, Veeam released security updates to address multiple vulnerabilities impacting its products,…
-
Firefox Update Patches Exploited Vulnerability
Investigation of the use-after-free flaw is ongoing, but organizations and individual users can update Firefox now for a fix. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/firefox-security-update-patches-vulnerability/
-
Fog, Akira ransomware groups exploit critical Veeam backup flaw
First seen on scworld.com Jump to article: www.scworld.com/news/fog-akira-ransomware-groups-exploit-critical-veeam-backup-flaw
-
Critical Nortek Linear eMerge E3 system flaw remains unaddressed
Tags: flawFirst seen on scworld.com Jump to article: www.scworld.com/brief/critical-nortek-linear-emerge-e3-system-flaw-remains-unaddressed
-
Critical Nortek Linear eMerge Flaw Still Unaddressed
Tags: flawFirst seen on scworld.com Jump to article: www.scworld.com/brief/critical-nortek-linear-emerge-flaw-still-unaddressed
-
New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution
GitLab has released security updates for Community Edition (CE) and Enterprise Edition (EE) to address eight security flaws, including a critical bug that could allow running Continuous Integration and Continuous Delivery (CI/CD) pipelines on arbitrary branches.Tracked as CVE-2024-9164, the vulnerability carries a CVSS score of 9.6 out of 10.”An issue was discovered in GitLab EE…
-
Akira and Fog ransomware now exploit critical Veeam RCE flaw
Ransomware gangs now exploit a critical security vulnerability that lets attackers gain remote code execution (RCE) on vulnerable Veeam Backup & Replication (VBR) servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/akira-and-fog-ransomware-now-exploiting-critical-veeam-rce-flaw/
-
Palo Alto Fixes Five Expedition Migration Tool Flaws
First seen on scworld.com Jump to article: www.scworld.com/brief/palo-alto-fixes-five-expedition-migration-tool-flaws
-
Critical Flaw Exposes Legacy Siemens Device to Brute-Force Attacks
First seen on scworld.com Jump to article: www.scworld.com/brief/critical-flaw-exposes-legacy-siemens-device-to-brute-force-attacks
-
Three critical flaws highlight Patch Tuesday in October
First seen on scworld.com Jump to article: www.scworld.com/news/three-critical-flaws-highlight-patch-tuesday-in-october
-
GitLab warns of critical arbitrary branch pipeline execution flaw
GitLab has released security updates to address multiple flaws in Community Edition (CE) and Enterprise Edition (EE), including a critical arbitrary branch pipeline execution flaw. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-arbitrary-branch-pipeline-execution-flaw/
-
Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks
A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being actively exploited in cyberattacks. With a CVSS base score of 9.8, the flaw is identified as Use-after-free in the Animation timeline component tracked as CVE-2024-9680 reported by Damien Schaeffer from ESET.” An attacker was able to achieve code execution in the…
-
U.S. CISA adds Ivanti CSA and Fortinet bugs to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti CSA and Fortinet bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: This week, Fortinet addressed a critical flaw in FortiOS, tracked as CVE-2024-23113 (CVSS score 9.8). The issue if…
-
Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems
Cybersecurity security researchers are warning about an unpatched vulnerability in Nice Linear eMerge E3 access controller systems that could allow for the execution of arbitrary operating system (OS) commands.The flaw, assigned the CVE identifier CVE-2024-9441, carries a CVSS score of 9.8 out of a maximum of 10.0, according to VulnCheck.”A vulnerability in the Nortek Linear…
-
Mozilla patches critical Firefox vuln that attackers are already exploiting
Firefixed: It’s maintenance time for low-complexity, high-impact security flaw First seen on theregister.com Jump to article: www.theregister.com/2024/10/10/firefixed_mozilla_patches_critical_firefox/
-
Mozilla issued an urgent Firefox update to fix an actively exploited flaw
Mozilla released an urgent Firefox update to fix a critical use-after-free vulnerability actively exploited in ongoing attacks. Mozilla released an emergency security update for its Firefox browser to address a critical use-after-free vulnerability, tracked as CVE-2024-9680, that is actively exploited in attacks. The vulnerability CVE-2024-9680 resides in Animation timelines. Firefox Animation Timelines is a feature…
-
Palo Alto fixed critical flaws in PAN-OS firewalls that allow for full compromise of the devices
Palo Alto fixed critical flaws in PAN-OS firewalls, warning that attackers could chain these vulnerabilities to hijack the devices. Palo Alto Networks addressed multiple vulnerabilities that an attacker can chain to hijack PAN-OS firewalls. The vulnerabilities reside in the Palo Alto Networks’ Expedition solution, which is a migration tool designed to help organizations move configurations…
-
CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches
Tags: cisa, cisco, cve, cybersecurity, exploit, flaw, fortinet, infrastructure, kev, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Fortinet products to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2024-23113 (CVSS score: 9.8), relates to cases of remote code execution that affects FortiOS, FortiPAM, FortiProxy, and FortiWeb.”A First seen on thehackernews.com…
-
Ivanti zero-day vulnerabilities exploited in chained attack
The new exploit chains targeting Ivanti Cloud Service Application customers are connected to a previously disclosed critical path traversal flaw, CVE-2024-8963. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366613041/Ivanti-zero-day-vulnerabilities-exploited-in-chained-attack
-
CISA says critical Fortinet RCE flaw now exploited in attacks
Today, CISA revealed that attackers actively exploit a critical FortiOS remote code execution (RCE) vulnerability in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-says-critical-fortinet-rce-flaw-now-exploited-in-attacks/
-
Firefox Zero-Day Under Attack: Update Your Browser Immediately
Mozilla has revealed that a critical security flaw impacting Firefox and Firefox Extended Support Release (ESR) has come under active exploitation in the wild.The vulnerability, tracked as CVE-2024-9680, has been described as a use-after-free bug in the Animation timeline component.”An attacker was able to achieve code execution in the content process by exploiting a use-after-free…
-
Ivanti CSA Customers Targeted in New Zero Day Attacks
Attackers Chain Three Security Flaws with Patched Admin Bypass Vulnerability. Internet appliance maker Ivanti warned customers Tuesday that attackers are actively exploiting new vulnerabilities in Cloud Services Appliance instances by chaining three security flaws with a zero-day patched in September. The company advised customers to update to version 5.0. First seen on govinfosecurity.com Jump to…
-
Apple’s iPhone Mirroring Flaw Exposes Employee Privacy Risks
The privacy flaw in Apple’s iPhone mirroring feature enables personal apps on an iPhone to be listed in a company’s software inventory when the feature is used on work computers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/apples-iphone-mirroring-flaw/