Tag: kev

768 CVEs Exploited in 2024, Reflecting a 20% Increase from 639 in 2023

Feb 3, 2025 4:12 PM

by

Andy Stern

in SecurityNews

Tags: cve, exploit, kev, threat, vulnerability

As many as 768 vulnerabilities with designated CVE identifiers were reported as exploited in the wild in 2024, up from 639 CVEs in 2023, registering a 20% increase year-over-year.Describing 2024 as “another banner year for threat actors targeting the exploitation of vulnerabilities,” VulnCheck said 23.6% of known exploited vulnerabilities (KEV) were known to be weaponized…
U.S. CISA adds Apple products’ flaw to its Known Exploited Vulnerabilities catalog

Jan 29, 2025 10:39 PM

by

Andy Stern

in SecurityNews

Tags: apple, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, update, vulnerability, zero-day

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple products’ flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple Multiple Products Use-After-Free Vulnerability, tracked as CVE-2025-24085, to its Known Exploited Vulnerabilities (KEV) catalog. This week, Apple released security updates to address 2025’s first zero-day vulnerability, tracked as CVE-2025-24085, actively exploited…
U.S. CISA adds Fortinet FortiOS to its Known Exploited Vulnerabilities catalog

Jan 15, 2025 5:02 PM

by

Andy Stern

in SecurityNews

Tags: authentication, cisa, cve, cybersecurity, exploit, fortinet, infrastructure, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiOS vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiOS authorization bypass vulnerability, tracked as CVE-2024-55591 (CVSS score: 9.6) to its Known Exploited Vulnerabilities (KEV) catalog. Remote attackers can exploit the vulnerability to bypass authentication and gain…
CISA adds second BeyondTrust CVE to known exploited vulnerabilities list

Jan 14, 2025 6:43 PM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, exploit, kev, vulnerability

Federal authorities are still working with the company to investigate a hack of Treasury Department workstations, but have not yet explained the CVEs’ specific roles in the attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-second-beyondtrust-cve-exploited/737288/
U.S. CISA adds BeyondTrust PRA and RS and Qlik Sense flaws to its Known Exploited Vulnerabilities catalog

Jan 14, 2025 8:46 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds BeyondTrust PRA and RS and Qlik Sense flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2024-12686 (CVSS score of 6.6) The flaw is an OS Command Injection Vulnerability in BeyondTrust…
CISA Adds Second BeyondTrust Flaw to KEV Catalog Amid Active Attacks

Jan 14, 2025 8:46 AM

by

Andy Stern

in SecurityNews

Tags: access, attack, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a second security flaw impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The vulnerability in question is CVE-2024-12686 (CVSS score: 6.6), a medium-severity bug that could First…
CISA Adds Mitel, Oracle, flaws to the KEV list

Jan 11, 2025 11:42 AM

by

Andy Stern

in SecurityNews

Tags: cisa, flaw, kev, oracle

First seen on scworld.com Jump to article: www.scworld.com/brief/cisa-adds-mitel-oracle-flaws-to-the-kev-list
U.S. CISA adds Ivanti Connect Secure, Policy Secure, and ZTA Gateways flaw to its Known Exploited Vulnerabilities catalog

Jan 9, 2025 2:20 PM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, ivanti, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure, Policy Secure, and ZTA Gateways flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure Vulnerability, tracked as CVE-2025-0282 (CVSS score: 9.0) to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability Ivanti impacted Ivanti Connect…
Critical Mitel, Oracle flaws find active exploitation, CISA urges patching

Jan 8, 2025 6:18 PM

by

Andy Stern

in SecurityNews

Tags: access, advisory, attack, cisa, cve, cvss, cyber, cyberattack, cybersecurity, data, exploit, flaw, infrastructure, kev, malicious, network, oracle, risk, unauthorized, update, vulnerability

Attackers are actively expoiting flaws in Mitel MiCollab flaws to gain unauthorized access to sensitive system files, the US Cybersecurity and Infrastructure Security Agency (CISA) has warned.On Tuesday the agency added two path traversal vulnerabilities in the widely used communication platform to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of exploitation.”These type of vulnerabilities…
Mitel MiCollab, Oracle WebLogic Server vulnerabilities exploited by attackers

Jan 8, 2025 2:18 PM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, exploit, kev, oracle, vulnerability

CISA has added Mitel MiCollab (CVE-2024-41713, CVE-2024-55550) and Oracle WebLogic Server (CVE-2020-2883) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/08/mitel-micollab-oracle-weblogic-server-vulnerabilities-exploited-by-attackers/
U.S. CISA adds Oracle WebLogic Server and Mitel MiCollab flaws to its Known Exploited Vulnerabilities catalog

Jan 8, 2025 9:18 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cybersecurity, exploit, flaw, infrastructure, kev, oracle, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle WebLogic Server and Mitel MiCollab flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle WebLogic Server and Mitel MiCollab vulnerabilities, to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for the vulnerabilities added to the catalog:…
CISA Flags Critical Flaws in Mitel and Oracle Systems Amid Active Exploitation

Jan 8, 2025 6:17 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, oracle, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three flaws impacting Mitel MiCollab and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The list of vulnerabilities is as follows -CVE-2024-41713 (CVSS score: 9.1) – A path traversal vulnerability in Mitel MiCollab that could allow an attacker…
CISA Adds Acclaim USAHERDS Vulnerability to KEV Catalog Amid Active Exploitation

Dec 24, 2024 12:43 PM

by

Andy Stern

in SecurityNews

Tags: cisa, credentials, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched high-severity security flaw impacting Acclaim Systems USAHERDS to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild.The vulnerability in question is CVE-2021-44207 (CVSS score: 8.1), a case of hard-coded, static credentials in Acclaim USAHERDS that First…
U.S. CISA adds Acclaim Systems USAHERDS flaw to its Known Exploited Vulnerabilities catalog

Dec 24, 2024 12:42 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Acclaim Systems USAHERDS flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Acclaim Systems USAHERDS vulnerability, tracked as CVE-2021-44207 (CVSS score: 8.1) to its Known Exploited Vulnerabilities (KEV) catalog. USAHERDS, developed by Acclaim Systems, is a web-based application designed to…
Top 7 zero-day exploitation trends of 2024

Dec 23, 2024 10:42 AM

by

Andy Stern

in SecurityNews

Tags: access, ai, attack, authentication, backdoor, botnet, breach, bug-bounty, business, china, ciso, cloud, computing, control, corporate, cve, cyberespionage, cybersecurity, data, data-breach, defense, email, endpoint, exploit, firewall, flaw, framework, github, google, government, group, hacker, identity, infrastructure, injection, Internet, ivanti, kev, leak, linux, malicious, malware, ml, monitoring, moveIT, network, north-korea, open-source, password, programming, pypi, ransomware, remote-code-execution, risk, service, software, sql, supply-chain, tool, training, unauthorized, update, vpn, vulnerability, windows, zero-day

Zero-day vulnerabilities saw big growth once again in 2024. With no patch available, zero-day flaws give attackers a significant jump on cybersecurity defense teams, making them a critical weapon for attacking enterprise systems.But while all zero-days are essential for CISOs and their team to be aware of, and for vendors to remedy in a timely…
U.S. CISA adds BeyondTrust software flaw to its Known Exploited Vulnerabilities catalog

Dec 20, 2024 12:42 PM

by

Andy Stern

in SecurityNews

Tags: access, cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, software, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection flaw, tracked as CVE-2024-12356 (CVSS score of 9.8) to…
CISA Adds Critical Flaw in BeyondTrust Software to Exploited Vulnerabilities List

Dec 20, 2024 6:42 AM

by

Andy Stern

in SecurityNews

Tags: access, cisa, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, software, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The vulnerability, tracked as CVE-2024-12356 (CVSS score: 9.8), is a command injection flaw that First…
U.S. CISA adds Microsoft Windows Kernel-Mode Driver and Adobe ColdFusion flaws to its Known Exploited Vulnerabilities catalog

Dec 17, 2024 10:42 AM

by

Andy Stern

in SecurityNews

Tags: access, adobe, cisa, control, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windows

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Kernel-Mode Driver and Adobe ColdFusion flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference (CVE-2024-35250) and Adobe ColdFusion Improper Access Control (CVE-2024-20767) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The…
CISA Warns of Adobe Windows Kernel Driver Vulnerabilities Exploited in Attacks

Dec 17, 2024 8:42 AM

by

Andy Stern

in SecurityNews

Tags: access, adobe, attack, cisa, control, cve, cyber, cybersecurity, exploit, infrastructure, kev, malicious, risk, vulnerability, windows

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert, adding two significant vulnerabilities to its Known Exploited Vulnerabilities Catalog. These vulnerabilities, actively exploited by malicious actors, underscore the growing risks facing organizations. Adobe ColdFusion Access Control Weakness (CVE-2024-20767) One of the newly added vulnerabilities, CVE-2024-20767, affects Adobe ColdFusion due to improper access…
CISA and FBI Raise Alerts on Exploited Flaws and Expanding HiatusRAT Campaign

Dec 17, 2024 8:42 AM

by

Andy Stern

in SecurityNews

Tags: access, adobe, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The list of flaws is below -CVE-2024-20767 (CVSS score: 7.4) – Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or…
Top 10 cybersecurity misconfigurations: Nail the setup to avoid attacks

Dec 17, 2024 7:44 AM

by

Andy Stern

in SecurityNews

Tags: access, attack, authentication, awareness, blueteam, breach, cisa, cloud, computing, control, credentials, cyber, cybersecurity, data, data-breach, endpoint, exploit, extortion, firmware, incident response, infrastructure, intelligence, kev, malicious, malware, mfa, microsoft, monitoring, network, office, open-source, password, phishing, RedTeam, risk, service, software, supply-chain, threat, unauthorized, update, vulnerability, zero-day, zero-trust

While cybersecurity headlines are often dominated by the latest zero-day or notable vulnerability in a vendor’s software/product or open-source software library, the reality is that many significant data breaches have been and will continue to be due to misconfigurations.To underscore the serious of this issue, the US National Security Agency (NSA) and the Cybersecurity and…
U.S. CISA adds Cleo Harmony, VLTrader, and LexiCom flaw to its Known Exploited Vulnerabilities catalog

Dec 14, 2024 7:05 PM

by

Andy Stern

in SecurityNews

Tags: cisa, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cleo Harmony, VLTrader, and LexiCom flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability CVE-2024-50623 (CVSS score 8.8), which impacts multiple Cleo products to its Known Exploited Vulnerabilities (KEV) catalog. >>Cleo has identified an unrestricted file upload and download vulnerability (CVE-2024-50623)…
U.S. CISA adds Microsoft Windows CLFS driver flaw to its Known Exploited Vulnerabilities catalog

Dec 11, 2024 5:36 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windows

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Common Log File System (CLFS) driver flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Microsoft Windows Common Log File System (CLFS) driver flaw CVE-2024-49138 (CVSS score: 7.8) to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft December 2024…
U.S. CISA adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog

Dec 6, 2024 2:48 PM

by

Andy Stern

in SecurityNews

Tags: authentication, cisa, cve, cybersecurity, exploit, infrastructure, kev, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds CyberPanel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CyberPanel flaw CVE-2024-51378 (CVSS score: 10.0) to its Known Exploited Vulnerabilities (KEV) catalog. The getresetstatus vulnerability in CyberPanel (before commit 1c0c6cb) affects dns/views.py and ftp/views.py. Remote attackers could bypass authentication and execute…
CISA Adds Three Critical Vulnerabilities to KEV Catalog: Immediate Action Urged

Dec 5, 2024 9:48 AM

by

Andy Stern

in SecurityNews

Tags: access, breach, cisa, cybersecurity, data, exploit, flaw, infrastructure, kev, service, unauthorized, vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding three critical vulnerabilities that are being actively exploited by cybercriminals. The flaws in these products could lead to unauthorized access, data breaches, and service disruptions if left unaddressed. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/new-flaws-to-known-exploited-vulnerabilities/
CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

Dec 5, 2024 7:48 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability, zyxel

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.The list of vulnerabilities is as follows -CVE-2024-51378 (CVSS score: 10.0) – An incorrect default permissions First seen on…
U.S. CISA adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog

Dec 4, 2024 9:48 AM

by

Andy Stern

in SecurityNews

Tags: attack, cisa, cybersecurity, exploit, firewall, infrastructure, kev, vulnerability, zyxel

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Proself versions before Ver5.62, Ver1.65, and Ver1.08 are vulnerable to XXE attacks, allowing unauthenticated attackers…
CISA Adds Array Networks’ CVE-2023-28461 to KEV List: Critical Patching Urged

Nov 26, 2024 1:10 PM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, network, update, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical security flaw, CVE-2023-28461, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability impacts First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisa-adds-cve-2023-28461-vulnerability/
U.S. CISA adds Array Networks AG and vxAG ArrayOS flaw to its Known Exploited Vulnerabilities catalog

Nov 26, 2024 11:12 AM

by

Andy Stern

in SecurityNews

Tags: cisa, cve, cybersecurity, exploit, infrastructure, kev, network, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Array Networks AG and vxAG ArrayOS flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Array Networks AG and vxAG ArrayOS flaw CVE-2023-28461 (CVSS score: 9.8) to its Known Exploited Vulnerabilities (KEV) catalog. Array Networks’ AG Series and vxAG (versions 9.4.0.481 and…
CISA Urges Agencies to Patch Critical “Array Networks” Flaw Amid Active Attacks

Nov 26, 2024 8:13 AM

by

Andy Stern

in SecurityNews

Tags: access, attack, authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, network, update, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched critical security flaw impacting Array Networks AG and vxAG secure access gateways to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild.The vulnerability, tracked as CVE-2023-28461 (CVSS score: 9.8), concerns a case of missing authentication that First…