vulnerability - Security Ticks

Possible Zero-Day Patched in SonicWall SMA Appliances

exploited, Featured, SMA, SonicWall, Vulnerabilities, vulnerability, Zero-Day / SecurityTicks

Possible Zero-Day Patched in SonicWall SMA Appliances 2025-05-08 at 16:11 By Ionut Arghire SonicWall patches three SMA 100 vulnerabilities, including a potential zero-day, that could be chained to execute arbitrary code remotely. The post Possible Zero-Day Patched in SonicWall SMA Appliances appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source […]

React to this headline:

Possible Zero-Day Patched in SonicWall SMA Appliances Read More »

Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819)

Don't miss, Hot stuff, News, Rapid7, security update, SMBs, SonicWall, VPN, vulnerability / SecurityTicks

Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819) 2025-05-08 at 15:38 By Zeljka Zorz SonicWall has fixed multiple vulnerabilities affecting its SMA100 Series devices, one of which (CVE-2025-32819) appears to be a patch bypass for an arbitrary file delete vulnerability that was exploited in zero-day attacks in early 2021, and may have also

React to this headline:

Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819) Read More »

Dozens of SysAid Instances Vulnerable to Remote Hacking

PoC, SysAid, Vulnerabilities, vulnerability / SecurityTicks

Dozens of SysAid Instances Vulnerable to Remote Hacking 2025-05-08 at 12:46 By Eduard Kovacs SysAid patches IT service management software vulnerabilities that can be chained for unauthenticated remote command execution. The post Dozens of SysAid Instances Vulnerable to Remote Hacking appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React

React to this headline:

Dozens of SysAid Instances Vulnerable to Remote Hacking Read More »

PoC exploit for SysAid pre-auth RCE released, upgrade quickly!

Don't miss, enterprise, Hot stuff, ITSM, News, PoC, SMBs, SysAid, vulnerability, WatchTowr / SecurityTicks

PoC exploit for SysAid pre-auth RCE released, upgrade quickly! 2025-05-07 at 15:45 By Zeljka Zorz WatchTowr researchers have released a proof-of-concept (PoC) exploit that chains two vulnerabilities in SysAid On-Prem – the self-hosted version of the platform behind SysAid’s popular IT service management and IT helpdesk solutions – to achieve unauthenticated remote code execution on

React to this headline:

PoC exploit for SysAid pre-auth RCE released, upgrade quickly! Read More »

Actively exploited FreeType flaw fixed in Android (CVE-2025-27363)

Android, Don't miss, Google, Hot stuff, News, security update, vulnerability / SecurityTicks

Actively exploited FreeType flaw fixed in Android (CVE-2025-27363) 2025-05-07 at 13:03 By Zeljka Zorz Google has released fixes for a bucketload of Android security vulnerabilities, including a FreeType flaw (CVE-2025-27363) that “may be under limited, targeted exploitation.” About CVE-2025-27363 CVE-2025-27363 is an out of bounds write vulnerability in FreeType, an open-source software library that renders

React to this headline:

Actively exploited FreeType flaw fixed in Android (CVE-2025-27363) Read More »

RCE flaw in tool for building AI agents exploited by attackers (CVE-2025-3248)

Censys, Don't miss, exploit, Horizon3.ai, Hot stuff, News, PoC, SANS ISC, vulnerability / SecurityTicks

RCE flaw in tool for building AI agents exploited by attackers (CVE-2025-3248) 2025-05-06 at 16:19 By Zeljka Zorz A missing authentication vulnerability (CVE-2025-3248) in Langflow, a web application for building AI-driven agents, is being exploited by attackers in the wild, CISA has confirmed by adding it to its Known Exploited Vulnerabilities (KEV) catalog. About CVE-2025-3248

React to this headline:

RCE flaw in tool for building AI agents exploited by attackers (CVE-2025-3248) Read More »

Critical Vulnerability in AI Builder Langflow Under Attack

AI, Artificial Intelligence, CISA KEV, exploited, Langflow, vulnerability / SecurityTicks

Critical Vulnerability in AI Builder Langflow Under Attack 2025-05-06 at 14:33 By Ionut Arghire CISA warns organizations that threat actors are exploiting a critical-severity vulnerability in low-code AI builder Langflow. The post Critical Vulnerability in AI Builder Langflow Under Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React

React to this headline:

Critical Vulnerability in AI Builder Langflow Under Attack Read More »

Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399)

Arctic Wolf Networks, botnet, Don't miss, Hot stuff, News, PoC, Samsung, SANS ISC, vulnerability / SecurityTicks

Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399) 2025-05-06 at 13:03 By Zeljka Zorz An easily and remotely exploitable vulnerability (CVE-2024-7399) affecting Samsung MagicINFO, a platform for managing content on Samsung commercial displays, is being leveraged by attackers. Exploit attempts have been flagged by the SANS Internet Storm Center and Arctic Wolf researchers:

React to this headline:

Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399) Read More »

Critical Commvault Vulnerability in Attacker Crosshairs

Commvault, exploited, Vulnerabilities, vulnerability / SecurityTicks

Critical Commvault Vulnerability in Attacker Crosshairs 2025-05-05 at 15:32 By Ionut Arghire CISA has flagged a critical-severity Commvault vulnerability as exploited one week after technical details were released. The post Critical Commvault Vulnerability in Attacker Crosshairs appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React to this headline:

React to this headline:

Critical Commvault Vulnerability in Attacker Crosshairs Read More »

Attackers exploited old flaws to breach SonicWall SMA appliances (CVE-2024-38475, CVE-2023-44221)

CISA, Don't miss, exploit, Hot stuff, News, PoC, SMBs, SonicWall, vulnerability, WatchTowr / SecurityTicks

Attackers exploited old flaws to breach SonicWall SMA appliances (CVE-2024-38475, CVE-2023-44221) 2025-05-02 at 16:18 By Zeljka Zorz Attackers have been using two previously known vulnerabilities (CVE-2024-38475, CVE-2023-44221) to compromise Sonicwall secure mobile access devices, the vendor has confirmed by updating the associated advisories. CISA has added the two flaws to its Known Exploited Vulnerabilities catalog,

React to this headline:

Attackers exploited old flaws to breach SonicWall SMA appliances (CVE-2024-38475, CVE-2023-44221) Read More »

SonicWall Flags Two More Vulnerabilities as Exploited

exploited, SonicWall, Vulnerabilities, vulnerability / SecurityTicks

SonicWall Flags Two More Vulnerabilities as Exploited 2025-05-01 at 13:01 By Ionut Arghire SonicWall has updated the advisories for two vulnerabilities to warn that they are being exploited in the wild. The post SonicWall Flags Two More Vulnerabilities as Exploited appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React

React to this headline:

SonicWall Flags Two More Vulnerabilities as Exploited Read More »

Airplay-enabled devices open to attack via “AirBorne” vulnerabilities

apple, Don't miss, Hot stuff, IoT, News, Oligo Security, vulnerability / SecurityTicks

Airplay-enabled devices open to attack via “AirBorne” vulnerabilities 2025-04-30 at 16:31 By Zeljka Zorz Vulnerabilities in Apple’s AirPlay Protocol, AirPlay Software Development Kits (SDKs), and the CarPlay Communication Plug-in could allow attackers to compromise AirPlay-enabled devices developed and sold by Apple and by other companies. “Because AirPlay is a fundamental piece of software for Apple

React to this headline:

Airplay-enabled devices open to attack via “AirBorne” vulnerabilities Read More »

Craft CMS Zero-Day Exploited to Compromise Hundreds of Websites

CMS, Craft, exploited, Vulnerabilities, vulnerability, Zero-Day / SecurityTicks

Craft CMS Zero-Day Exploited to Compromise Hundreds of Websites 2025-04-28 at 17:32 By Ionut Arghire Threat actors have exploited a zero-day vulnerability in Craft CMS to execute PHP code on hundreds of websites. The post Craft CMS Zero-Day Exploited to Compromise Hundreds of Websites appeared first on SecurityWeek. This article is an excerpt from SecurityWeek

React to this headline:

Craft CMS Zero-Day Exploited to Compromise Hundreds of Websites Read More »

Most critical vulnerabilities aren’t worth your attention

cyber risk, cybersecurity, Datadog, News, report, survey, vulnerability / SecurityTicks

Most critical vulnerabilities aren’t worth your attention 2025-04-28 at 07:03 By Help Net Security Web applications face a wide range of risks, including known-exploitable vulnerabilities, supply chain attacks, and insecure identity configurations in CI/CD, according to the Datadog State of DevSecOps 2025 report. 14% of Java services still contain at least one vulnerability By analyzing

React to this headline:

Most critical vulnerabilities aren’t worth your attention Read More »

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610)

Don't miss, Hot stuff, News, OPSWAT, Ruby, security update, vulnerability, web application security / SecurityTicks

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610) 2025-04-25 at 12:39 By Zeljka Zorz Researchers have uncovered three serious vulnerabilities in Rack, a server interface used by most Ruby web app frameworks (Ruby on Rails, Sinatra, Hanami, Roda, and others). Two of the flaws – CVE-2025-25184 and CVE-2025-27111 – could allow attackers to manipulate

React to this headline:

Rack Ruby vulnerability could reveal secrets to attackers (CVE-2025-27610) Read More »

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028)

backup, Commvault, Data Protection, Don't miss, Hot stuff, News, PoC, vulnerability, WatchTowr / SecurityTicks

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) 2025-04-24 at 15:35 By Zeljka Zorz If your organization is using Commvault Command Center for your data protection, backup creation, configuration and restoration needs, you should check whether your on-premise installation has been upgraded to patch a critical vulnerability (CVE-2025-34028) that could allow unauthenticated remote code execution.

React to this headline:

Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) Read More »

Cisco Confirms Some Products Impacted by Critical Erlang/OTP Flaw

Cisco, Erlang OTP, Vulnerabilities, vulnerability / SecurityTicks

Cisco Confirms Some Products Impacted by Critical Erlang/OTP Flaw 2025-04-24 at 13:03 By Eduard Kovacs Cisco is investigating the impact of the Erlang/OTP remote code execution vulnerability CVE-2025-32433 on its products. The post Cisco Confirms Some Products Impacted by Critical Erlang/OTP Flaw appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original

React to this headline:

Cisco Confirms Some Products Impacted by Critical Erlang/OTP Flaw Read More »

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433)

Arctic Wolf Networks, Don't miss, exploit, Horizon3.ai, Hot stuff, News, Platform Security, PoC, ProDefense, Ruhr University Bochum, SSH, vulnerability / SecurityTicks

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) 2025-04-22 at 15:48 By Zeljka Zorz There are now several public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433) unveiled last week. “All users running an SSH server based on the Erlang/OTP SSH library are likely to be affected by

React to this headline:

PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433) Read More »

SSL.com Scrambles to Patch Certificate Issuance Vulnerability

certificates, SSL.com, Vulnerabilities, vulnerability / SecurityTicks

SSL.com Scrambles to Patch Certificate Issuance Vulnerability 2025-04-22 at 15:48 By Ionut Arghire A vulnerability in SSL.com has resulted in nearly a dozen certificates for legitimate domains being wrongly issued. The post SSL.com Scrambles to Patch Certificate Issuance Vulnerability appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React to

React to this headline:

SSL.com Scrambles to Patch Certificate Issuance Vulnerability Read More »

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035)

CISA, Don't miss, Hot stuff, News, SMBs, SonicWall, vulnerability / SecurityTicks

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035) 2025-04-18 at 14:47 By Zeljka Zorz CVE-2021-20035, an old vulnerability affecting Sonicwall Secure Mobile Access (SMA) 100 series appliances, is being exploited by attackers. Sonicwall confirmed it by updating the original security advisory to reflect the new state of play, and by changing the description of the vulnerability

React to this headline:

Sonicwall SMA100 vulnerability exploited by attackers (CVE-2021-20035) Read More »