vulnerability - Security Ticks

Enterprise, Consumer Devices Exposed to Attacks via Malicious UEFI Logo Images

Endpoint Security, UEFI, Vulnerabilities, vulnerability / SecurityTicks

Enterprise, Consumer Devices Exposed to Attacks via Malicious UEFI Logo Images 06/12/2023 at 19:03 By Eduard Kovacs LogoFAIL is an UEFI image parser attack allowing hackers to compromise consumer and enterprise devices using malicious logo images. The post Enterprise, Consumer Devices Exposed to Attacks via Malicious UEFI Logo Images appeared first on SecurityWeek. This article […]

React to this headline:

Enterprise, Consumer Devices Exposed to Attacks via Malicious UEFI Logo Images Read More »

Atlassian fixes four critical RCE vulnerabilities, patch quickly!

Atlassian, Atlassian Confluence, BitBucket, Don't miss, Hot stuff, Jira Software, News, security update, vulnerability / SecurityTicks

Atlassian fixes four critical RCE vulnerabilities, patch quickly! 06/12/2023 at 18:01 By Helga Labus Atlassian has released security updates for four critical vulnerabilities (CVE-2023-1471, CVE-2023-22522, CVE-2023-22524, CVE-2023-22523) in its various offerings that could be exploited to execute arbitrary code. About the vulnerabilities CVE-2022-1471 is a deserialization flaw in the SnakeYAML library for Java that can

React to this headline:

Atlassian fixes four critical RCE vulnerabilities, patch quickly! Read More »

CISA: Adobe ColdFusion flaw leveraged to access government servers (CVE-2023-26360)

Adobe ColdFusion, CISA, Don't miss, exploit, Government, Hot stuff, News, vulnerability / SecurityTicks

CISA: Adobe ColdFusion flaw leveraged to access government servers (CVE-2023-26360) 06/12/2023 at 17:46 By Helga Labus Unknown attackers have leveraged a critical vulnerability (CVE-2023-26360) in the Adobe ColdFusion application development platform to access government servers, the Cybersecurity and Infrastructure Security Agency (CISA) has shared. About the exploited vulnerability CVE-2023-26360 is a deserialization of untrusted data

React to this headline:

CISA: Adobe ColdFusion flaw leveraged to access government servers (CVE-2023-26360) Read More »

21 Vulnerabilities in Sierra Wireless Routers Could Expose Critical Infrastructure to Attacks

Featured, ICS/OT, IoT Security, Mobile & Wireless, OT, routers, vulnerability / SecurityTicks

21 Vulnerabilities in Sierra Wireless Routers Could Expose Critical Infrastructure to Attacks 06/12/2023 at 14:17 By Eduard Kovacs Forescout has found 21 vulnerabilities in Sierra Wireless OT/IoT routers that could expose critical infrastructure organizations to remote attacks. The post 21 Vulnerabilities in Sierra Wireless Routers Could Expose Critical Infrastructure to Attacks appeared first on SecurityWeek.

React to this headline:

21 Vulnerabilities in Sierra Wireless Routers Could Expose Critical Infrastructure to Attacks Read More »

21 high-risk vulnerabilities in OT/IoT routers found

Don't miss, Forescout, Hot stuff, Internet of Things, News, open source, Sierra Wireless, software, vulnerability / SecurityTicks

21 high-risk vulnerabilities in OT/IoT routers found 06/12/2023 at 12:53 By Help Net Security Forescout detailed the discovery of 21 new vulnerabilities in OT/IoT routers and open-source software elements. The “SIERRA:21 – Living on the Edge” report features research into Sierra Wireless AirLink cellular routers and some open-source components, such as TinyXML and OpenNDS. Sierra

React to this headline:

21 high-risk vulnerabilities in OT/IoT routers found Read More »

Bitcoin Ordinals could be stopped if blockchain bug is patched, claims dev

Bitcoin Core, BRC-20, Inscriptions, Ordinals, spam, vulnerability / SecurityTicks

Bitcoin Ordinals could be stopped if blockchain bug is patched, claims dev 06/12/2023 at 10:03 By Cointelegraph by Martin Young A Bitcoin Core developer claimed Bitcoin Ordinals exploit a vulnerability allowing inscribers to bypass data size limits, which could soon be fixed. This article is an excerpt from Cointelegraph.com News View Original Source React to

React to this headline:

Bitcoin Ordinals could be stopped if blockchain bug is patched, claims dev Read More »

Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397)

APT, cyber espionage, Don't miss, Email, EU, Hot stuff, Microsoft, Microsoft Exchange, News, Outlook, vulnerability / SecurityTicks

Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397) 05/12/2023 at 17:47 By Helga Labus Russian state-backed hacking group Forest Blizzard (aka Fancy Bear, aka APT28) has been using a known Microsoft Outlook vulnerability (CVE-2023-23397) to target public and private entities in Poland, Polish Cyber Command has warned. Compromising email accounts and maintaining

React to this headline:

Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397) Read More »

Qlik Sense flaws exploited in Cactus ransomware campaign

Arctic Wolf Networks, data analytics, Don't miss, exploit, Hot stuff, News, Ransomware, security update, vulnerability / SecurityTicks

Qlik Sense flaws exploited in Cactus ransomware campaign 01/12/2023 at 15:18 By Helga Labus Attackers are exploiting three critical vulnerabilities in internet-facing Qlik Sense instances to deliver Cactus ransomware to target organizations, Arctic Wolf researchers have warned. The exploited vulnerabilities Qlik Sense is a business intelligence and data analytics solution popular with governmental organizations and

React to this headline:

Qlik Sense flaws exploited in Cactus ransomware campaign Read More »

Critical Zyxel NAS vulnerabilities patched, update quickly!

Don't miss, Hot stuff, IBM X-Force, NAS, News, security update, vulnerability, Zyxel / SecurityTicks

Critical Zyxel NAS vulnerabilities patched, update quickly! 01/12/2023 at 14:33 By Zeljka Zorz Zyxel has patched six vulnerabilities affecting its network attached storage (NAS) devices, including several (OS) command injection flaws that can be easily exploited by unauthenticated attackers. The vulnerabilities in Zyxel NAS devices One of the six plugged security holes is an improper

React to this headline:

Critical Zyxel NAS vulnerabilities patched, update quickly! Read More »

CGSI Network Captures the Exploitation of ownCloud Vulnerability- CVE-2023-49103

CVE-2023-49103, ownCloud, Telegram, Threat Intelligence, vulnerability / SecurityTicks

CGSI Network Captures the Exploitation of ownCloud Vulnerability- CVE-2023-49103 30/11/2023 at 19:32 By cybleinc CGSI captures the active exploitation of ownCloud’s critical vulnerability CVE-2023-49103. The post CGSI Network Captures the Exploitation of ownCloud Vulnerability- CVE-2023-49103 appeared first on Cyble. This article is an excerpt from Cyble View Original Source React to this headline:

React to this headline:

CGSI Network Captures the Exploitation of ownCloud Vulnerability- CVE-2023-49103 Read More »

PoCs for critical Arcserve UDP vulnerabilities released

Arcserve, Data Protection, disaster recovery, Don't miss, enterprise, News, PoC, Tenable, vulnerability / SecurityTicks

PoCs for critical Arcserve UDP vulnerabilities released 29/11/2023 at 17:46 By Zeljka Zorz Arcserve has fixed critical security vulnerabilities (CVE-2023-41998, CVE-2023-41999, CVE-2023-42000) in its Unified Data Protection (UDP) solution, PoCs for which have been published by Tenable researchers on Monday. The vulnerabilities Arcserve UDP is a popular enterprise data protection, backup and disaster recovery solution

React to this headline:

PoCs for critical Arcserve UDP vulnerabilities released Read More »

Google fixes Chrome zero day exploited in the wild (CVE-2023-6345)

Chrome, Don't miss, exploit, Google, Hot stuff, News, security update, vulnerability / SecurityTicks

Google fixes Chrome zero day exploited in the wild (CVE-2023-6345) 29/11/2023 at 14:46 By Helga Labus Google has released an urgent security update to fix a number of vulnerabilities in Chrome browser, including a zero-day vulnerability (CVE-2023-6345) that is being actively exploited in the wild. About CVE-2023-6345 CVE-2023-6345, reported by Benoît Sevens and Clément Lecigne

React to this headline:

Google fixes Chrome zero day exploited in the wild (CVE-2023-6345) Read More »

Design flaw leaves Google Workspace vulnerable for takeover

Google, Google Workspace, Hunters, News, vulnerability / SecurityTicks

Design flaw leaves Google Workspace vulnerable for takeover 28/11/2023 at 18:31 By Help Net Security A design flaw in Google Workspace’s domain-wide delegation feature, discovered by Hunters’ Team Axon, can allow attackers to misuse existing delegations, enabling privilege escalation and unauthorized access to Workspace APIs without Super Admin privileges. Such exploitation could result in the

React to this headline:

Design flaw leaves Google Workspace vulnerable for takeover Read More »

Critical Vulnerability Found in Ray AI Framework

AI, Artificial Intelligence, vulnerability / SecurityTicks

Critical Vulnerability Found in Ray AI Framework 28/11/2023 at 17:17 By Ionut Arghire A critical issue in open source AI framework Ray could provide attackers with operating system access to all nodes. The post Critical Vulnerability Found in Ray AI Framework appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View

React to this headline:

Critical Vulnerability Found in Ray AI Framework Read More »

Critical ownCloud flaw under attack (CVE-2023-49103)

Don't miss, GreyNoise, Hot stuff, News, ownCloud, SANS ISC, vulnerability / SecurityTicks

Critical ownCloud flaw under attack (CVE-2023-49103) 28/11/2023 at 14:17 By Zeljka Zorz Attackers are trying to exploit a critical information disclosure vulnerability (CVE-2023-49103) in ownCloud, a popular file sharing and collaboration platform used in enterprise settings. Greynoise and SANS ISC say attemps have been first spotted over the weekend, though Dr. Johannes Ullrich, Dean of

React to this headline:

Critical ownCloud flaw under attack (CVE-2023-49103) Read More »

PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214)

data analytics, Don't miss, enterprise, Hot stuff, News, PoC, Splunk, vulnerability / SecurityTicks

PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214) 27/11/2023 at 13:47 By Zeljka Zorz A proof-of-concept (PoC) exploit for a high-severity flaw in Splunk Enterprise (CVE-2023-46214) that can lead to remote code execution has been made public. Users are advised to implement the provided patches or workarounds quickly. About CVE-2023-46214 Splunk Enterprise is a solution

React to this headline:

PoC for Splunk Enterprise RCE flaw released (CVE-2023-46214) Read More »

How LockBit used Citrix Bleed to breach Boeing and other targets

ACSC, CISA, Citrix, Don't miss, FBI, Hot stuff, NetScaler, News, Ransomware, vulnerability / SecurityTicks

How LockBit used Citrix Bleed to breach Boeing and other targets 22/11/2023 at 16:47 By Zeljka Zorz CVE-2023-4966, aka “Citrix Bleed”, has been exploited by LockBit 3.0 affiliates to breach Boeing’s parts and distribution business, and “other trusted third parties have observed similar activity impacting their organization,” cybersecurity and law enforcement officials have confirmed on

React to this headline:

How LockBit used Citrix Bleed to breach Boeing and other targets Read More »

Apache ActiveMQ bug exploited to deliver Kinsing malware

Apache ActiveMQ, cryptojacking, Don't miss, exploit, Hot stuff, Linux, Malware, News, Trend Micro, vulnerability / SecurityTicks

Apache ActiveMQ bug exploited to deliver Kinsing malware 21/11/2023 at 15:02 By Helga Labus Attackers are exploiting a recently fixed vulnerability (CVE-2023-46604) in Apache ActiveMQ to install Kinsing malware and cryptocurrency miners on targeted Linux systems. CVE-2023-46604 exploitation Apache ActiveMQ is a popular Java-based open source message broker that allows communication between applications and services

React to this headline:

Apache ActiveMQ bug exploited to deliver Kinsing malware Read More »

Sophos Web Appliance vulnerability exploited in the wild (CVE-2023-1671)

CISA, Don't miss, enterprise, exploit, Hot stuff, News, PoC, Sophos, vulnerability / SecurityTicks

Sophos Web Appliance vulnerability exploited in the wild (CVE-2023-1671) 20/11/2023 at 14:47 By Helga Labus CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog, among them a critical vulnerability (CVE-2023-1671) in Sophos Web Appliance that has been patched by the company in April 2023. About CVE-2023-1671 CVE-2023-1671 is a pre-auth command injection vulnerability

React to this headline:

Sophos Web Appliance vulnerability exploited in the wild (CVE-2023-1671) Read More »

Cybersecurity team claims up to $2.1B in crypto stored in old wallets is at risk

vulnerability / SecurityTicks

Cybersecurity team claims up to $2.1B in crypto stored in old wallets is at risk 15/11/2023 at 12:03 By Cointelegraph By Ezra Reguerra The security firm urges those using wallets generated from 2011 to 2015 to transfer their assets to crypto wallets that were generated more recently. This article is an excerpt from Cointelegraph.com News

React to this headline:

Cybersecurity team claims up to $2.1B in crypto stored in old wallets is at risk Read More »