vulnerability

Vulnerability Allowed Eavesdropping via Sonos Smart Speakers

eavesdrop, IoT Security, Sonos, vulnerability /

Vulnerability Allowed Eavesdropping via Sonos Smart Speakers 2024-08-09 at 12:16 By Eduard Kovacs Sonos has patched vulnerabilities in its smart speakers, including a serious flaw that could have been exploited to eavesdrop on users. The post Vulnerability Allowed Eavesdropping via Sonos Smart Speakers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS […]

Vulnerability Allowed Eavesdropping via Sonos Smart Speakers Read More »

Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption

ICS, ICS/OT, IoT Security, power, Vulnerabilities, vulnerability /

Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption 2024-08-08 at 16:16 By Eduard Kovacs Vulnerabilities found in solar power systems could have been exploited by hackers to cause disruption and possibly blackouts. The post Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption appeared first on SecurityWeek. This article is an excerpt

Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption Read More »

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days

0-day, attack, Don't miss, Hot stuff, News, research, SafeBreach, vulnerability, Windows, Windows Server /

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days 2024-08-08 at 13:01 By Zeljka Zorz A researcher has developed a downgrade attack that can make Windows machines covertly, persistently and irreversibly vulnerable, even if they were fully patched before that. A downgrade attack exploiting the Windows Update process The direction of SafeBreach researcher Alon Leviev’s

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days Read More »

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)

CVE, Don't miss, email security, Hot stuff, News, Roundcube, security update, SonarSource, vulnerability /

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008) 2024-08-07 at 12:01 By Zeljka Zorz Two cross-site scripting vulnerabilities (CVE-2024-42009, CVE-2024-42008) affecting Roundcube could be exploited by attackers to steal users’ emails and contacts, email password, and send emails from their account. About the vulnerabilities Roundcube is an open-source webmail software solution popular with European

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008) Read More »

Chrome, Firefox Updates Patch Serious Vulnerabilities 

Chrome, Firefox, Vulnerabilities, vulnerability /

Chrome, Firefox Updates Patch Serious Vulnerabilities  2024-08-07 at 11:31 By Eduard Kovacs A Chrome 127 update patches five vulnerabilities, and Firefox 129 addresses over a dozen security holes. The post Chrome, Firefox Updates Patch Serious Vulnerabilities  appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source

Chrome, Firefox Updates Patch Serious Vulnerabilities  Read More »

Researchers unearth MotW bypass technique used by threat actors for years

Don't miss, Elastic, Features, malware detection, Microsoft, News, security controls, vulnerability, Windows /

Researchers unearth MotW bypass technique used by threat actors for years 2024-08-06 at 14:31 By Zeljka Zorz Threat actors have been abusing a bug in how Windows handles LNK files with non-standard target paths and internal structures to prevent in-built protections from stopping malicious payloads and trick users into running them. “We identified multiple samples

Researchers unearth MotW bypass technique used by threat actors for years Read More »

Google Patches Android Zero-Day Exploited in Targeted Attacks

Android, exploited, Featured, Vulnerabilities, vulnerability, Zero-Day /

Google Patches Android Zero-Day Exploited in Targeted Attacks 2024-08-06 at 11:01 By Eduard Kovacs Google has patched CVE-2024-36971, a high-severity kernel zero-day vulnerability in Android that has been exploited in targeted attacks.  The post Google Patches Android Zero-Day Exploited in Targeted Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed

Google Patches Android Zero-Day Exploited in Targeted Attacks Read More »

From Weaponization to Victimization: Fallout from the ServiceNow Vulnerability

vulnerability /

From Weaponization to Victimization: Fallout from the ServiceNow Vulnerability 2024-08-06 at 10:16 By Cyble Threat Actors capitalize on ServiceNow vulnerability  ServiceNow is a cloud-based platform that provides enterprise service management (ESM) software. It is designed to help organizations manage digital workflows for enterprise operations.   ServiceNow offers a range of solutions, including IT Service Management (ITSM),

From Weaponization to Victimization: Fallout from the ServiceNow Vulnerability Read More »

From Weaponization to Victimization: Fallout from ServiceNow Vulnerability

vulnerability /

From Weaponization to Victimization: Fallout from ServiceNow Vulnerability 2024-08-06 at 10:01 By Cyble Threat Actors capitalize on ServiceNow vulnerability  ServiceNow is a cloud-based platform that provides enterprise service management (ESM) software. It is designed to help organizations manage digital workflows for enterprise operations.   ServiceNow offers a range of solutions, including IT Service Management (ITSM), IT

From Weaponization to Victimization: Fallout from ServiceNow Vulnerability Read More »

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856)

Apache OFBiz, CVE, Don't miss, enterprise, Hot stuff, News, open source, SonicWall, vulnerability /

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) 2024-08-05 at 16:47 By Zeljka Zorz CVE-2024-38856, an incorrect authorization vulnerability affecting all but the latest version of Apache OFBiz, may be exploited by remote, unauthenticated attackers to execute arbitrary code on vulnerable systems. About CVE-2024-38856 Apache OFBiz is an open-source framework for enterprise resource

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) Read More »

Apache OFBiz Users Warned of New and Exploited Vulnerabilities

Apache, OFBiz, Vulnerabilities, vulnerability /

Apache OFBiz Users Warned of New and Exploited Vulnerabilities 2024-08-05 at 15:01 By Eduard Kovacs Organizations are being warned of a newly discovered Apache OFBiz vulnerability as exploitation of another recent flaw is observed. The post Apache OFBiz Users Warned of New and Exploited Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from

Apache OFBiz Users Warned of New and Exploited Vulnerabilities Read More »

CISA Warns of Avtech Camera Vulnerability Exploited in Wild

exploited, Vulnerabilities, vulnerability /

CISA Warns of Avtech Camera Vulnerability Exploited in Wild 2024-08-02 at 13:46 By Eduard Kovacs An Avtech camera vulnerability that likely remains unfixed has been exploited in the wild, according to CISA. The post CISA Warns of Avtech Camera Vulnerability Exploited in Wild appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

CISA Warns of Avtech Camera Vulnerability Exploited in Wild Read More »

Homebrew Security Audit Finds 25 Vulnerabilities

Application Security, audit, Homebrew, Vulnerabilities, vulnerability /

Homebrew Security Audit Finds 25 Vulnerabilities 2024-08-01 at 15:16 By Ionut Arghire Vulnerabilities in Homebrew could have allowed attackers to load executable code and modify binary builds, security audit finds. The post Homebrew Security Audit Finds 25 Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source

Homebrew Security Audit Finds 25 Vulnerabilities Read More »

VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085)

CVE, Don't miss, enterprise, Hot stuff, Microsoft, News, Ransomware, virtualization, VMWare, vulnerability /

VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085) 2024-07-30 at 14:01 By Zeljka Zorz Ransomware operators have been leveraging CVE-2024-37085, an authentication bypass vulnerability affecting Active Directory domain-joined VMware ESXi hypervisors, to gain full administrative access to them and encrypt their file system. VMware owner Broadcom has released a fix for CVE-2024-37085 on

VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085) Read More »

Critical Acronis Cyber Infrastructure vulnerability exploited in the wild (CVE-2023-45249)

Acronis, CVE, Don't miss, Hot stuff, MSP, News, storage, vulnerability /

Critical Acronis Cyber Infrastructure vulnerability exploited in the wild (CVE-2023-45249) 2024-07-29 at 15:46 By Zeljka Zorz CVE-2023-45249, a critical vulnerability affecting older versions of Acronis Cyber Infrastructure, is being exploited by attackers. About Acronis Cyber Infrastructure Acronis is a privately held Swiss cybersecurity and data protection technology company. Acronis Cyber Infrastructure (ACI) is an IT

Critical Acronis Cyber Infrastructure vulnerability exploited in the wild (CVE-2023-45249) Read More »

PKfail Vulnerability Allows Secure Boot Bypass on Hundreds of Computer Models 

PKfail, secure boot, UEFI, Vulnerabilities, vulnerability /

PKfail Vulnerability Allows Secure Boot Bypass on Hundreds of Computer Models  2024-07-26 at 13:01 By Eduard Kovacs A vulnerability dubbed PKfail can allow attackers to run malicious code during the boot process, which can be used to deliver UEFI bootkits. The post PKfail Vulnerability Allows Secure Boot Bypass on Hundreds of Computer Models  appeared first

PKfail Vulnerability Allows Secure Boot Bypass on Hundreds of Computer Models  Read More »

Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327)

Code White, CVE, Don't miss, enterprise, Hot stuff, News, Progress, vulnerability /

Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327) 2024-07-26 at 09:46 By Zeljka Zorz Progress Software has fixed a critical vulnerability (CVE-2024-6327) in its Telerik Report Server solution and is urging users to upgrade as soon as possible. About CVE-2024-6327 (and CVE-2024-6096) Telerik Report Server is an enterprise solution for storing,

Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327) Read More »

BIND Updates Resolve High-Severity DoS Vulnerabilities

BIND, Vulnerabilities, vulnerability /

BIND Updates Resolve High-Severity DoS Vulnerabilities 2024-07-25 at 16:16 By Ionut Arghire The latest BIND security updates address remotely exploitable vulnerabilities leading to denial-of-service. The post BIND Updates Resolve High-Severity DoS Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source

BIND Updates Resolve High-Severity DoS Vulnerabilities Read More »

Docker fixes critical auth bypass flaw, again (CVE-2024-41110)

containers, CVE, Docker, Don't miss, Hot stuff, News, security update, virtualization, vulnerability /

Docker fixes critical auth bypass flaw, again (CVE-2024-41110) 2024-07-25 at 15:01 By Zeljka Zorz A critical-severity Docker Engine vulnerability (CVE-2024-41110) may be exploited by attackers to bypass authorization plugins (AuthZ) via specially crafted API request, allowing them to perform unauthorized actions, including privilege escalation. About CVE-2024-41110 CVE-2024-41110 is a vulnerability that can be exploited remotely,

Docker fixes critical auth bypass flaw, again (CVE-2024-41110) Read More »

Nvidia Patches High-Severity Vulnerabilities in AI, Networking Products

NVIDIA, Vulnerabilities, vulnerability /

Nvidia Patches High-Severity Vulnerabilities in AI, Networking Products 2024-07-25 at 12:16 By Eduard Kovacs Nvidia has patched high-severity vulnerabilities in its Jetson, Mellanox OS, OnyX, Skyway, and MetroX products. The post Nvidia Patches High-Severity Vulnerabilities in AI, Networking Products appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source

Nvidia Patches High-Severity Vulnerabilities in AI, Networking Products Read More »

Scroll to Top