Critical Fluent Bit flaw affects major cloud platforms, tech companies’ offerings (CVE-2024-4323) 2024-05-21 at 14:31 By Zeljka Zorz Tenable researchers have discovered a critical vulnerability (CVE-2024-4323) in Fluent Bit, a logging utility used by major cloud providers and tech companies, which may be leveraged for denial of service, information disclosure, or remote code execution. About […]
Vulnerability Found in Fluent Bit Utility Used by Major Cloud, Tech Companies 2024-05-20 at 18:46 By Eduard Kovacs Linguistic Lumberjack (CVE-2024-4323) is a critical vulnerability in the Fluent Bit logging utility that can allow DoS, information disclosure and possibly RCE. The post Vulnerability Found in Fluent Bit Utility Used by Major Cloud, Tech Companies appeared first
Vulnerability Found in Fluent Bit Utility Used by Major Cloud, Tech Companies Read More »
PoC exploit for Ivanti EPMM privilege escalation flaw released (CVE 2024-22026) 2024-05-20 at 14:02 By Zeljka Zorz Technical details about and a proof-of-concept (PoC) exploit for CVE-2024-22026, a privilege escalation bug affecting Ivanti EPMM, has been released by the vulnerability’s reporter. About CVE-2024-22026 Ivanti Endpoint Manager Mobile (formerly MobileIron Core) is used by enterprises to
PoC exploit for Ivanti EPMM privilege escalation flaw released (CVE 2024-22026) Read More »
Critical Flaw in AI Python Package Can Lead to System and Data Compromise 2024-05-17 at 17:01 By Eduard Kovacs A critical vulnerability tracked as CVE-2024-34359 and dubbed Llama Drama can allow hackers to target AI product developers. The post Critical Flaw in AI Python Package Can Lead to System and Data Compromise appeared first on
Critical Flaw in AI Python Package Can Lead to System and Data Compromise Read More »
CISA Warns of Exploited Vulnerabilities in EOL D-Link Products 2024-05-17 at 17:01 By Ionut Arghire CISA has added two vulnerabilities in discontinued D-Link products to its KEV catalog, including a decade-old flaw. The post CISA Warns of Exploited Vulnerabilities in EOL D-Link Products appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS
CISA Warns of Exploited Vulnerabilities in EOL D-Link Products Read More »
Critical Git vulnerability allows RCE when cloning repositories with submodules (CVE-2024-32002) 2024-05-16 at 14:16 By Zeljka Zorz New versions of Git are out, with fixes for five vulnerabilities, the most critical (CVE-2024-32002) of which can be used by attackers to remotely execute code during a “clone” operation. About Git Git is a widely-popular distributed version
Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities 2024-05-15 at 18:31 By Eduard Kovacs Intel has published 41 new May 2024 Patch Tuesday advisories covering a total of more than 90 vulnerabilities. The post Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek
Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities Read More »
May 2024 Patch Tuesday: Microsoft fixes exploited zero-days (CVE-2024-30051, CVE-2024-30040) 2024-05-14 at 22:02 By Zeljka Zorz For May 2024 Patch Tuesday, Microsoft has released fixes for 59 CVE-numbered vulnerabilities, including two zero-days (CVE-2024-30051, CVE-2024-30040) actively exploited by attackers. CVE-2024-30051 and CVE-2024-30040 CVE-2024-30051 is a heap-based buffer overflow vulnerability affecting the Windows DWM Core Library that
Apple backports iOS zero-day patch, adds Bluetooth tracker alert 2024-05-14 at 16:32 By Zeljka Zorz Apple has backported the patch for CVE-2024-23296 to the iOS 16 branch and has fixed a bug (CVE-2024-27852) in MarketplaceKit that may allow maliciously crafted webpages to distribute a script that tracks iOS users on other webpages. The company has
Apple backports iOS zero-day patch, adds Bluetooth tracker alert Read More »
Cinterion Modem Flaws Pose Risk to Millions of Devices in Industrial, Other Sectors 2024-05-13 at 17:46 By Ionut Arghire A critical vulnerability in the Cinterion cellular modems can be exploited for remote code execution via SMS messages. The post Cinterion Modem Flaws Pose Risk to Millions of Devices in Industrial, Other Sectors appeared first on
Cinterion Modem Flaws Pose Risk to Millions of Devices in Industrial, Other Sectors Read More »
CISA Announces CVE Enrichment Project ‘Vulnrichment’ 2024-05-09 at 16:01 By Eduard Kovacs CISA’s Vulnrichment project is adding important information to CVE records to help improve vulnerability management processes. The post CISA Announces CVE Enrichment Project ‘Vulnrichment’ appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source
CISA Announces CVE Enrichment Project ‘Vulnrichment’ Read More »
F5 Patches Dangerous Vulnerabilities in BIG-IP Next Central Manager 2024-05-09 at 14:17 By Eduard Kovacs F5 has patched two potentially serious vulnerabilities in BIG-IP Next that could allow an attacker to take full control of a device. The post F5 Patches Dangerous Vulnerabilities in BIG-IP Next Central Manager appeared first on SecurityWeek. This article is
F5 Patches Dangerous Vulnerabilities in BIG-IP Next Central Manager Read More »
Uninterrupted Power Supply (UPS): A Silent Threat to Critical Infrastructure Resilience 2024-05-08 at 13:16 By neetha871ad236bd Multiple Vulnerabilities Disclosed in CyberPower UPS Management Software Executive Summary UPS management software is employed by a broad spectrum of users, encompassing data centers, critical manufacturing sectors, healthcare facilities, educational institutions, government agencies, and beyond, to maintain uninterrupted mission-critical
Uninterrupted Power Supply (UPS): A Silent Threat to Critical Infrastructure Resilience Read More »
CISA, FBI Urge Organizations to Eliminate Path Traversal Vulnerabilities 2024-05-03 at 17:09 By Ionut Arghire CISA and the FBI warn of threat actors abusing path traversal software vulnerabilities in attacks targeting critical infrastructure. The post CISA, FBI Urge Organizations to Eliminate Path Traversal Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek
CISA, FBI Urge Organizations to Eliminate Path Traversal Vulnerabilities Read More »
Microsoft Warns of ‘Dirty Stream’ Vulnerability in Popular Android Apps 2024-05-03 at 14:31 By Eduard Kovacs Microsoft has uncovered a new type of attack called Dirty Stream that impacted Android apps with billions of installations. The post Microsoft Warns of ‘Dirty Stream’ Vulnerability in Popular Android Apps appeared first on SecurityWeek. This article is an
Microsoft Warns of ‘Dirty Stream’ Vulnerability in Popular Android Apps Read More »
Vulnerability in R Programming Language Could Fuel Supply Chain Attacks 2024-04-30 at 17:16 By Ionut Arghire A vulnerability (CVE-2024-27322) in the R programming language implementation can be exploited to execute arbitrary and be used as part of a supply chain attack. The post Vulnerability in R Programming Language Could Fuel Supply Chain Attacks appeared first
Vulnerability in R Programming Language Could Fuel Supply Chain Attacks Read More »
PoC for critical Progress Flowmon vulnerability released (CVE-2024-2389) 2024-04-24 at 15:01 By Zeljka Zorz More details of and a proof-of-concept exploit for an unauthenticated OS command injection vulnerability (CVE-2024-2389) in Flowmon, Progress Software’s network monitoring/analysis and security solution, have been published. The critical vulnerability has been disclosed and patched by Progress earlier this month. “Currently,
PoC for critical Progress Flowmon vulnerability released (CVE-2024-2389) Read More »
Cisco Says PoC Exploit Available for Newly Patched IMC Vulnerability 2024-04-18 at 15:46 By Ionut Arghire Cisco patches a high-severity Integrated Management Controller vulnerability for which PoC exploit code is available. The post Cisco Says PoC Exploit Available for Newly Patched IMC Vulnerability appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS
Cisco Says PoC Exploit Available for Newly Patched IMC Vulnerability Read More »
Ivanti patches critical Avalanche flaw exploitable via a simple message (CVE-2024-29204) 2024-04-18 at 15:02 By Zeljka Zorz The newest version of Ivanti Avalanche – the company’s enterprise mobile device management (MDM) solution – carries fixes for 27 vulnerabilities, two of which (CVE-2024-29204, CVE-2024-24996) are critical and may allow a remote unauthenticated attacker to execute arbitrary
Ivanti patches critical Avalanche flaw exploitable via a simple message (CVE-2024-29204) Read More »
Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation 2024-04-17 at 12:31 By Zeljka Zorz While it initially seemed that protecting Palo Alto Network firewalls from attacks leveraging CVE-2024-3400 would be as easy a disabling the devices’ telemetry, it has now been comfirmed that this mitigation is ineffectual. “Device telemetry does not need to be
Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation Read More »