vulnerability

In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover

Vulnerabilities, vulnerability /

In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover 25/09/2023 at 13:32 By Ionut Arghire A critical vulnerability in the TeamCity CI/CD server could allow unauthenticated attackers to execute code and take over vulnerable servers. The post In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover appeared first on SecurityWeek. This article is […]

In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover Read More »

Hands-on threat simulations: empower cybersecurity teams to confidently combat threats

Artificial Intelligence, attacks, automation, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, machine learning, Malware, News, opinion, Pluralsight, red team, skill development, software, threat detection, vulnerability /

Hands-on threat simulations: empower cybersecurity teams to confidently combat threats 25/09/2023 at 08:05 By Help Net Security Security processes are increasingly automated which has led some businesses to deprioritize developing their security teams’ defense skills. While antivirus and non-human generated threat detections efficiently identify vulnerabilities, they cannot detect every single threat. With the rising number […]

Hands-on threat simulations: empower cybersecurity teams to confidently combat threats Read More »

GitLab fixes critical vulnerability, patch now! (CVE-2023-5009)

DevOps, Don't miss, GitLab, Hot stuff, News, open source, security update, vulnerability /

GitLab fixes critical vulnerability, patch now! (CVE-2023-5009) 22/09/2023 at 13:31 By Helga Labus GitLab has fixed a critical vulnerability (CVE-2023-5009) in the Enterprise Edition (EE) and Community Edition (CE) of its widely used DevOps platform. They flaw may allow a threat actor to abuse scan execution policies to run pipelines as another user. About the […]

GitLab fixes critical vulnerability, patch now! (CVE-2023-5009) Read More »

Fake WinRAR PoC spread VenomRAT malware

Don't miss, Hot stuff, Malware, News, Palo Alto Networks, PoC, vulnerability, WinRAR /

Fake WinRAR PoC spread VenomRAT malware 21/09/2023 at 13:01 By Helga Labus An unknown threat actor has released a fake proof of concept (PoC) exploit for CVE-2023-4047, a recently fixed remote code execution (RCE) vulnerability in WinRAR, to spread the VenomRAT malware. The fake WinRAR PoC On August 17, 2023, Trend Micro’s Zero Day Initiative […]

Fake WinRAR PoC spread VenomRAT malware Read More »

Critical Trend Micro vulnerability exploited in the wild (CVE-2023-41179)

Don't miss, Endpoint Security, enterprise, Hot stuff, News, patch, security update, Trend Micro, vulnerability /

Critical Trend Micro vulnerability exploited in the wild (CVE-2023-41179) 21/09/2023 at 11:46 By Zeljka Zorz Trend Micro has fixed a critical zero-day vulnerability (CVE-2023-41179) in several of its endpoint security products for enterprises that has been spotted being exploited in the wild. About CVE-2023-41179 The nature of the flaw hasn’t been revealed, but we know […]

Critical Trend Micro vulnerability exploited in the wild (CVE-2023-41179) Read More »

Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems

Vulnerabilities, vulnerability /

Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems 20/09/2023 at 15:31 By Eduard Kovacs Atos Unify product vulnerabilities could be exploited to cause disruption and reconfigure or backdoor the targeted system.  The post Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS […]

Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems Read More »

Kubernetes vulnerabilities allows RCE on Windows endpoints (CVE-2023-3676)

Akamai, Don't miss, Hot stuff, Kubernetes, News, security update, vulnerability, Windows /

Kubernetes vulnerabilities allows RCE on Windows endpoints (CVE-2023-3676) 18/09/2023 at 14:32 By Helga Labus Three high-severity Kubernetes vulnerabilities (CVE-2023-3676, CVE-2023-3893, CVE-2023-3955) could allow attackers to execute code remotely and gain control over all Windows nodes in the Kubernetes cluster. About the vulnerabilities CVE-2023-3676, discovered by Akamai researcher Tomer Peled, is a command injection vulnerability that […]

Kubernetes vulnerabilities allows RCE on Windows endpoints (CVE-2023-3676) Read More »

Threat Actors orchestrate cyber-attacks on vulnerable Ivanti products

CVE-2023-35078, Ivanti, Threat Actor, United States, vulnerability /

Threat Actors orchestrate cyber-attacks on vulnerable Ivanti products 14/09/2023 at 20:17 By cybleinc Cyble Global Sensor Intelligence Networks observes exploitation of Ivanti Vulnerabilities. The post Threat Actors orchestrate cyber-attacks on vulnerable Ivanti products first appeared on Cyble. The post Threat Actors orchestrate cyber-attacks on vulnerable Ivanti products appeared first on Cyble. This article is an […]

Threat Actors orchestrate cyber-attacks on vulnerable Ivanti products Read More »

CISA Offering Free Vulnerability Scanning Service to Water Utilities

ICS/OT, Vulnerabilities, vulnerability, Water /

CISA Offering Free Vulnerability Scanning Service to Water Utilities 13/09/2023 at 15:20 By Eduard Kovacs CISA is offering a free vulnerability scanning service to water utilities to help them protect drinking water and wastewater systems against cyberattacks. The post CISA Offering Free Vulnerability Scanning Service to Water Utilities appeared first on SecurityWeek. This article is […]

CISA Offering Free Vulnerability Scanning Service to Water Utilities Read More »

Chrome zero-day exploited in the wild, patch now! (CVE-2023-4863)

0-day, Chrome, Don't miss, Google, Hot stuff, News, security update, vulnerability /

Chrome zero-day exploited in the wild, patch now! (CVE-2023-4863) 12/09/2023 at 12:47 By Helga Labus Google has rolled out a security update for a critical Chrome zero-day vulnerability (CVE-2023-4863) exploited in the wild. About the vulnerability (CVE-2023-4863) CVE-2023-4863 is a critical heap buffer overflow vulnerability in the component that handles WebP, a raster graphics file […]

Chrome zero-day exploited in the wild, patch now! (CVE-2023-4863) Read More »

The blueprint for a highly effective EASM solution

Compliance, cybersecurity, Don't miss, Features, framework, Hot stuff, misconfiguration, monitoring, News, opinion, remediation, SaaS, shadow IT, SIEM, Threat Intelligence, Uncovery, vulnerability /

The blueprint for a highly effective EASM solution 11/09/2023 at 08:04 By Mirko Zorz In this Help Net Security interview, Adrien Petit, CEO at Uncovery, discusses the benefits that organizations can derive from implementing external attack surface management (EASM) solutions, the essential capabilities an EASM solution should possess, and how it deals with uncovering hidden […]

The blueprint for a highly effective EASM solution Read More »

Email forwarding flaws enable attackers to impersonate high-profile domains

bug bounty, cybersecurity, Don't miss, Email, identity, Malware, News, report, spoofing, spyware, vulnerability /

Email forwarding flaws enable attackers to impersonate high-profile domains 11/09/2023 at 07:02 By Help Net Security Sending an email with a forged address is easier than previously thought, due to flaws in the process that allows email forwarding, according to a research team led by computer scientists at the University of California San Diego. The […]

Email forwarding flaws enable attackers to impersonate high-profile domains Read More »

Unpatched Cisco ASA flaw exploited by attackers (CVE-2023-20269)

brute-force, Cisco, Don't miss, Hot stuff, News, Rapid7, vulnerability /

Unpatched Cisco ASA flaw exploited by attackers (CVE-2023-20269) 08/09/2023 at 14:02 By Zeljka Zorz A vulnerability (CVE-2023-20269) in Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) firewalls is being exploited by attackers to gain access to vulnerable internet-exposed devices. “This vulnerability was found during the resolution of a Cisco TAC support case,” […]

Unpatched Cisco ASA flaw exploited by attackers (CVE-2023-20269) Read More »

Old vulnerabilities are still a big problem

cybercrime, Don't miss, exploit, Fortinet, Hot stuff, Malware, News, patching, Qualys, Ransomware, vulnerability /

Old vulnerabilities are still a big problem 06/09/2023 at 17:01 By Zeljka Zorz A recently flagged phishing campaign aimed at delivering the Agent Tesla RAT to unsuspecting users takes advantage of old vulnerabilities in Microsoft Office that allow remote code execution. “Despite fixes for CVE-2017-11882/CVE-2018-0802 being released by Microsoft in November, 2017 and January, 2018, […]

Old vulnerabilities are still a big problem Read More »

AtlasVPN to Patch IP Leak Vulnerability After Public Disclosure

VPN, Vulnerabilities, vulnerability /

AtlasVPN to Patch IP Leak Vulnerability After Public Disclosure 06/09/2023 at 14:17 By Eduard Kovacs AtlasVPN developers are working on a patch for an IP leak vulnerability after a researcher publicly disclosed the flaw due to being ignored. The post AtlasVPN to Patch IP Leak Vulnerability After Public Disclosure appeared first on SecurityWeek. This article […]

AtlasVPN to Patch IP Leak Vulnerability After Public Disclosure Read More »

Atlas VPN zero-day allows sites to discover users’ IP address

0-day, Don't miss, exploit, Hot stuff, Linux, News, VPN, vulnerability /

Atlas VPN zero-day allows sites to discover users’ IP address 05/09/2023 at 20:47 By Zeljka Zorz Atlas VPN has confirmed the existence of a zero-day vulnerability that may allow website owners to discover Linux users’ real IP address. Details about this zero-day vulnerability as well as exploit code have been publicly released on Reddit several […]

Atlas VPN zero-day allows sites to discover users’ IP address Read More »

VMware fixes critical vulnerability in Aria Operations for Networks (CVE-2023-34039)

Don't miss, Hot stuff, News, security update, VMWare, vulnerability /

VMware fixes critical vulnerability in Aria Operations for Networks (CVE-2023-34039) 30/08/2023 at 14:01 By Helga Labus VMware has patched one critical (CVE-2023-34039) and one high-severity vulnerability (CVE-2023-20890) in Aria Operations for Networks, its popular enterprise network monitoring tool. About the vulnerabilities (CVE-2023-34039, CVE-2023-20890) CVE-2023-34039 is a network bypass vulnerability arising as a result of a […]

VMware fixes critical vulnerability in Aria Operations for Networks (CVE-2023-34039) Read More »

Ransomware group exploits Citrix NetScaler systems for initial access

Citrix, Don't miss, exploit, Hot stuff, News, Ransomware, Sophos, vulnerability /

Ransomware group exploits Citrix NetScaler systems for initial access 29/08/2023 at 14:50 By Helga Labus A known threat actor specializing in ransomware attacks is believed to be behind a recent campaign that targeted unpatched internet-facing Citrix NetScaler systems to serve as an initial foothold into enterprise networks. “Our data indicates strong similarity between attacks using […]

Ransomware group exploits Citrix NetScaler systems for initial access Read More »

Easy-to-exploit Skype vulnerability reveals users’ IP address

consumer, deanonymization, Don't miss, Hot stuff, Microsoft, mobile apps, News, Privacy, Skype, vulnerability /

Easy-to-exploit Skype vulnerability reveals users’ IP address 29/08/2023 at 13:32 By Zeljka Zorz A vulnerability in Skype mobile apps can be exploited by attackers to discover a user’s IP address – a piece of information that may endanger individuals whose physical security depends on their general location remaining secret. The vulnerability The security vulnerability has […]

Easy-to-exploit Skype vulnerability reveals users’ IP address Read More »

Is the cybersecurity community’s obsession with compliance counter-productive?

CISO, Compliance, credentials, cybersecurity, Don't miss, Expert analysis, Expert corner, Government, Hot stuff, News, opinion, phishing, trackd, vulnerability /

Is the cybersecurity community’s obsession with compliance counter-productive? 29/08/2023 at 07:01 By Help Net Security Does anyone think the chances of surviving a plane crash increase if our tray tables are locked and our carry-on bags are completely stowed under our seats? That we’ll be OK if the plane hits a mountain if we have […]

Is the cybersecurity community’s obsession with compliance counter-productive? Read More »

Scroll to Top