#security-vulnerability

[ follow ]
#data-breach

Data broker leaves 600K+ sensitive files exposed online

Over 600,000 sensitive files, including personal data, were exposed in a non-password protected database belonging to SL Data Services.

Insurance website's buggy API leaked Office 365 password

Toyota Tsusho Insurance Broker India (TTIBI) exposed over 650,000 Microsoft-hosted emails due to a misconfigured server.
The company failed to change the password of the affected account even after the vulnerability was disclosed five months ago.

Ransomware gangs are loving this dumb but deadly ESXi flaw

The CVE-2024-37085 vulnerability allows attackers to gain full control of an ESXi hypervisor by creating specific AD groups, potentially leading to serious security breaches.

Tracker firm Hapn spilling names of thousands of GPS tracking customers | TechCrunch

Hapn exposed thousands of customer names due to a website bug, raising significant privacy concerns for users and impacting corporate clients.
The database leak included sensitive details of 8,600 GPS trackers, jeopardizing customer and corporate security.

Data broker leaves 600K+ sensitive files exposed online

Over 600,000 sensitive files, including personal data, were exposed in a non-password protected database belonging to SL Data Services.

Insurance website's buggy API leaked Office 365 password

Toyota Tsusho Insurance Broker India (TTIBI) exposed over 650,000 Microsoft-hosted emails due to a misconfigured server.
The company failed to change the password of the affected account even after the vulnerability was disclosed five months ago.

Ransomware gangs are loving this dumb but deadly ESXi flaw

The CVE-2024-37085 vulnerability allows attackers to gain full control of an ESXi hypervisor by creating specific AD groups, potentially leading to serious security breaches.

Tracker firm Hapn spilling names of thousands of GPS tracking customers | TechCrunch

Hapn exposed thousands of customer names due to a website bug, raising significant privacy concerns for users and impacting corporate clients.
The database leak included sensitive details of 8,600 GPS trackers, jeopardizing customer and corporate security.
moredata-breach
#apache-struts

Critical Apache Struts bug under active exploit

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.

Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected

A critical security flaw in Apache Struts allows for potential remote code execution, with exploitation attempts already detected in the wild.

Critical Apache Struts bug under active exploit

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.

Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected

A critical security flaw in Apache Struts allows for potential remote code execution, with exploitation attempts already detected in the wild.
moreapache-struts
#firmware

Widespread Windows and Linux Vulnerabilities Could Let Attackers Sneak in Malicious Code Before Boot

Lenovo, AMI, and Insyde have released patches for LogoFAIL, a security vulnerability that affects almost all Windows and Linux computers.
LogoFAIL allows attackers to remotely execute code by replacing an image or logo during the device boot-up process.

Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection

A critical vulnerability in OpenWrt allows malicious firmware distribution through an unchecked build request process.

Widespread Windows and Linux Vulnerabilities Could Let Attackers Sneak in Malicious Code Before Boot

Lenovo, AMI, and Insyde have released patches for LogoFAIL, a security vulnerability that affects almost all Windows and Linux computers.
LogoFAIL allows attackers to remotely execute code by replacing an image or logo during the device boot-up process.

Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection

A critical vulnerability in OpenWrt allows malicious firmware distribution through an unchecked build request process.
morefirmware
#wordpress

Critical WordPress plugin vulnerability under active exploit threatens thousands

Thousands of WordPress sites are unpatched against a critical vulnerability in the Hunk Companion plugin, exposing them to serious security risks.

WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Malicious Plugins

A critical vulnerability in the Hunk Companion WordPress plugin allows attackers to install malicious plugins, which can lead to severe security breaches.

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites

Jetpack plugin fixed a critical vulnerability that could expose user-submitted forms to logged-in users.
Over 101 versions of the Jetpack plugin were updated due to this security flaw.

LiteSpeed Cache Plugin Vulnerability Poses Significant Risk to WordPress Websites

A high-severity security vulnerability in LiteSpeed Cache allows unauthenticated users to gain admin access, potentially jeopardizing WordPress sites.

Critical WordPress plugin vulnerability under active exploit threatens thousands

Thousands of WordPress sites are unpatched against a critical vulnerability in the Hunk Companion plugin, exposing them to serious security risks.

WordPress Hunk Companion Plugin Flaw Exploited to Silently Install Malicious Plugins

A critical vulnerability in the Hunk Companion WordPress plugin allows attackers to install malicious plugins, which can lead to severe security breaches.

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites

Jetpack plugin fixed a critical vulnerability that could expose user-submitted forms to logged-in users.
Over 101 versions of the Jetpack plugin were updated due to this security flaw.

LiteSpeed Cache Plugin Vulnerability Poses Significant Risk to WordPress Websites

A high-severity security vulnerability in LiteSpeed Cache allows unauthenticated users to gain admin access, potentially jeopardizing WordPress sites.
morewordpress

Researchers Uncover Symlink Exploit Allowing TCC Bypass in iOS and macOS

Apple patched a vulnerability allowing unauthorized access to sensitive data by bypassing the TCC framework, potentially compromising user privacy.
#cloud-development-kit

AWS CDK flaw exposed accounts to full takeover

AWS fixed a significant vulnerability in its Cloud Development Kit that could lead to account hijacking for a small percentage of users.

AWS Cloud Development Kit Vulnerability Enables Full AWS Account Takeover

A newly discovered vulnerability in AWS CDK could allow attackers to take over AWS accounts due to predictable S3 bucket names.

AWS CDK flaw exposed accounts to full takeover

AWS fixed a significant vulnerability in its Cloud Development Kit that could lead to account hijacking for a small percentage of users.

AWS Cloud Development Kit Vulnerability Enables Full AWS Account Takeover

A newly discovered vulnerability in AWS CDK could allow attackers to take over AWS accounts due to predictable S3 bucket names.
morecloud-development-kit
#remote-code-execution

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

Thousands of PAN-OS devices compromised by critical exploits

Palo Alto Networks firewalls were compromised due to two security bugs, allowing attackers to deploy backdoors and malware.

D-Link says replace vulnerable routers or risk pwnage

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.
The vulnerability allows for remote code execution without authentication, raising significant security concerns.

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

Thousands of PAN-OS devices compromised by critical exploits

Palo Alto Networks firewalls were compromised due to two security bugs, allowing attackers to deploy backdoors and malware.

D-Link says replace vulnerable routers or risk pwnage

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.
The vulnerability allows for remote code execution without authentication, raising significant security concerns.
moreremote-code-execution

Canada Prepares for Immigration Surge After Trump Vows Mass Deportation

The U.S.-Canada border may become a significant migration flashpoint due to Trump's deportation policies.

Nvidia urges people to update GPU drivers due to "high" security risks

Nvidia advises immediate driver updates to address a high-risk vulnerability in its graphics cards.
#authentication

An Okta login bug bypassed checking passwords on some long usernames

A vulnerability in AD/LDAP DelAuth allows username-based authentication exploiting cached keys under certain conditions.

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

A security vulnerability in Styra's Open Policy Agent could leak NTLM hashes, allowing for credential theft and exploitation.
The flaw is linked to improper input validation leading to unauthorized access.

New Blast-RADIUS attack breaks 30-year-old protocol used in networks everywhere

RADIUS, a crucial network protocol, is newly vulnerable, risking control breaches across various critical infrastructure networks.

An Okta login bug bypassed checking passwords on some long usernames

A vulnerability in AD/LDAP DelAuth allows username-based authentication exploiting cached keys under certain conditions.

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

A security vulnerability in Styra's Open Policy Agent could leak NTLM hashes, allowing for credential theft and exploitation.
The flaw is linked to improper input validation leading to unauthorized access.

New Blast-RADIUS attack breaks 30-year-old protocol used in networks everywhere

RADIUS, a crucial network protocol, is newly vulnerable, risking control breaches across various critical infrastructure networks.
moreauthentication

Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk

A critical vulnerability in Kubernetes Image Builder could lead to root access; it has been fixed in version 0.1.38.

ChatGPT macOS Flaw Could've Enabled Long-Term Spyware via Memory Function

A security flaw in ChatGPT's macOS app could allow persistent spyware to exfiltrate user data through its memory feature.
#cybersecurity

Microsoft patches rollback flaw in Windows 10

A critical flaw in Windows Update allows attackers to rollback security patches, potentially exposing systems to known vulnerabilities. The flaw affects certain Windows 10 versions.

Researchers say a bug let them add fake pilots to rosters used for TSA checks

Security vulnerability discovered in TSA's login systems could let unauthorized individuals access flight crew records.
SQL injection tested by researchers confirmed serious flaws in the system allowing administrative access without proper authentication.

YubiKeys have an unfixable security flaw

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.

A new critical MOVEit vulnerability is being exploited by hackers - here's what you need to know

Enterprises using MOVEit Transfer affected versions should immediately patch the critical vulnerability CVE-2024-5806 to prevent unauthorized access.

Google releases Pixel update to get rid of surveillance vulnerability

Google acted promptly to remove a potentially vulnerable software from Pixel smartphones to prevent hacking risks.
No evidence of exploitation was found, but concerns led to proactive security measures.

The Arc browser that lets you customize websites had a serious vulnerability

Arc browser's 'Boosts' feature allows for website customization but poses security risks due to a vulnerability that can be exploited by attackers.

Microsoft patches rollback flaw in Windows 10

A critical flaw in Windows Update allows attackers to rollback security patches, potentially exposing systems to known vulnerabilities. The flaw affects certain Windows 10 versions.

Researchers say a bug let them add fake pilots to rosters used for TSA checks

Security vulnerability discovered in TSA's login systems could let unauthorized individuals access flight crew records.
SQL injection tested by researchers confirmed serious flaws in the system allowing administrative access without proper authentication.

YubiKeys have an unfixable security flaw

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.

A new critical MOVEit vulnerability is being exploited by hackers - here's what you need to know

Enterprises using MOVEit Transfer affected versions should immediately patch the critical vulnerability CVE-2024-5806 to prevent unauthorized access.

Google releases Pixel update to get rid of surveillance vulnerability

Google acted promptly to remove a potentially vulnerable software from Pixel smartphones to prevent hacking risks.
No evidence of exploitation was found, but concerns led to proactive security measures.

The Arc browser that lets you customize websites had a serious vulnerability

Arc browser's 'Boosts' feature allows for website customization but poses security risks due to a vulnerability that can be exploited by attackers.
morecybersecurity
#data-theft

Google Cloud Document AI flaw (still) allows data theft

The Google Cloud Document AI service has a serious vulnerability that remains unaddressed, enabling potential data theft from Cloud Storage.

1Password vulnerability lets attackers steal Vault items

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.

Google Cloud Document AI flaw (still) allows data theft

The Google Cloud Document AI service has a serious vulnerability that remains unaddressed, enabling potential data theft from Cloud Storage.

1Password vulnerability lets attackers steal Vault items

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.
moredata-theft
#trytond

Security Release for issues #13505 and #13506

Trytond allows report execution on restricted records, posing a security risk that requires users to upgrade immediately.

Security Release for issue #13142

Trytond is vulnerable to zip bomb attacks due to the acceptance of compressed content from unauthenticated requests.

Security Release for issues #13505 and #13506

Trytond allows report execution on restricted records, posing a security risk that requires users to upgrade immediately.

Security Release for issue #13142

Trytond is vulnerable to zip bomb attacks due to the acceptance of compressed content from unauthenticated requests.
moretrytond
#yubikey

YubiKeys Are a Security Gold Standard-but They Can Be Cloned

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.

YubiKey vulnerability will let attackers clone the authentication device

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.

YubiKeys Are a Security Gold Standard-but They Can Be Cloned

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.

YubiKey vulnerability will let attackers clone the authentication device

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.
moreyubikey
#software-update

SolarWinds left hardcoded credentials in helpdesk product

SolarWinds' Web Help Desk had a critical security flaw due to hardcoded credentials, necessitating an immediate update for users.

Microsoft Edge users report serious issues following recent update

Microsoft Edge update caused major usability issues for users.
Fix for the bug includes disabling 'Enhance your security on the web.'

SolarWinds left hardcoded credentials in helpdesk product

SolarWinds' Web Help Desk had a critical security flaw due to hardcoded credentials, necessitating an immediate update for users.

Microsoft Edge users report serious issues following recent update

Microsoft Edge update caused major usability issues for users.
Fix for the bug includes disabling 'Enhance your security on the web.'
moresoftware-update
#amd-processors

Researchers discover potentially catastrophic exploit present in AMD chips for decades

AMD processors have a critical firmware flaw allowing deep memory infection for decades.

AMD won't patch Sinkclose security bug on older Zen CPUs

Some AMD processors dating back to 2006 have a security vulnerability tracked as CVE-2023-31315, impacting models since 2020 with highly privileged execution environment issues.

Researchers discover potentially catastrophic exploit present in AMD chips for decades

AMD processors have a critical firmware flaw allowing deep memory infection for decades.

AMD won't patch Sinkclose security bug on older Zen CPUs

Some AMD processors dating back to 2006 have a security vulnerability tracked as CVE-2023-31315, impacting models since 2020 with highly privileged execution environment issues.
moreamd-processors

GhostWrite Vulnerability in C910 and C920 RISC-V CPUs

Vulnerability 'GhostWrite' in T-Head RISC-V CPUs exposes memory contents, mitigated by kernel updates.
#privilege-escalation

Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform

A vulnerability named ConfusedFunction allows attackers to escalate privileges in Google Cloud Functions and access unauthorized data.
Google has updated Cloud Build to prevent misuse post-responsible disclosure.

Zoom stomps critical privilege escalation bug, 6 other flaws

Zoom has revealed a critical privilege escalation vulnerability in its products that could allow unauthenticated users to gain higher privileges.
The company has released updates to patch the vulnerability, along with other medium-severity issues.

Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform

A vulnerability named ConfusedFunction allows attackers to escalate privileges in Google Cloud Functions and access unauthorized data.
Google has updated Cloud Build to prevent misuse post-responsible disclosure.

Zoom stomps critical privilege escalation bug, 6 other flaws

Zoom has revealed a critical privilege escalation vulnerability in its products that could allow unauthenticated users to gain higher privileges.
The company has released updates to patch the vulnerability, along with other medium-severity issues.
moreprivilege-escalation

Crooks plant backdoor in software used by courtrooms around the world

A software update for JAVS Viewer 8 contained a hidden backdoor, putting over 10,000 courtrooms at risk of unauthorized access by threat actors.

Hackers make millions of attempts to exploit WordPress plugin vulnerability

Hackers are exploiting a severe vulnerability in the WordPress Automatic plugin, allowing complete website takeover.

Someone is hacking 3D printers to warn owners of a security flaw

Anycubic Kobra 2 Pro/Plus/Max 3D printer faces security vulnerability with warning message advising to disconnect from the internet.
A hacker targeting vulnerable printers sent warning messages regarding a critical vulnerability through ASCII art.

CISA finally removes dud vulnerability from must-patch list

CISA has removed a security vulnerability (CVE-2022-28958) from its Known Exploited Vulnerability catalog after it was found to be a fake vulnerability.
The vulnerability was thought to be a critical remote code execution flaw but had no impact on the systems it targeted.

Vendors' response to my LLM-crasher bug report was dire

Reporting bugs with a story in reputable publications can yield substantial responses. Caution is crucial when handling potentially dangerous information.

'Almost every Apple device' vulnerable to CocoaPods

CocoaPods faced a security issue with thousands of unclaimed packages, potentially leading to supply chain attacks on iOS and macOS apps.

Zero Day Initiative - Getting Unauthenticated Remote Code Execution on the Logsign Unified SecOps Platform

A lack of rate limiting in password reset requests poses a security vulnerability on web servers, enabling potential brute-force attacks on admin passwords.

'Unusually scary' bug in Apple Vision Pro allows hackers to fill your room with spiders, bats

A software bug in Apple Vision Pro headset allowed hackers to flood users' virtual reality with spiders and bats, exploiting Safari to trigger the security gap.

Phoenix UEFI bug affects long list of Intel chip families

A new vulnerability (CVE-2024-0762) affecting UEFI firmware in Intel chip families similar to BlackLotus poses security threats.

Update your Windows PC to avoid a serious Wi-Fi vulnerability

Install Microsoft's latest update to patch a critical vulnerability in Windows 11 and 10 related to public Wi-Fi networks.
[ Load more ]