#security-vulnerability

[ follow ]
#remote-code-execution
Information security
fromTheregister
4 months ago

Critical Apache Struts bug under active exploit

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.
Information security
fromSecuritymagazine
2 weeks ago

Devices exposed to remote hacking via Erlang/OTP SSH vulnerability

Erlang/OTP's SSH implementation has a critical vulnerability allowing remote code execution without authentication, requiring urgent attention and action from security teams.
Information security
fromTheregister
7 months ago

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.
fromThe Hacker News
1 month ago
Java

Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code

A critical security vulnerability in Apache Parquet allows remote code execution, affecting versions up to 1.15.0.
fromTechzine Global
2 weeks ago
Information security

Commvault vulnerability poses serious risk to company data

Commvault's Command Center has a serious vulnerability (CVE-2025-34028) that allows remote code execution.
Organizations must ensure their systems are updated to version 11.38.20 to mitigate the risk.
Information security
fromTheregister
4 months ago

Critical Apache Struts bug under active exploit

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.
Information security
fromSecuritymagazine
2 weeks ago

Devices exposed to remote hacking via Erlang/OTP SSH vulnerability

Erlang/OTP's SSH implementation has a critical vulnerability allowing remote code execution without authentication, requiring urgent attention and action from security teams.
Information security
fromTheregister
7 months ago

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.
fromThe Hacker News
1 month ago
Java

Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code

A critical security vulnerability in Apache Parquet allows remote code execution, affecting versions up to 1.15.0.
fromTechzine Global
2 weeks ago
Information security

Commvault vulnerability poses serious risk to company data

Commvault's Command Center has a serious vulnerability (CVE-2025-34028) that allows remote code execution.
Organizations must ensure their systems are updated to version 11.38.20 to mitigate the risk.
more#remote-code-execution
#phishing
fromZDNET
3 weeks ago
Privacy professionals

That Google email look real? Don't click - it might be scam. Here's how to tell

Phishing attacks increasingly exploit legitimate platforms like Google to create convincing scams, putting user security at risk.
fromThe Hacker News
1 month ago
Privacy professionals

Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks

Google addresses a severe Chrome vulnerability, CVE-2025-2783, exploited in phishing attacks targeting Russian organizations.
fromZDNET
3 weeks ago
Privacy professionals

That Google email look real? Don't click - it might be scam. Here's how to tell

Phishing attacks increasingly exploit legitimate platforms like Google to create convincing scams, putting user security at risk.
fromThe Hacker News
1 month ago
Privacy professionals

Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks

Google addresses a severe Chrome vulnerability, CVE-2025-2783, exploited in phishing attacks targeting Russian organizations.
more#phishing
#nextjs
fromInfoWorld
1 month ago
Information security

Warning for developers, web admins: update Next.js to prevent exploit

Next.js vulnerability allows trivial authentication bypass, potentially exposing sensitive features to unauthorized users.
fromDeveloper Tech News
1 month ago
Web frameworks

Critical security flaw uncovered in Next.js framework

Next.js framework has a critical security flaw in its middleware that could affect millions of sites.
Information security
fromInfoWorld
1 month ago

Warning for developers, web admins: update Next.js to prevent exploit

Next.js vulnerability allows trivial authentication bypass, potentially exposing sensitive features to unauthorized users.
fromDeveloper Tech News
1 month ago
Web frameworks

Critical security flaw uncovered in Next.js framework

Next.js framework has a critical security flaw in its middleware that could affect millions of sites.
more#nextjs
Privacy technologies
fromTechCrunch
2 months ago

Exclusive: Stalkerware apps Cocospy and Spyic are exposing phone data of millions of people

A security vulnerability in Cocospy and Spyic apps exposes personal data of millions unknowingly monitored users.
Sensitive personal data can be accessed due to flaws in phone-monitoring spyware.
#data-protection
Information security
fromInfoQ
3 months ago

DeepSeek Database Leaking Sensitive Information Highlights AI Security Risks

Wiz highlights a serious database vulnerability in DeepSeek, underscoring the AI industry's need for improved security measures.
fromTheregister
6 months ago
DevOps

AWS CDK flaw exposed accounts to full takeover

AWS fixed a significant vulnerability in its Cloud Development Kit that could lead to account hijacking for a small percentage of users.
Information security
fromInfoQ
3 months ago

DeepSeek Database Leaking Sensitive Information Highlights AI Security Risks

Wiz highlights a serious database vulnerability in DeepSeek, underscoring the AI industry's need for improved security measures.
fromTheregister
6 months ago
DevOps

AWS CDK flaw exposed accounts to full takeover

AWS fixed a significant vulnerability in its Cloud Development Kit that could lead to account hijacking for a small percentage of users.
more#data-protection
fromTheregister
3 months ago
DevOps

Patch this hole or risk Kubernetes Windows node hijackings

A recently patched command-injection vulnerability in Kubernetes could allow remote code execution on Windows endpoints within a cluster.
fromTheregister
3 months ago
Information security

Asus lets chip fix slip out early, AMD says patch is inbound

AMD confirmed a microcode-related security vulnerability affecting some of its microprocessors.
The vulnerability relates to microcode signature verification, potentially allowing unauthorized code loading.
Miscellaneous
fromThe Verge
4 months ago

Volkswagen leak exposed location data for 800,000 electric cars

Volkswagen experienced a significant data leak exposing the location and personal information of approximately 800,000 electric vehicle owners.
fromThe Hacker News
4 months ago
Information security

Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection

A critical vulnerability in OpenWrt allows malicious firmware distribution through an unchecked build request process.
Information security
fromArs Technica
4 months ago

Critical WordPress plugin vulnerability under active exploit threatens thousands

Thousands of WordPress sites are unpatched against a critical vulnerability in the Hunk Companion plugin, exposing them to serious security risks.
Information security
fromThe Hacker News
4 months ago

Researchers Uncover Symlink Exploit Allowing TCC Bypass in iOS and macOS

Apple patched a vulnerability allowing unauthorized access to sensitive data by bypassing the TCC framework, potentially compromising user privacy.
fromInfoQ
5 months ago
DevOps

AWS Cloud Development Kit Vulnerability Enables Full AWS Account Takeover

A newly discovered vulnerability in AWS CDK could allow attackers to take over AWS accounts due to predictable S3 bucket names.
fromWGB
6 months ago
Information security

Nvidia urges people to update GPU drivers due to "high" security risks

Nvidia advises immediate driver updates to address a high-risk vulnerability in its graphics cards.
#cybersecurity
fromThe Hacker News
6 months ago
Information security

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

A security vulnerability in Styra's Open Policy Agent could leak NTLM hashes, allowing for credential theft and exploitation.
The flaw is linked to improper input validation leading to unauthorized access.
fromThe Verge
8 months ago
Information security

Google releases Pixel update to get rid of surveillance vulnerability

Google acted promptly to remove a potentially vulnerable software from Pixel smartphones to prevent hacking risks.
No evidence of exploitation was found, but concerns led to proactive security measures.
fromThe Hacker News
6 months ago
Information security

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

A security vulnerability in Styra's Open Policy Agent could leak NTLM hashes, allowing for credential theft and exploitation.
The flaw is linked to improper input validation leading to unauthorized access.
fromThe Verge
8 months ago
Information security

Google releases Pixel update to get rid of surveillance vulnerability

Google acted promptly to remove a potentially vulnerable software from Pixel smartphones to prevent hacking risks.
No evidence of exploitation was found, but concerns led to proactive security measures.
more#cybersecurity
#data-theft
fromTheregister
9 months ago
Information security

1Password vulnerability lets attackers steal Vault items

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.
fromTheregister
9 months ago
Information security

1Password vulnerability lets attackers steal Vault items

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.
more#data-theft
#yubikey
Information security
fromThe Verge
8 months ago

YubiKeys have an unfixable security flaw

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.
fromWIRED
8 months ago
Information security

YubiKeys Are a Security Gold Standard-but They Can Be Cloned

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.
fromEngadget
8 months ago
Information security

YubiKey vulnerability will let attackers clone the authentication device

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.
Information security
fromThe Verge
8 months ago

YubiKeys have an unfixable security flaw

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.
fromWIRED
8 months ago
Information security

YubiKeys Are a Security Gold Standard-but They Can Be Cloned

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.
fromEngadget
8 months ago
Information security

YubiKey vulnerability will let attackers clone the authentication device

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.
more#yubikey
fromInfoQ
9 months ago
Information security

GhostWrite Vulnerability in C910 and C920 RISC-V CPUs

Vulnerability 'GhostWrite' in T-Head RISC-V CPUs exposes memory contents, mitigated by kernel updates.
Information security
fromThe Hacker News
9 months ago

Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform

A vulnerability named ConfusedFunction allows attackers to escalate privileges in Google Cloud Functions and access unauthorized data.
Google has updated Cloud Build to prevent misuse post-responsible disclosure.
fromTheregister
10 months ago
Information security

Vendors' response to my LLM-crasher bug report was dire

Reporting bugs with a story in reputable publications can yield substantial responses. Caution is crucial when handling potentially dangerous information.
[ Load more ]