#security-vulnerability

[ follow ]

Canada Prepares for Immigration Surge After Trump Vows Mass Deportation

The U.S.-Canada border may become a significant migration flashpoint due to Trump's deportation policies.
#remote-code-execution

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

D-Link says replace vulnerable routers or risk pwnage

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.
The vulnerability allows for remote code execution without authentication, raising significant security concerns.

Doomsday 9.9 unauthenticated RCE bug affects all Linux

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

D-Link says replace vulnerable routers or risk pwnage

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.
The vulnerability allows for remote code execution without authentication, raising significant security concerns.
moreremote-code-execution

Nvidia urges people to update GPU drivers due to "high" security risks

Nvidia advises immediate driver updates to address a high-risk vulnerability in its graphics cards.
#authentication

An Okta login bug bypassed checking passwords on some long usernames

A vulnerability in AD/LDAP DelAuth allows username-based authentication exploiting cached keys under certain conditions.

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

A security vulnerability in Styra's Open Policy Agent could leak NTLM hashes, allowing for credential theft and exploitation.
The flaw is linked to improper input validation leading to unauthorized access.

New Blast-RADIUS attack breaks 30-year-old protocol used in networks everywhere

RADIUS, a crucial network protocol, is newly vulnerable, risking control breaches across various critical infrastructure networks.

An Okta login bug bypassed checking passwords on some long usernames

A vulnerability in AD/LDAP DelAuth allows username-based authentication exploiting cached keys under certain conditions.

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

A security vulnerability in Styra's Open Policy Agent could leak NTLM hashes, allowing for credential theft and exploitation.
The flaw is linked to improper input validation leading to unauthorized access.

New Blast-RADIUS attack breaks 30-year-old protocol used in networks everywhere

RADIUS, a crucial network protocol, is newly vulnerable, risking control breaches across various critical infrastructure networks.
moreauthentication
#wordpress

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites

Jetpack plugin fixed a critical vulnerability that could expose user-submitted forms to logged-in users.
Over 101 versions of the Jetpack plugin were updated due to this security flaw.

LiteSpeed Cache Plugin Vulnerability Poses Significant Risk to WordPress Websites

A high-severity security vulnerability in LiteSpeed Cache allows unauthenticated users to gain admin access, potentially jeopardizing WordPress sites.

WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites

Jetpack plugin fixed a critical vulnerability that could expose user-submitted forms to logged-in users.
Over 101 versions of the Jetpack plugin were updated due to this security flaw.

LiteSpeed Cache Plugin Vulnerability Poses Significant Risk to WordPress Websites

A high-severity security vulnerability in LiteSpeed Cache allows unauthenticated users to gain admin access, potentially jeopardizing WordPress sites.
morewordpress
#cybersecurity

Microsoft patches rollback flaw in Windows 10

A critical flaw in Windows Update allows attackers to rollback security patches, potentially exposing systems to known vulnerabilities. The flaw affects certain Windows 10 versions.

Researchers say a bug let them add fake pilots to rosters used for TSA checks

Security vulnerability discovered in TSA's login systems could let unauthorized individuals access flight crew records.
SQL injection tested by researchers confirmed serious flaws in the system allowing administrative access without proper authentication.

YubiKeys have an unfixable security flaw

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.

A new critical MOVEit vulnerability is being exploited by hackers - here's what you need to know

Enterprises using MOVEit Transfer affected versions should immediately patch the critical vulnerability CVE-2024-5806 to prevent unauthorized access.

Google releases Pixel update to get rid of surveillance vulnerability

Google acted promptly to remove a potentially vulnerable software from Pixel smartphones to prevent hacking risks.
No evidence of exploitation was found, but concerns led to proactive security measures.

The Arc browser that lets you customize websites had a serious vulnerability

Arc browser's 'Boosts' feature allows for website customization but poses security risks due to a vulnerability that can be exploited by attackers.

Microsoft patches rollback flaw in Windows 10

A critical flaw in Windows Update allows attackers to rollback security patches, potentially exposing systems to known vulnerabilities. The flaw affects certain Windows 10 versions.

Researchers say a bug let them add fake pilots to rosters used for TSA checks

Security vulnerability discovered in TSA's login systems could let unauthorized individuals access flight crew records.
SQL injection tested by researchers confirmed serious flaws in the system allowing administrative access without proper authentication.

YubiKeys have an unfixable security flaw

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.

A new critical MOVEit vulnerability is being exploited by hackers - here's what you need to know

Enterprises using MOVEit Transfer affected versions should immediately patch the critical vulnerability CVE-2024-5806 to prevent unauthorized access.

Google releases Pixel update to get rid of surveillance vulnerability

Google acted promptly to remove a potentially vulnerable software from Pixel smartphones to prevent hacking risks.
No evidence of exploitation was found, but concerns led to proactive security measures.

The Arc browser that lets you customize websites had a serious vulnerability

Arc browser's 'Boosts' feature allows for website customization but poses security risks due to a vulnerability that can be exploited by attackers.
morecybersecurity

Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk

A critical vulnerability in Kubernetes Image Builder could lead to root access; it has been fixed in version 0.1.38.

ChatGPT macOS Flaw Could've Enabled Long-Term Spyware via Memory Function

A security flaw in ChatGPT's macOS app could allow persistent spyware to exfiltrate user data through its memory feature.
#data-theft

Google Cloud Document AI flaw (still) allows data theft

The Google Cloud Document AI service has a serious vulnerability that remains unaddressed, enabling potential data theft from Cloud Storage.

1Password vulnerability lets attackers steal Vault items

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.

Google Cloud Document AI flaw (still) allows data theft

The Google Cloud Document AI service has a serious vulnerability that remains unaddressed, enabling potential data theft from Cloud Storage.

1Password vulnerability lets attackers steal Vault items

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.
moredata-theft
#trytond

Security Release for issues #13505 and #13506

Trytond allows report execution on restricted records, posing a security risk that requires users to upgrade immediately.

Security Release for issue #13142

Trytond is vulnerable to zip bomb attacks due to the acceptance of compressed content from unauthenticated requests.

Security Release for issues #13505 and #13506

Trytond allows report execution on restricted records, posing a security risk that requires users to upgrade immediately.

Security Release for issue #13142

Trytond is vulnerable to zip bomb attacks due to the acceptance of compressed content from unauthenticated requests.
moretrytond
#yubikey

YubiKeys Are a Security Gold Standard-but They Can Be Cloned

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.

YubiKey vulnerability will let attackers clone the authentication device

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.

YubiKeys Are a Security Gold Standard-but They Can Be Cloned

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.

YubiKey vulnerability will let attackers clone the authentication device

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.
moreyubikey
#software-update

SolarWinds left hardcoded credentials in helpdesk product

SolarWinds' Web Help Desk had a critical security flaw due to hardcoded credentials, necessitating an immediate update for users.

Microsoft Edge users report serious issues following recent update

Microsoft Edge update caused major usability issues for users.
Fix for the bug includes disabling 'Enhance your security on the web.'

SolarWinds left hardcoded credentials in helpdesk product

SolarWinds' Web Help Desk had a critical security flaw due to hardcoded credentials, necessitating an immediate update for users.

Microsoft Edge users report serious issues following recent update

Microsoft Edge update caused major usability issues for users.
Fix for the bug includes disabling 'Enhance your security on the web.'
moresoftware-update
#amd-processors

Researchers discover potentially catastrophic exploit present in AMD chips for decades

AMD processors have a critical firmware flaw allowing deep memory infection for decades.

AMD won't patch Sinkclose security bug on older Zen CPUs

Some AMD processors dating back to 2006 have a security vulnerability tracked as CVE-2023-31315, impacting models since 2020 with highly privileged execution environment issues.

Researchers discover potentially catastrophic exploit present in AMD chips for decades

AMD processors have a critical firmware flaw allowing deep memory infection for decades.

AMD won't patch Sinkclose security bug on older Zen CPUs

Some AMD processors dating back to 2006 have a security vulnerability tracked as CVE-2023-31315, impacting models since 2020 with highly privileged execution environment issues.
moreamd-processors

GhostWrite Vulnerability in C910 and C920 RISC-V CPUs

Vulnerability 'GhostWrite' in T-Head RISC-V CPUs exposes memory contents, mitigated by kernel updates.
#data-breach

Insurance website's buggy API leaked Office 365 password

Toyota Tsusho Insurance Broker India (TTIBI) exposed over 650,000 Microsoft-hosted emails due to a misconfigured server.
The company failed to change the password of the affected account even after the vulnerability was disclosed five months ago.

Ransomware gangs are loving this dumb but deadly ESXi flaw

The CVE-2024-37085 vulnerability allows attackers to gain full control of an ESXi hypervisor by creating specific AD groups, potentially leading to serious security breaches.

Insurance website's buggy API leaked Office 365 password

Toyota Tsusho Insurance Broker India (TTIBI) exposed over 650,000 Microsoft-hosted emails due to a misconfigured server.
The company failed to change the password of the affected account even after the vulnerability was disclosed five months ago.

Ransomware gangs are loving this dumb but deadly ESXi flaw

The CVE-2024-37085 vulnerability allows attackers to gain full control of an ESXi hypervisor by creating specific AD groups, potentially leading to serious security breaches.
moredata-breach
#privilege-escalation

Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform

A vulnerability named ConfusedFunction allows attackers to escalate privileges in Google Cloud Functions and access unauthorized data.
Google has updated Cloud Build to prevent misuse post-responsible disclosure.

Zoom stomps critical privilege escalation bug, 6 other flaws

Zoom has revealed a critical privilege escalation vulnerability in its products that could allow unauthenticated users to gain higher privileges.
The company has released updates to patch the vulnerability, along with other medium-severity issues.

Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform

A vulnerability named ConfusedFunction allows attackers to escalate privileges in Google Cloud Functions and access unauthorized data.
Google has updated Cloud Build to prevent misuse post-responsible disclosure.

Zoom stomps critical privilege escalation bug, 6 other flaws

Zoom has revealed a critical privilege escalation vulnerability in its products that could allow unauthenticated users to gain higher privileges.
The company has released updates to patch the vulnerability, along with other medium-severity issues.
moreprivilege-escalation

Crooks plant backdoor in software used by courtrooms around the world

A software update for JAVS Viewer 8 contained a hidden backdoor, putting over 10,000 courtrooms at risk of unauthorized access by threat actors.

Hackers make millions of attempts to exploit WordPress plugin vulnerability

Hackers are exploiting a severe vulnerability in the WordPress Automatic plugin, allowing complete website takeover.

Someone is hacking 3D printers to warn owners of a security flaw

Anycubic Kobra 2 Pro/Plus/Max 3D printer faces security vulnerability with warning message advising to disconnect from the internet.
A hacker targeting vulnerable printers sent warning messages regarding a critical vulnerability through ASCII art.
#security vulnerability

Widespread Windows and Linux Vulnerabilities Could Let Attackers Sneak in Malicious Code Before Boot

Lenovo, AMI, and Insyde have released patches for LogoFAIL, a security vulnerability that affects almost all Windows and Linux computers.
LogoFAIL allows attackers to remotely execute code by replacing an image or logo during the device boot-up process.

Exploit for Critical Windows Defender Bypass Goes Public

A proof-of-concept exploit (PoC) is available for a critical zero-day vulnerability in Windows SmartScreen.
The exploit allows attackers to bypass Windows Defender SmartScreen checks.
Organizations need to address the vulnerability and apply the patch if they haven't already.

CISA finally removes dud vulnerability from must-patch list

CISA has removed a security vulnerability (CVE-2022-28958) from its Known Exploited Vulnerability catalog after it was found to be a fake vulnerability.
The vulnerability was thought to be a critical remote code execution flaw but had no impact on the systems it targeted.

Dangerous Apache ActiveMQ Exploit Allows Stealthy EDR Bypass

A fresh proof-of-concept exploit for a critical security vulnerability in Apache ActiveMQ allows remote code execution on servers.
The exploit cuts down on intruder noise by launching attacks from memory, making it harder to detect.
The vulnerability has been patched, but thousands of organizations remain vulnerable.

Widespread Windows and Linux Vulnerabilities Could Let Attackers Sneak in Malicious Code Before Boot

Lenovo, AMI, and Insyde have released patches for LogoFAIL, a security vulnerability that affects almost all Windows and Linux computers.
LogoFAIL allows attackers to remotely execute code by replacing an image or logo during the device boot-up process.

Exploit for Critical Windows Defender Bypass Goes Public

A proof-of-concept exploit (PoC) is available for a critical zero-day vulnerability in Windows SmartScreen.
The exploit allows attackers to bypass Windows Defender SmartScreen checks.
Organizations need to address the vulnerability and apply the patch if they haven't already.

CISA finally removes dud vulnerability from must-patch list

CISA has removed a security vulnerability (CVE-2022-28958) from its Known Exploited Vulnerability catalog after it was found to be a fake vulnerability.
The vulnerability was thought to be a critical remote code execution flaw but had no impact on the systems it targeted.

Dangerous Apache ActiveMQ Exploit Allows Stealthy EDR Bypass

A fresh proof-of-concept exploit for a critical security vulnerability in Apache ActiveMQ allows remote code execution on servers.
The exploit cuts down on intruder noise by launching attacks from memory, making it harder to detect.
The vulnerability has been patched, but thousands of organizations remain vulnerable.
moresecurity vulnerability

Vendors' response to my LLM-crasher bug report was dire

Reporting bugs with a story in reputable publications can yield substantial responses. Caution is crucial when handling potentially dangerous information.

'Almost every Apple device' vulnerable to CocoaPods

CocoaPods faced a security issue with thousands of unclaimed packages, potentially leading to supply chain attacks on iOS and macOS apps.

Zero Day Initiative - Getting Unauthenticated Remote Code Execution on the Logsign Unified SecOps Platform

A lack of rate limiting in password reset requests poses a security vulnerability on web servers, enabling potential brute-force attacks on admin passwords.

'Unusually scary' bug in Apple Vision Pro allows hackers to fill your room with spiders, bats

A software bug in Apple Vision Pro headset allowed hackers to flood users' virtual reality with spiders and bats, exploiting Safari to trigger the security gap.

Phoenix UEFI bug affects long list of Intel chip families

A new vulnerability (CVE-2024-0762) affecting UEFI firmware in Intel chip families similar to BlackLotus poses security threats.

Update your Windows PC to avoid a serious Wi-Fi vulnerability

Install Microsoft's latest update to patch a critical vulnerability in Windows 11 and 10 related to public Wi-Fi networks.
[ Load more ]