CVE

Critical VMware vCenter Server bugs fixed (CVE-2024-38812)

September 18, 2024

Broadcom has released fixes for two vulnerabilities affecting VMware vCenter Server that can be triggered by sending a specially crafted network packet, and could lead to …

PoC exploit for exploited Ivanti Cloud Services Appliance flaw released (CVE-2024-8190)

September 17, 2024

CVE-2024-8190, an OS command injection vulnerability in Ivanti Cloud Services Appliance (CSA) v4.6, is under active exploitation. Details about the attacks are still unknown, …

Microsoft confirms second 0-day exploited by Void Banshee APT (CVE-2024-43461)

September 16, 2024

CVE-2024-43461, a spoofing vulnerability affecting Windows MSHTML – a software component used by various apps for rendering web pages on Windows – “was …

Ivanti fixes critical vulnerabilities in Endpoint Management (CVE-2024-29847)

September 11, 2024

Ivanti has fixed a slew of vulnerabilities affecting its Endpoint Manager solution, including a maximum severity one (CVE-2024-29847) that may allow unauthenticated attackers …

Microsoft fixes 4 exploited zero-days and a code defect that nixed earlier security fixes

September 10, 2024

September 2024 Patch Tuesday is here and Microsoft has delivered 79 fixes, including those for a handful of zero-days (CVE-2024-38217, CVE-2024-38226, CVE-2024-38014, …

Zyxel fixes critical command injection flaw in EOL NAS devices (CVE-2024-6342)

September 10, 2024

Users of Zyxel network-attached storage (NAS) devices are urged to implement hotfixes addressing a critical and easily exploited command injection vulnerability …

Veeam Backup & Replication RCE flaw may soon be leveraged by ransomware gangs (CVE-2024-40711)

September 9, 2024

CVE-2024-40711, a critical vulnerability affecting Veeam Backup & Replication (VBR), could soon be exploited by attackers to steal enterprise data. Discovered and …

Apache OFBiz team patches critical RCE vulnerability (CVE-2024-45195)

September 6, 2024

For the fourth time in the last five months, Apache OFBiz users have been advised to upgrade their installations to fix a critical flaw (CVE-2024-45195) that could lead to …

APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262)

August 28, 2024

ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). APT-C-60, a South Korea-aligned cyberespionage group, was …

SonicWall patches critical flaw affecting its firewalls (CVE-2024-40766)

August 26, 2024

SonicWall has patched a critical vulnerability (CVE-2024-40766) in its next-gen firewalls that could allow remote attackers unauthorized access to resources and, in specific …

Another critical SolarWinds Web Help Desk bug fixed (CVE-2024-28987)

August 23, 2024

A week after SolarWinds released a fix for a critical code-injection-to-RCE vulnerability (CVE-2024-28986) in Web Help Desk (WHD), another patch for another critical flaw …

Critical GitHub Enterprise Server auth bypass flaw fixed (CVE-2024-6800)

August 22, 2024

A critical vulnerability (CVE-2024-6800) affecting all currently supported versions of GitHub Enterprise Server (GHES) may allow attackers to gain unrestricted access to the …

CVE