CVE

Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)

August 7, 2024

Two cross-site scripting vulnerabilities (CVE-2024-42009, CVE-2024-42008) affecting Roundcube could be exploited by attackers to steal users’ emails and contacts, email …

Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856)

August 5, 2024

CVE-2024-38856, an incorrect authorization vulnerability affecting all but the latest version of Apache OFBiz, may be exploited by remote, unauthenticated attackers to execute …

VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085)

July 30, 2024

Ransomware operators have been leveraging CVE-2024-37085, an authentication bypass vulnerability affecting Active Directory domain-joined VMware ESXi hypervisors, to gain full …

Critical Acronis Cyber Infrastructure vulnerability exploited in the wild (CVE-2023-45249)

July 29, 2024

CVE-2023-45249, a critical vulnerability affecting older versions of Acronis Cyber Infrastructure, is being exploited by attackers. About Acronis Cyber Infrastructure Acronis …

Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327)

July 26, 2024

Progress Software has fixed a critical vulnerability (CVE-2024-6327) in its Telerik Report Server solution and is urging users to upgrade as soon as possible. About …

Docker fixes critical auth bypass flaw, again (CVE-2024-41110)

July 25, 2024

A critical-severity Docker Engine vulnerability (CVE-2024-41110) may be exploited by attackers to bypass authorization plugins (AuthZ) via specially crafted API request, …

Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991)

July 18, 2024

A recently fixed vulnerability (CVE-2024-36991) affecting Splunk Enterprise on Windows “is more severe than it initially appeared,” according to SonicWall’s …

Void Banshee APT exploited “lingering Windows relic” in zero-day attacks

July 16, 2024

The zero-day exploit used to leverage CVE-2024-38112, a recently patched Windows MSHTML vulnerability, was wielded by an APT group dubbed Void Banshee to deliver malware to …

Critical Exim vulnerability facilitates malware delivery (CVE-2024-39929)

July 15, 2024

The maintainers of the Exim mail transfer agent (MTA) have fixed a critical vulnerability (CVE-2024-39929) that currently affects around 1.5 million public-facing servers and …

Zero-day patched by Microsoft has been exploited by attackers for over a year (CVE-2024-38112)

July 10, 2024

CVE-2024-38112, a spoofing vulnerability in Windows MSHTML Platform for which Microsoft has released a fix on Tuesday, has likely been exploited by attackers in the wild for …

Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)

July 9, 2024

For July 2024 Patch Tuesday, Microsoft has released security updates and patches that fix 142 CVEs, including two exploited zero-days (CVE-2024-38080, CVE-2024-38112) in …

PoC exploit for critical Fortra FileCatalyst flaw published (CVE-2024-5276)

June 27, 2024

A critical SQL injection vulnerability in Fortra FileCatalyst Workflow (CVE-2024-5276) has been patched; a PoC exploit is already available online. While there’s …

CVE