exploit

Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587)

November 29, 2022

A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the …

Researchers release PoC for Fortinet firewall flaw, exploitation attempts mount

October 14, 2022

Horizon3.ai researchers have released a PoC exploit for CVE-2022-40684, the authentication bypass vulnerability affecting Fortinet‘s firewalls and secure web gateways, …

MS Exchange zero-days: The calm before the storm?

October 3, 2022

CVE-2022-41040 and CVE-2022-41082, the two exploited MS Exchange zero-days that still have no official fix, have been added to CISA’s Known Exploited Vulnerabilities …

Two Microsoft Exchange zero-days exploited by attackers (CVE-2022-41040, CVE-2022-41082)

September 30, 2022

Attackers are leveraging two zero-day vulnerabilities (CVE-2022-41040, CVE-2022-41082) to breach Microsoft Exchange servers. News of the attacks broke on Wednesday, when …

RCE in Sophos Firewall is being exploited in the wild (CVE-2022-3236)

September 26, 2022

Sophos has patched an actively exploited remote code execution vulnerability (CVE-2022-3236) in its Firewall solutions, and has pushed the fix to customers who have automatic …

Critical ManageEngine RCE flaw is being exploited (CVE-2022-35405)

September 23, 2022

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-35405, a critical remote code execution vulnerability in ManageEngine PAM360, Password …

Apple fixes exploited zero-days: Update your devices! (CVE-2022-32894, CVE-2022-32893)

August 18, 2022

Apple has released security updates for iOS, iPadOS, and macOS Monterey to fix CVE-2022-32894 and CVE-2022-32893, two code execution vulnerabilities exploited by attackers in …

Attackers are leveraging Follina. What can you do?

June 3, 2022

As the world is waiting for Microsoft to push out a patch for CVE-2022-30190, aka “Follina”, attackers around the world are exploiting the vulnerability in a …

Zero-day bug exploited by attackers via macro-less Office documents (CVE-2022-30190)

May 31, 2022

A newly numbered Windows zero-day vulnerability (CVE-2022-30190) is being exploited in the wild via specially crafted Office documents (without macros), security researchers …

Attackers are attempting to exploit critical F5 BIG-IP RCE

May 9, 2022

Researchers have developed PoC exploits for CVE-2022-1388, a critical remote code execution bug affecting F5 BIG-IP multi-purpose networking devices/modules. Simultaneously, …

Attackers are exploiting VMware RCE to deliver malware (CVE-2022-22954)

April 14, 2022

Cyber crooks have begun exploiting CVE-2022-22954, a RCE vulnerability in VMware Workspace ONE Access and Identity Manager, to deliver cryptominers onto vulnerable systems. …

CISA adds Spring4Shell to list of exploited vulnerabilities

April 5, 2022

It’s been almost a week since the Spring4Shell vulnerability (CVE-2022-22965) came to light and since the Spring development team fixed it in new versions of the Spring …