security update

Critical vulnerabilities in TeamCity JetBrains fixed, release of technical details imminent, patch quickly! (CVE-2024-27198, CVE-2024-27199)

March 4, 2024

JetBrains has fixed two critical security vulnerabilities (CVE-2024-27198, CVE-2024-27199) affecting TeamCity On-Premises and is urging customers to patch them immediately. …

Critical ConnectWise ScreenConnect vulnerabilities fixed, patch ASAP!

February 20, 2024

UPDATE (February 22, 2024, 05:40 a.m. ET): Now designated as CVE-2024-1709 and CVE-2024-1708, the vulnerabilities are under active exploitation. Go here for up-to-date …

QNAP fixes OS command injection flaws affecting its NAS devices (CVE-2023-47218, CVE-2023-50358)

February 14, 2024

QNAP Systems has patched two unauthenticated OS command injection vulnerabilities (CVE-2023-47218, CVE-2023-50358) in various versions of the operating systems embedded in the …

Critical Fortinet FortiOS flaw exploited in the wild (CVE-2024-21762)

February 12, 2024

Fortinet has patched critical remote code execution vulnerabilities in FortiOS (CVE-2024-21762, CVE-2024-23313), one of which is “potentially” being exploited in …

February 2024 Patch Tuesday forecast: Zero days are back and a new server too

February 9, 2024

UPDATE: February 13, 14:55 ET – February 2024 Patch Tuesday is live. January 2024 Patch Tuesday is behind us. A relatively light release from Microsoft with 39 CVEs …

On-premises JetBrains TeamCity servers vulnerable to auth bypass (CVE-2024-23917)

February 7, 2024

JetBrains has patched a critical authentication bypass vulnerability (CVE-2024-23917) affecting TeamCity On-Premises continuous integration and deployment servers. About …

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832)

February 6, 2024

Five days after Mastodon developers pushed out fixes for a remotely exploitable account takeover vulnerability (CVE-2024-23832), over 66% of Mastodon servers out there have …

Self-managed GitLab installations should be patched again (CVE-2024-0402)

January 30, 2024

Less than two weeks after having plugged a security hole that allows account takeover without user interaction, GitLab Inc. has patched a critical vulnerability …

Critical Jenkins RCE flaw exploited in the wild. Patch now! (CVE-2024-23897)

January 29, 2024

Several proof-of-concept (PoC) exploits for a recently patched critical vulnerability (CVE-2024-23897) in Jenkins have been made public and there’s evidence of …

Apple fixes actively exploited WebKit zero-day (CVE-2024-23222)

January 23, 2024

Apple has fixed an actively exploited zero-day vulnerability (CVE-2024-23222) that affects Macs, iPhones, iPads and AppleTVs. About CVE-2024-23222 CVE-2024-23222 is a type …

VMware: Plug critical Aria Automation hole immediately! (CVE-2023-34063)

January 18, 2024

A critical vulnerability (CVE-2023-34063) affecting VMware Aria Automation and VMware Cloud Foundation can be exploited by attackers to gain access to remote organizations and …

Google fixes actively exploited Chrome zero-day (CVE-2024-0519)

January 17, 2024

In the new stable release of the Chrome browser, Google has fixed three security vulnerabilities affecting the V8 engine, including one zero-day (CVE-2024-0519) with an …