security update

February 2024 Patch Tuesday forecast: Zero days are back and a new server too

February 9, 2024

UPDATE: February 13, 14:55 ET – February 2024 Patch Tuesday is live. January 2024 Patch Tuesday is behind us. A relatively light release from Microsoft with 39 CVEs …

On-premises JetBrains TeamCity servers vulnerable to auth bypass (CVE-2024-23917)

February 7, 2024

JetBrains has patched a critical authentication bypass vulnerability (CVE-2024-23917) affecting TeamCity On-Premises continuous integration and deployment servers. About …

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832)

February 6, 2024

Five days after Mastodon developers pushed out fixes for a remotely exploitable account takeover vulnerability (CVE-2024-23832), over 66% of Mastodon servers out there have …

Self-managed GitLab installations should be patched again (CVE-2024-0402)

January 30, 2024

Less than two weeks after having plugged a security hole that allows account takeover without user interaction, GitLab Inc. has patched a critical vulnerability …

Critical Jenkins RCE flaw exploited in the wild. Patch now! (CVE-2024-23897)

January 29, 2024

Several proof-of-concept (PoC) exploits for a recently patched critical vulnerability (CVE-2024-23897) in Jenkins have been made public and there’s evidence of …

Apple fixes actively exploited WebKit zero-day (CVE-2024-23222)

January 23, 2024

Apple has fixed an actively exploited zero-day vulnerability (CVE-2024-23222) that affects Macs, iPhones, iPads and AppleTVs. About CVE-2024-23222 CVE-2024-23222 is a type …

VMware: Plug critical Aria Automation hole immediately! (CVE-2023-34063)

January 18, 2024

A critical vulnerability (CVE-2023-34063) affecting VMware Aria Automation and VMware Cloud Foundation can be exploited by attackers to gain access to remote organizations and …

Google fixes actively exploited Chrome zero-day (CVE-2024-0519)

January 17, 2024

In the new stable release of the Chrome browser, Google has fixed three security vulnerabilities affecting the V8 engine, including one zero-day (CVE-2024-0519) with an …

Atlassian reveals critical Confluence RCE flaw, urges “immediate action” (CVE-2023-22527)

January 16, 2024

Atlassian has patched a critical vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution. The good news is that …

Juniper fixes critical RCE in its SRX firewalls and EX switches (CVE-2024-21591)

January 15, 2024

Juniper Networks has fixed a critical pre-authentication remote code execution (RCE) vulnerability (CVE-2024-21591) in Junos OS on SRX firewalls and EX switches. About …

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

January 12, 2024

A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have …

Critical Cisco Unity Connection flaw gives attackers root privileges. Patch now! (CVE-2024-20272)

January 11, 2024

Cisco has fixed a critical vulnerability (CVE-2024-20272) in Cisco Unity Connection that could allow an unauthenticated attacker to upload arbitrary files and gain root …