vulnerability

Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms (CVE-2023-35082)

January 19, 2024

A previously patched critical vulnerability (CVE-2023-35082) affecting Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core is being actively exploited, the Cybersecurity …

VMware: Plug critical Aria Automation hole immediately! (CVE-2023-34063)

January 18, 2024

A critical vulnerability (CVE-2023-34063) affecting VMware Aria Automation and VMware Cloud Foundation can be exploited by attackers to gain access to remote organizations and …

Atlassian reveals critical Confluence RCE flaw, urges “immediate action” (CVE-2023-22527)

January 16, 2024

Atlassian has patched a critical vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution. The good news is that …

Juniper fixes critical RCE in its SRX firewalls and EX switches (CVE-2024-21591)

January 15, 2024

Juniper Networks has fixed a critical pre-authentication remote code execution (RCE) vulnerability (CVE-2024-21591) in Junos OS on SRX firewalls and EX switches. About …

Akira ransomware attackers are wiping NAS and tape backups

January 12, 2024

“The Akira ransomware malware, which was first detected in Finland in June 2023, has been particularly active at the end of the year,” the Finnish National …

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

January 12, 2024

A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have …

Critical Cisco Unity Connection flaw gives attackers root privileges. Patch now! (CVE-2024-20272)

January 11, 2024

Cisco has fixed a critical vulnerability (CVE-2024-20272) in Cisco Unity Connection that could allow an unauthenticated attacker to upload arbitrary files and gain root …

Attackers could use vulnerabilities in Bosch Rexroth nutrunners to disrupt automotive production

January 9, 2024

Researchers have discovered over two dozen vulnerabilities in “smart” cordless nutrunners (i.e., pneumatic torque wrenches) manufactured by Bosch Rexroth that …

SQLi vulnerability in Cacti could lead to RCE (CVE-2023-51448)

January 9, 2024

A blind SQL injection vulnerability (CVE-2023-51448) in Cacti, a widely-used network monitoring, performance and fault management framework, could lead to information …

8220 gang exploits old Oracle WebLogic vulnerability to deliver infostealers, cryptominers

December 20, 2023

The 8220 gang has been leveraging an old Oracle WebLogic Server vulnerability (CVE-2020-14883) to distribute malware, the Imperva Threat Research team has found. About 8220 …

Citrix Bleed leveraged to steal data of 35+ million Comcast Xfinity customers

December 20, 2023

Telecommunications company Comcast has confirmed a breach that exposed personal information of more than 35.8 million of Xfinity customers. Exploiting Citrix Bleed to breach …

SSH vulnerability exploitable in Terrapin attacks (CVE-2023-48795)

December 19, 2023

Security researchers have discovered a vulnerability (CVE-2023-48795) in the SSH cryptographic network protocol that could allow an attacker to downgrade the …