Since August 2023, members of the Huntr bug bounty platform for artificial intelligence (AI) and machine learning (ML) have uncovered over a dozen vulnerabilities exposing AI/ML models to system takeover and sensitive information theft. Identified in tools with hundreds of thousands or millions of downloads per month, such as H2O-3, MLflow, and Ray, these issues ..
Tag : Vulnerabilities
Microsoft on Tuesday released patches and guidance for addressing a high-severity vulnerability in Azure Command-Line Interface (CLI) that could result in the exposure of sensitive information, such as credentials, through GitHub Actions logs. Tracked as CVE-2023-36052 (CVSS score of 8.6) and addressed with the release of Azure CLI 2.54 as part of the November 2023 ..
The world’s largest software maker Microsoft on Tuesday released patches with cover for at least 59 documented security vulnerabilities, including a pair of critical-severity zero-days already being exploited in the wild. Redmond’s security response team documented a wide range of security defects in a range of Windows OS and components and called special attention to ..
Software maker Adobe on Tuesday rolled out a massive batch of security fixes to cover critical-severity flaws in its Acrobat and Reader, ColdFusion, inDesign, inCopy and Audition products. As part of its scheduled Patch Tuesday updates, Adobe documented 72 distinct security bugs and called special attention to code-execution defects in the widely deployed Adobe Acrobat ..
A team of researchers has disclosed the details of a new attack method affecting a security feature present in AMD processors, demonstrating the risk it can pose to protected virtual machines (VMs). The attack method, named CacheWarp, was discovered by researchers from the CISPA Helmholtz Center for Information Security in Germany, the Graz University of ..
Organizations using SysAid IT service management software have been warned about a zero-day vulnerability that has been exploited by affiliates of a notorious ransomware operation. Exploitation of the zero-day, tracked as CVE-2023-47246, was apparently first observed by Microsoft’s threat intelligence team, which rushed to notify SysAid about the vulnerability and the attacks. The vendor has ..
Veeam Software has rolled out patches for four severe security vulnerabilities that expose users of its Veeam ONE product to remote code execution attacks The Ohio company issued an urgent advisory to document the flaws, which include a pair of critical issues with CVSS severity scores of 9.9 out of 10. An IT monitoring and ..
The first in-the-wild exploitation attempts targeting a recent vulnerability in Atlassian Confluence Data Center and Confluence Server were observed over the weekend, threat intelligence firm GreyNoise warns. Patched a week ago, the critical security defect tracked as CVE-2023-22518 (CVSS score of 9.1) is an improper authorization flaw that could lead to “significant data loss”, Atlassian ..
Microsoft says four Exchange ‘zero-days’ disclosed by ZDI have either already been patched or they don’t require immediate attention. The post Microsoft Says Exchange ‘Zero Days’ Disclosed by ZDI Already Patched or Not Urgent appeared first on SecurityWeek. https://www.securityweek.com/microsoft-says-exchange-zero-days-disclosed-by-zdi-already-patched-or-n..
Atlassian warns that ‘critical information’ released on the Confluence bug CVE-2023-22518 increases the risk of exploitation. The post Atlassian Issues Second Warning on Potential Exploitation of Critical Confluence Flaw appeared first on SecurityWeek. https://www.securityweek.com/atlassian-issues-second-warning-on-potential-exploitation-of-critical-conflu..
