Gaps in Cloudflare’s security controls allow users to bypass customer-configured protection mechanisms and target other users from the platform itself, technology consulting firm Certitude warns. The issue, the company says, arises from the shared infrastructure that all Cloudflare tenants have access to, allowing malicious actors to abuse the trust customers place in the platform’s protections ..
Tag : Vulnerabilities
Enterprise technology vendor Progress Software on Thursday shipped patches for critical-level security flaws in its WS_FTP file transfer software, warning that a pre-authenticated attacker could wreak havoc on the underlying operating system. An urgent bulletin from the Burlington, Mass. company documented at least eight security defects that could be exploited remotely and urged business customers ..
Cisco this week announced patches for multiple vulnerabilities impacting its products, including a medium-severity flaw in IOS and IOS XE software that appears to have been exploited in attacks. Tracked as CVE-2023-20109, the bug impacts the Group Encrypted Transport VPN (GET VPN) feature of IOS and IOS XE and can lead to remote code execution. ..
Google has rushed to patch another Chrome zero-day vulnerability exploited by a commercial spyware vendor. The internet giant announced on Tuesday that the stable channel of Chrome for Windows, macOS and Linux has been updated to version 117.0.5938.132. The latest update patches 10 vulnerabilities, three of which have been highlighted by the company in its ..
Mozilla on Tuesday announced security updates for both Firefox and Thunderbird, addressing a total of nine vulnerabilities in its products, including high-severity flaws. Firefox 118 was released to the stable channel with patches for all nine vulnerabilities – all are memory issues, most of which could lead to exploitable crashes. Tracked as CVE-2023-5168 and CVE-2023-5169, ..
Apple on Tuesday announced the release of macOS 14 Sonoma. A security advisory published by the tech giant shows that the latest version of the operating system patches more than 60 vulnerabilities. The flaws can be exploited to obtain potentially sensitive information (location, calendar, contacts, photos, credentials), execute arbitrary code with elevated privileges, escape the ..
A critical vulnerability in the TeamCity CI/CD server could be exploited remotely, without authentication, to execute arbitrary code and gain administrative control over a vulnerable server. Developed by JetBrains, TeamCity is a general-purpose build management and continuous integration platform available both for on-premises installation and as a cloud service. The recently identified critical flaw, tracked ..
The Internet Systems Consortium (ISC) has released security updates to address two remotely exploitable denial-of-service (DoS) vulnerabilities in the DNS software suite BIND. Both bugs, ISC says, reside in named – the BIND daemon that acts both as an authoritative name server and as a recursive resolver – and may cause it to terminate unexpectedly. ..
The Known Exploited Vulnerabilities (KEV) Catalog maintained by the US cybersecurity agency CISA has led to significant improvements in federal agencies’ patching efforts, with more than 1,000 vulnerabilities now included in the list. Launched in November 2021, the KEV Catalog lists flaws that CISA has proof are being exploited in malicious attacks, and is accompanied ..
Apple announced on Thursday that its latest operating system updates patch three new zero-day vulnerabilities. Based on the previous work of the organizations credited for reporting the flaws, they have likely been exploited by a spyware vendor. The zero-days are tracked as CVE-2023-41991, which allows a malicious app to bypass signature verification, CVE-2023-41992, a kernel ..
