Cisco on Wednesday announced patches for a critical-severity vulnerability in the BroadWorks Application Delivery Platform and BroadWorks Xtended Services Platform. Tracked as CVE-2023-20238, the vulnerability affecting the BroadWorks calling and collaboration platform was identified in the single sign-on (SSO) implementation and could be exploited by remote, unauthenticated attackers to forge credentials and access affected systems. ..
Tag : Vulnerabilities
Google on Tuesday announced the release of a Chrome 116 update that patches four high-severity vulnerabilities reported by external researchers. Tracked as CVE-2023-4761, the first bug is described as an out-of-bounds memory access issue in the FedCM (Federated Credential Management) API. Out-of-bounds memory access errors occur when a program reads memory addresses outside of the ..
AtlasVPN developers are working on a patch for an IP leak vulnerability whose details were made public by a researcher who decided to take the full disclosure route after responsible disclosure attempts were ignored. The researcher, who apparently wants to remain anonymous, shared the details on the Full Disclosure mailing list and on Reddit, claiming ..
Just days after shipping a major security update to correct vulnerabilities in its Aria Operations for Networks product line, VMWare is warning that exploit code has been published online. In an updated advisory, the virtualization technology giant confirmed the public release of exploit code that provides a roadmap for hackers to bypass SSH authentication and ..
SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we will curate and present ..
A vulnerability in several extensions for the All-in-One WP Migration plugin potentially exposes WordPress websites to attacks leading to sensitive information disclosure. With more than five million installations and maintained by ServMask, All-in-One WP Migration is a highly popular plugin for moving websites that also provides several premium extensions for migrating to third-party platforms. On ..
Splunk on Wednesday announced patches for multiple high-severity vulnerabilities in Splunk Enterprise and IT Service Intelligence, including flaws in third-party packages. The most severe of the bugs resolved in Splunk Enterprise this month is CVE-2023-40595 (CVSS score of 8.8), which is described as a remote code execution issue exploitable using crafted queries. “The exploit requires ..
Threat actors have started exploiting four recently patched vulnerabilities in the J-Web component of Juniper Networks’ Junos OS after proof-of-concept (PoC) exploit code was published online. The issues, tracked as CVE-2023-36844 through CVE-2023-36847, are medium-severity bugs that can be exploited to control environment variables remotely and to upload arbitrary files, without authentication. Juniper Networks released ..
Mozilla and Google on Tuesday announced the release of stable updates for Firefox and Chrome to address several high-severity vulnerabilities, including memory corruption issues. Mozilla released Firefox 117 with patches for 13 vulnerabilities, including seven rated ‘high severity’, four of which are described as memory corruption bugs affecting the browser’s IPC CanvasTranslator, IPC ColorPickerShownCallback, IPC ..
Virtualization technology giant VMware on Tuesday shipped a major security update to correct at least two critical vulnerabilities in its Aria Operations for Networks product line. In a critical-severity advisory, VMware said the flaws could be exploited by malicious hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line ..
