SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we will curate and present ..
Tag : Vulnerabilities
Multiple vulnerabilities in the popular airline and hotel rewards platform points.com could have allowed attackers to access users’ personal information, security researchers warn. Acting as a backend for numerous airline and hotel rewards programs, points.com also operates as a market for exchanging and redeeming loyalty points. Over the course of several months, security researchers Ian ..
Exploitation of the recently disclosed Ivanti Endpoint Manager Mobile (EPMM) vulnerability has started to pick up, just as the vendor announced the discovery of a new flaw. The EPMM zero-day tracked as CVE-2023-35078, which allows an unauthenticated attacker to obtain sensitive information and make changes to the targeted system, was exploited in attacks aimed at ..
Government agencies in Australia, Canada, New Zealand, the UK, and the US have published a list of the software vulnerabilities that were most frequently exploited in malicious attacks in 2022. Last year, the Five Eyes agencies say, threat actors mainly targeted internet-facing systems that were not patched against older, known vulnerabilities, including flaws for which ..
Dozens of vulnerabilities impacting the Milesight UR32L industrial router could be exploited to execute arbitrary code or commands, Cisco’s Talos security researchers warn. A cost-effective solution, the UR32L router provides WCDMA and 4G LTE support, Ethernet ports, and remote device management, which make it suitable for a broad range of M2M/IoT applications. During their investigation ..
Cloud security specialist Qualys has provided its view of the top five cloud security risks, drawing insights and data from its own platform and third parties. The five key risk areas are misconfigurations, external-facing vulnerabilities, weaponized vulnerabilities, malware inside a cloud environment, and remediation lag (that is, delays in patching). The 2023 Qualys Cloud Security ..
Google on Wednesday announced a Chrome 115 update that patches 17 vulnerabilities, including 11 flaws reported by external researchers. The browser update resolves three high-severity type confusion bugs in the V8 JavaScript and WebAssembly engine that earned the reporting researchers over $60,000 in bug bounties, Google notes in its advisory. The internet giant says it ..
Mozilla on Tuesday announced the release of Firefox 116, Firefox ESR 115.1, and Firefox ESR 102.14, which include patches for multiple high-severity vulnerabilities. The browser maker lists a total of 14 CVEs in its advisory, nine of which are rated ‘high severity’. Three of the CVEs refer to memory safety bugs in Firefox. The first ..
Youssef Sammouda is a Tunisian security researcher who focuses on bug bounty programs. He describes himself as, “Vulnerability researcher with an attraction to web applications and the security vulnerabilities that affect them.” He achieved first place in Facebook’s whitehat program in 2021, 2020 and 2019. SecurityWeek talked to Sammouda about using cybersecurity research and bug ..
Ivanti has warned customers about a second zero-day vulnerability in its Endpoint Manager Mobile (EPMM) product that has been exploited in targeted attacks. Norwegian authorities announced on July 24 that a dozen government ministries had been targeted in a cyberattack involving exploitation of CVE-2023-35078, an Ivanti EPMM zero-day that allows an unauthenticated attacker to obtain ..
