New guidance from the Australian Cyber Security Centre (ACSC), the US Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) warns developers, vendors, and organizations of access control vulnerabilities in web applications. Described as insecure direct object reference (IDOR) issues, they allow threat actors to read or tamper with sensitive data via application ..
Tag : Vulnerabilities
SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we will curate and present ..
Zimbra this week released patches for a cross-site scripting (XSS) vulnerability in Collaboration Suite that has been exploited in malicious attacks. Tracked as CVE-2023-37580, the vulnerability was disclosed earlier this month, when Zimbra recommended manual patching for version 8.8.15 of the popular email and collaboration solution. No CVE identifier had been issued for the flaw ..
Internet-connected Peloton fitness equipment is plagued with numerous security issues that could allow attackers to obtain device information or deploy malware, cybersecurity firm Check Point reports. An analysis of the software running on the Peloton Treadmill has revealed exposure to security risks associated with Android devices that are not updated to the most recent platform ..
Researchers at cloud security firm Wiz have discovered two easily exploitable privilege escalation vulnerabilities in Ubuntu’s OverlayFS module affecting 40% of Ubuntu cloud workloads. OverlayFS is a union filesystem that allows one filesystem to overlay another, enabling file modifications without changing the base. It allows users to copy files from the base to the upper ..
Researchers at cloud security startup Wiz are reporting that a whopping 62 percent of AWS environments may be exposed to the newly documented Zenbleed information leak vulnerability in AMD Zen 2 processors. In a research note posted Wednesday, Wiz calculated that more than 60 percent of AWS environments are running EC2 instances with Zen 2 ..
Cybersecurity firm Fortinet has published details on three critical- and high-severity vulnerabilities patched recently in the Microsoft Message Queuing (MSMQ) service. Two of these flaws, tracked as CVE-2023-21554 and CVE-2023-28302, could lead to remote code execution (RCE) and denial-of-service (DoS) and were addressed by Microsoft with its April 2023 Patch Tuesday updates. No CVE identifier ..
More than 900,000 MikroTik devices are impacted by a RouterOS vulnerability leading to arbitrary code execution, vulnerability intelligence provider VulnCheck reports. Tracked as CVE-2023-30799 (CVSS score of 9.1), the issue is described as a privilege escalation bug impacting RouterOS versions before 6.49.7 and RouterOS long-term versions through 6.48.6. “A remote and authenticated attacker can escalate ..
Five vulnerabilities, two deemed to be critical, have been found in the Terrestrial Trunked Radio (TETRA) standard. TETRA is the most widely used police radio communication system outside of the US. It is used by fire and ambulance services, transportation agencies, utilities, and military, border control and customs agencies in more than 100 nations globally ..
AMD has started releasing microcode patches to address a Zen 2 processor vulnerability that can allow an attacker to access sensitive information. The flaw, dubbed Zenbleed and officially tracked as CVE-2023-20593, was discovered by Google researchers as part of a new CPU research project and reported to AMD on May 15. Google Information Security’s Tavis ..
