A new zero-day vulnerability affecting a product of US-based enterprise software provider Ivanti has been exploited in an attack aimed at the Norwegian government. Norwegian authorities announced on Monday that a dozen government ministries had been targeted in a cyberattack involving a previously unknown vulnerability. The country’s National Security Authority later clarified that the attack ..
Tag : Vulnerabilities
Apple on Monday pushed out major security-themed updates to its flagship iOS, macOS and iPadOS platforms, warning that at least one of the patched vulnerabilities has already been exploited in the wild. The Cupertino device maker announced patches for critical code execution flaws in iOS and macOS, including a kernel bug that was used in ..
A new exploit technique targeting a recent Citrix Application Delivery Controller (ADC) and Gateway vulnerability can be used against thousands of unpatched devices, cybersecurity firm Bishop Fox claims. Tracked as CVE-2023-3519 and patched last week, the critical-severity bug can be exploited to execute arbitrary code remotely, without authentication, on vulnerable appliances that are configured as ..
Atlassian has released patches for two remote code execution (RCE) vulnerabilities in Confluence Data Center and Server and another in Bamboo Data Center. The most severe of these issues, tracked as CVE-2023-22508 (CVSS score of 8.5), was introduced in Confluence version 7.4.0. The second bug, tracked as CVE-2023-22505 (CVSS score of 8.0), was introduced in ..
Network security company Perimeter81 apparently needs to improve its responsible disclosure process for vulnerabilities found in its products. Cybersecurity researcher Erhad Husovic published a blog post in late June to disclose the details of a local privilege escalation vulnerability discovered in Perimeter81’s macOS application. The researcher said the privilege escalation exploit leverages a misconfigured XPC ..
Three vulnerabilities in Apache OpenMeetings potentially expose organizations to remote code execution attacks, cybersecurity firm Sonar warns. A web conferencing application, OpenMeetings is used for online meetings, collaboration, and presentations, either as standalone software or as a plugin for Confluence, Jira, and other applications. On Thursday, Sonar published information on three OpenMeetings bugs – CVE-2023-28936, ..
reader comments 39 with Two years ago, ransomware crooks breached hardware-maker Gigabyte and dumped more than 112 gigabytes of data that included information from some of its most important supply-chain partners, including Intel and AMD. Now researchers are warning that the leaked information revealed what could amount to critical zero-day vulnerabilities that could imperil huge ..
Firmware and hardware security company Eclypsium has disclosed information on two new vulnerabilities found by its researchers in the American Megatrends (AMI) MegaRAC Baseboard Management Controller (BMC) software. Eclypsium disclosed other flaws discovered as part of the same research project in December 2022. The analysis focused on information leaked as a result of a ransomware ..
Adobe has released a second round of patches for some recently disclosed ColdFusion vulnerabilities, including flaws that appear to have been exploited in attacks. On July 11, Adobe announced patches for CVE-2023-29298, an improper access control issue that can lead to a security feature bypass. On July 14, the company informed customers about fixes for ..
Oracle on Tuesday announced the release of 508 new security patches as part of the July 2023 CPU, including more than 75 patches that resolve critical-severity vulnerabilities. More than 350 of the security patches address vulnerabilities that can be exploited remotely, without authentication. Some of these flaws impact multiple products, Oracle’s advisory reveals. As part ..
