Multiple hardcoded credentials found on the Technicolor TG670 DSL gateway router allow attackers to completely take over devices, the CERT Coordination Center (CERT/CC) warns. A broadband router for small offices and home offices, the Technicolor TG670 router allows administrators to authenticate over HTTP, SSH, or Telnet. With the remote management functionality enabled, users gain complete ..
Tag : Vulnerabilities
The application of artificial intelligence is still in its infancy, but we are already seeing one major effect: the democratization of hacking. The annual Bugcrowd report, Inside the Mind of a Hacker 2023, examines the attitudes held and methods used by the Bugcrowd pool of bug hunters. This year, the report focuses on the effect ..
Citrix on Tuesday announced the release of patches for a critical-severity vulnerability in the Secure Access client for Ubuntu that could be exploited to achieve remote code execution (RCE). According to Citrix’s advisory, however, exploitation of the issue, which is tracked as CVE-2023-24492 (CVSS score of 9.6), requires user interaction. “A vulnerability has been discovered ..
Fortinet on Tuesday announced security updates that address a critical-severity vulnerability in FortiOS and FortiProxy that could be exploited for remote code execution (RCE). Tracked as CVE-2023-33308 (CVSS score of 9.8), the bug is described as a stack-based overflow issue impacting the deep inspection function in proxy mode. “A stack-based overflow vulnerability in FortiOS & ..
Russian spies and cybercriminals are actively exploiting still-unpatched security flaws in Microsoft Windows and Office products, according to an urgent warning from the world’s largest software maker. In an unusual move, Microsoft documented “a series of remote code execution vulnerabilities” impacting Windows and Office users and confirmed it was investigating multiple reports of targeted code ..
Software maker Adobe on Tuesday called attention to critical security flaws in its InDesign and ColdFusion products, warning that the defects expose users to malicious hacker attacks. The company’s scheduled July Patch Tuesday rollout includes fixes for a dozen documented vulnerabilities in Adobe InDesign, including a bug serious enough to lead to arbitrary code execution ..
Apple on Monday rolled out an urgent software update to its iOS and iPadOS mobile operating systems and warned that zero-day exploitation has already been detected. For the second time since adopting the “rapid security responses” process to address zero-day attacks, Apple pushed iOS 16.5.1 (a) and iPadOS 16.5.1 (a) to devices globally after an ..
Virtualization technology giant VMware on Monday warned that exploit code has been publicly released for a pre-authentication remote code execution flaw in its enterprise-facing VMware Aria Operations for Logs product. In an update to a critical-level advisory originally released in April this year, VMware said it has confirmed that exploit code for CVE-2023-20864 has been ..
A recently patched vulnerability in Ubiquiti EdgeRouter and AirCube devices could be exploited to execute arbitrary code, vulnerability reporting firm SSD Secure Disclosure warns. Tracked as CVE-2023-31998, the issue is described as a heap overflow vulnerability that can be exploited over a LAN connection. According to Ubiquiti, an attacker exploiting this bug may interrupt UPnP ..
A critical vulnerability in the decentralized social networking platform Mastodon could be exploited to take over servers. The issue was disclosed last week, when Mastodon announced patches for five vulnerabilities in the open source software, including two rated ‘critical’. The most important of these is CVE-2023-36460 (CVSS score of 9.9), an arbitrary file creation issue ..
