Taiwanese computer components maker Gigabyte has announced BIOS updates meant to remove a backdoor feature that was recently found in hundreds of its motherboards. The issue, disclosed last week by firmware and hardware security company Eclypsium, is that the firmware of more than 270 Gigabyte motherboards drops a Windows binary that is executed at boot-up ..
Tag : Vulnerabilities
SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless crucial for a comprehensive understanding of the cybersecurity landscape. Each week, we will curate and present ..
Splunk on Thursday announced Splunk Enterprise security updates that resolve multiple high-severity vulnerabilities, including some impacting third-party packages used by the product. The most severe of these is CVE-2023-32707, a privilege escalation issue that allows low-privileged users with the ‘edit_user’ capability to escalate privileges to administrator, via a specially crafted web request. “This is because ..
A zero-day vulnerability affecting Progress Software’s MOVEit Transfer product has been exploited to hack organizations and steal their data. Progress Software warned on May 31 that its MOVEit Transfer managed file transfer (MFT) software is affected by a critical SQL injection vulnerability that can be exploited by an unauthenticated attacker to access MOVEit Transfer databases. ..
Google today announced significantly higher bug bounty rewards for vulnerability reports containing full chain exploits leading to a sandbox escape in Chrome. Until December 1, 2023, the first report to contain a full chain exploit leading to a Chrome sandbox escape, Google says, may receive up to $180,000, or even more if cumulated with other ..
Organizations using Moxa’s MXsecurity product have been informed about two potentially serious vulnerabilities that could be exploited by malicious hackers targeting operational technology (OT) networks. MXsecurity is an industrial network security management software designed for OT environments. Security researcher Simon Janz discovered recently that the product is impacted by a critical vulnerability that can be ..
Adobe on Wednesday called out for all researchers on the HackerOne vulnerability reporting platform to join its VIP private bug bounty program. The private program builds on the public Vulnerability Disclosure Program (VDP) that Adobe runs on the hacker-powered platform and promises higher rewards for the identified vulnerabilities and tighter collaboration with the research community. ..
Getty Images reader comments 24 with Firewalls made by Zyxel are being wrangled into a destructive botnet, which is taking control of them by exploiting a recently patched vulnerability with a severity rating of 9.8 out of a possible 10. “At this stage if you have a vulnerable device exposed, assume compromise,” officials from Shadowserver, ..
An automatic update pushed to roughly five million WordPress sites over the past few days addresses a critical vulnerability introduced in 2012. Maintained by Automattic, Jetpack is a WordPress plugin providing security features such as malware scan, real-time backup and restore, spam and brute-force attack protection, and more. The suite of security tools has more ..
A zero-day vulnerability affecting Barracuda Networks email security appliances has been exploited to deploy malware and steal data from organizations for several months before it was discovered. The zero-day, tracked as CVE-2023-2868 and described as a remote command injection issue, impacts Email Security Gateway (ESG) appliances running versions 5.1.3.001 through 9.2.0.006. “The vulnerability stemmed from ..
