More than 200,000 WordPress websites are exposed to ongoing attacks targeting a critical vulnerability in the Ultimate Member plugin. Designed to make it easy for users to register and log in on sites, the plugin allows site owners to add user profiles, define roles, create custom form fields and member directories, and more. Tracked as ..
Tag : Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency (CISA) has added half a dozen flaws affecting Samsung smartphones to its Known Exploited Vulnerabilities Catalog, and they have all likely been exploited by a commercial spyware vendor. CISA added eight new vulnerabilities to its catalog on Thursday, including two D-Link router and access point vulnerabilities exploited by ..
The MITRE Corporation has published an updated Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses list to reflect the latest trends in the adversarial landscape. The 2023 CWE Top 25 lists more common and impactful weaknesses leading to serious software vulnerabilities that are often exploited in malicious attacks to take over systems, steal ..
A cybersecurity firm has disclosed the details of critical SAP vulnerabilities, including a wormable exploit chain, that can expose organizations to attacks. The vulnerabilities were reported to the enterprise software giant by Fabian Hagg, researcher at SEC Consult, an Austria-based cybersecurity consulting firm that is part of the Atos Group’s Eviden business. Hagg found the ..
Proof-of-concept (PoC) code targeting a high-severity authentication bypass vulnerability in the Arcserve Unified Data Protection (UDP) backup software was published one day after patches were released earlier this week. Tracked as CVE-2023-26258, the security defect was identified in the web management interface of Arcserve UDP. Successful exploitation of the bug could allow an attacker to ..
Google this week announced a new Chrome 114 update that patches a total of four vulnerabilities, including three high-severity bugs reported by external researchers. The internet giant says it paid out a total of $35,000 in bug bounty rewards to the reporting researchers. The highest payout went to GitHub Security Lab researcher Man Yue Mo, ..
Fortinet has released patches to address a critical vulnerability in its FortiNAC network access control solution. The zero trust access solution allows organizations to view devices and users on the network and provides granular control over network access policies. Tracked as CVE-2023-33299 (CVSS score of 9.6), the critical flaw is described as an issue related ..
The Internet Systems Consortium (ISC) has released patches for three remotely exploitable denial-of-service (DoS) vulnerabilities in the DNS software suite BIND. Tracked as CVE-2023-2828, CVE-2023-2829 and CVE-2023-2911, these high-severity issues could be exploited to exhaust the available memory, or could cause named – BIND’s daemon that functions both as a recursive resolver and as an ..
The National Security Agency (NSA) has published technical mitigation guidance to help organizations harden systems against BlackLotus UEFI bootkit infections. The NSA’s recommendations provide a blueprint for defenders to protect systems from BlackLotus, a stealthy malware that emerged on underground forums in late 2022 with capabilities that include user access control (UAC) and secure boot ..
The US government’s cybersecurity agency CISA on Thursday added another batch of security flaws to its Known Exploited Vulnerabilities (KEV) catalog and urged federal agencies to patch these issues as a matter of urgency. The already exploited vulnerabilities affect users of the open-source Roundcube webmail server and VMware Aria Operations for Networks. Exploitation of the ..
