Virtualization giant VMware has published software updates to address multiple memory corruption vulnerabilities in vCenter Server that could lead to remote code execution. A total of five security defects were patched in the software’s implementation of the DCERPC protocol, including four that VMware flags as ‘important’, with a CVSS score of 8.1. Two of these ..
Tag : Vulnerabilities
A security researcher has published proof-of-concept (PoC) code targeting a recently patched high-severity vulnerability in the Cisco AnyConnect Secure Mobility Client and Secure Client for Windows. The software allows remote employees to connect to an organization’s network using a secure virtual private network (VPN) and provides monitoring capabilities. Tracked as CVE-2023-20178 (CVSS score of 7.8), ..
Exploit trends help reveal the areas that cybercriminals are actively investigating for potential attacks and what they’re currently targeting. New intelligence allows CISOs to prioritize risk mitigation and reduce the active attack surface with an expanded “Red Zone” approach. Entering the Red Zone When FortiGuard Labs researchers looked at data from the second half of ..
Apple has rolled out a major security-themed iOS update to fix remote code execution vulnerabilities that have already been exploited in the wild. The patches address a pair of vulnerabilities reported by Russian anti-malware vendor Kaspersky and follow the public documentation of ‘Operation Triangulation,’ a digital spy campaign that used zero-click iMessage exploits. The patches ..
Web application security firm Defiant warns of critical-severity authentication bypass vulnerabilities in two WordPress plugins with tens of thousands of installations. The first security defect, tracked as CVE-2023-2986 (CVSS score of 9.8/10), impacts the Abandoned Cart Lite for WooCommerce, a plugin that notifies customers who did not complete the purchase process, and which has more ..
The US Cybersecurity and Infrastructure Security Agency (CISA) this week issued advisories detailing two unpatched vulnerabilities in Enphase products. An American energy technology company, Enphase builds and sells solar micro-inverters, charging stations, and other energy equipment, mainly focused on residential customers. On Tuesday, CISA published two ICS advisories to warn of vulnerabilities in Enphase products ..
Like all major applications, Google’s Chrome suffers from vulnerabilities. During 2022, SecurityWeek reported on 456 vulnerabilities (averaging 38 per month), including nine zero-days. The high number of flaws needing to be patched poses a simple question: is Chrome safe to use? This high rate of vulnerability disclosures and patches has continued into 2023. Chrome 109 ..
Researchers at security startup Descope have discovered a major misconfiguration in Microsoft Azure AD OAuth applications and warned that any business using ‘Log in with Microsoft’ could be exposed to full account takeover exploits. The security defect, nicknamed nOAuth, is described as an authentication implementation flaw that can affect Microsoft Azure AD multi-tenant OAuth applications. ..
Taiwanese computer hardware manufacturer Asus on Monday shipped urgent firmware updates to address vulnerabilities in its WiFi router product lines and warned users of the risk of remote code execution attacks. In an advisory, Asus documented at least nine security defects and multiple security weaknesses that allow code execution, denial-of-service, information disclosure and authentication bypasses. ..
Western Digital has blocked access to its cloud services for devices running firmware versions impacted by a known and critical security vulnerability. The move, which began on June 15, comes one month after the company released firmware updates for its My Cloud product line to address multiple security defects, including a critical path traversal bug ..
