Progress Software is urging MOVEit customers to apply patches to a third critical vulnerability in the file transfer software in less than one month. Tracked as CVE-2023-35708, the latest vulnerability is described as an SQL injection flaw that could allow an unauthenticated attacker to escalate privileges and access the MOVEit Transfer database. “An attacker could ..
Tag : Vulnerabilities
Hot on the heels of a $6 million seed funding round, cybersecurity startup SquareX today announced a six-week bug bounty program focused on its new cloud-based browser security solution. Integrating with the browser as an extension, the solution protects users from malware and also allows them to remain private online, through temporary containers that SquareX ..
Microsoft’s security response team on Tuesday rolled out a massive batch of software updates to address major security gaps in its flagship Windows operating system and software components. Redmond’s monthly Patch Tuesday updates cover at least 70 documented vulnerabilities affecting the Windows ecosystem, including six critical issues that expose users to dangerous code execution attacks. ..
A Chinese cyberespionage group tracked as UNC3886 has been observed exploiting a VMware ESXi zero-day vulnerability to escalate privileges on guest virtual machines, Mandiant warns. Initially detailed in September 2022, UNC3886 has been using malicious vSphere Installation Bundles (VIBs) – packages that are typically used to maintain systems and deploy updates – to install backdoors ..
Today we find ourselves using cloud native technologies to increase flexibility, scaling and cost savings in many respects. The modern cloud stack using IaaS, abstracts the hardware maintenance component away and you are left with everything above such as the operating system and software. Golden images have been a simple concept used in practice for ..
Progress Software has released another round of patches for its MOVEit products after researchers discovered new vulnerabilities while analyzing the recent zero-day. The news comes just as more organizations hit by the zero-day attack have come forward. The zero-day affecting the MOVEit Transfer and Cloud managed file transfer (MFT) software, tracked as CVE-2023-34362 and described ..
Fortinet has patched a critical FortiGate vulnerability that can be exploited by an unauthenticated attacker for remote code execution, according to the researchers who reported the flaw to the vendor. The vulnerability is tracked as CVE-2023-27997 and it was discovered by researchers at French offensive IT security firm Lexfo. Charles Fol, one of the researchers, ..
Newly uncovered evidence suggests that cybercriminals have known about the recently patched MOVEit Transfer zero-day vulnerability since mid-2021. The zero-day affecting the managed file transfer (MFT) software, tracked as CVE-2023-34362, started being widely exploited on or around May 27. The product’s developer, Progress Software, alerted customers on May 31, but at least 100 organizations have ..
A researcher has disclosed the details of serious vulnerabilities discovered in a Honda ecommerce platform used for equipment sales. Exploitation of the flaws could have allowed an attacker to gain access to customer and dealer information. The security holes and the data exposure were discovered earlier this year by US-based researcher Eaton Zveare, who notified ..
Cisco on Wednesday announced patches for a critical vulnerability in its Expressway series and TelePresence Video Communication Server (VCS) enterprise collaboration and video communication solutions. Tracked as CVE-2023-20105 (CVSS score of 9.6), the vulnerability allows an administrator with ‘read-only’ rights to elevate their privileges to ‘read-write’. The issue exists because password change requests are not ..
