Getty Images reader comments 24 with Firewalls made by Zyxel are being wrangled into a destructive botnet, which is taking control of them by exploiting a recently patched vulnerability with a severity rating of 9.8 out of a possible 10. “At this stage if you have a vulnerable device exposed, assume compromise,” officials from Shadowserver, ..
Tag : Vulnerabilities
An automatic update pushed to roughly five million WordPress sites over the past few days addresses a critical vulnerability introduced in 2012. Maintained by Automattic, Jetpack is a WordPress plugin providing security features such as malware scan, real-time backup and restore, spam and brute-force attack protection, and more. The suite of security tools has more ..
A zero-day vulnerability affecting Barracuda Networks email security appliances has been exploited to deploy malware and steal data from organizations for several months before it was discovered. The zero-day, tracked as CVE-2023-2868 and described as a remote command injection issue, impacts Email Security Gateway (ESG) appliances running versions 5.1.3.001 through 9.2.0.006. “The vulnerability stemmed from ..
Vulnerabilities identified in PrinterLogic’s enterprise management printer solution could expose organizations to authentication bypass, SQL injection, cross-site scripting (XSS) and other types of attacks. PrinterLogic’s platform allows organizations to manage all printers within their environments from a single console. An analysis of the PrinterLogic SaaS platform and of the source code of the Virtual Appliance ..
A Mirai botnet variant has been exploiting a recently patched vulnerability tracked as CVE-2023-28771 to hack many Zyxel firewalls. The Taiwan-based networking device manufacturer informed customers about the security hole on April 25, when it announced the availability of patches for impacted ATP, VPN, USG Flex and ZyWALL/USG firewalls. The OS command injection vulnerability, found ..
DevOps platform GitLab this week resolved a critical-severity vulnerability impacting both GitLab Community Edition (CE) and Enterprise Edition (EE). An open source end-to-end software development platform, GitLab helps developers and organizations build, secure, and operate software. The platform has approximately 30 million registered users. Tracked as CVE-2023-2825 and leading to arbitrary file reads, the newly ..
Security, application delivery and data protection solutions provider Barracuda Networks is warning customers about a zero-day vulnerability that has been exploited to hack the company’s Email Security Gateway (ESG) appliances. The zero-day, tracked as CVE-2023-2868, was addressed with a patch (BNSF-36456) that has been automatically applied to all impacted appliances. An entry in NIST’s vulnerability ..
OAuth-related vulnerabilities found in the widely used application development framework Expo could have been exploited to take control of user accounts, according to API security firm Salt Security. Expo is an open source platform for developing universal native apps for mobile devices and the web. The company says its product is used by more than ..
Latvian network equipment manufacturer MikroTik has shipped a patch for a major security defect in its RouterOS product and confirmed the vulnerability was exploited five months ago at the Pwn2Own Toronto hacking contest. In a barebones advisory documenting the CVE-2023-32154 flaw, Mikrotik confirmed the issue affects devices running MikroTik RouterOS versions v6.xx and v7.xx with ..
Samsung smartphone users have been warned by the vendor and the US Cybersecurity and Infrastructure Security Agency (CISA) about a recently patched vulnerability being exploited in attacks. The flaw in question is CVE-2023-21492, described as a kernel pointer exposure issue related to log files. The security hole can allow a privileged local attacker to bypass ..
