Malicious attackers can exploit Apache Superset installations running default configurations to gain administrator access and execute code on servers and databases, penetration testing firm Horizon3.ai warns. An open source application written in Python and based on the Flask web framework, Apache Superset provides users with the ability to explore and visualize large amounts of data. ..
Tag : Vulnerabilities
VMware this week announced patches for a critical-severity vulnerability in Workstation and Fusion that was disclosed in March 2023 at the Pwn2Own Vancouver hacking contest. Tracked as CVE-2023-20869 (CVSS score of 9.3), the issue was discovered by Star Labs researchers, who earned an $80,000 bug bounty reward for the finding. VMware’s advisory describes the security ..
Most Windows and macOS PaperCut installations have not been patched against a critical-severity vulnerability already exploited in attacks, according to a warning from endpoint and response security firm Huntress. The security defect, tracked as CVE-2023-27350 (CVSS 9.8/10), is described as an improper access control bug in the PaperCut MF/NG print management system. Attackers can exploit ..
A vulnerability in Google Cloud Platform (GCP) could have allowed attackers to maliciously change an OAuth application and hide it to create a stealthy backdoor to any Google account. Exploitation of the bug, referred to as GhostToken, could have allowed attackers to completely hide the malicious application from the Google user and leverage it to ..
Virtualization technology powerhouse VMware continues to encounter major security problems in its enterprise-facing log analysis product. The company shipped urgent patches on Thursday to cover critical security defects in the VMware Aria Operations for Logs (formerly vRealize Log Insight) product line and warned of the risk of pre-authentication remote root exploits. A critical-level advisory from ..
Print management solutions provider PaperCut has warned organizations that exploitation of a recently patched critical-severity vulnerability has commenced. Papercut offers a print management system called PaperCut MF/NG, which provides monitoring and control capabilities. With PaperCut NG organizations can manage and control printing, while PaperCut MF allows them to manage and track off-the-glass copier activity. Tracked ..
Fortra has completed the investigation into the recent zero-day incident involving its GoAnywhere managed file transfer (MFT) software and the company has shared a summary of its findings. The investigation, conducted with the aid of cybersecurity firm Palo Alto Networks, revealed that malicious activity started on January 18, with cybercriminals exploiting a zero-day vulnerability against ..
Google on Tuesday announced patches for another zero-day vulnerability found in the Chrome browser. Tracked as CVE-2023-2136, the security defect is described as a high-severity integer overflow issue in Skia. The bug was reported by Google Threat Analysis Group researcher Clement Lecigne and, per Google’s policy, no monetary reward was issued for it. “Google is ..
Oracle on Tuesday announced the release of 433 new patches as part of its quarterly set of security updates, including more than 70 fixes for critical-severity vulnerabilities. More than 250 of the addressed vulnerabilities can be exploited remotely and without authentication. Some of the resolved bugs impact multiple products. For the third quarter in a ..
Government agencies in the United States and United Kingdom have issued a joint cybersecurity advisory to warn organizations about attacks in which a Russian threat group has exploited an old vulnerability to hack Cisco routers. The threat actor in question is APT28 (aka Fancy Bear, Strontium, Pawn Storm, Sednit Gang and Sofacy), which has officially ..
