A Windows zero-day vulnerability fixed by Microsoft with its April 2023 Patch Tuesday updates has been exploited by cybercriminals in ransomware attacks, according to Kaspersky. Microsoft’s latest round of security updates addresses roughly 100 vulnerabilities, including CVE-2023-28252, which has been described as a privilege escalation flaw affecting the Windows Common Log File System (CLFS) driver. ..
Tag : Vulnerabilities
German enterprise software maker SAP announced the release of 19 new notes on its April 2023 Security Patch Day, as well as five updates to previously released notes. Of the 24 notes included in SAP’s security updates (PDF), five are rated ‘hot news’, the highest severity rating. Two of these are new notes and three ..
For the second month in a row, Microsoft is pushing out urgent patches to cover an already-exploited vulnerability in its flagship Windows operating system. The vulnerability, flagged as zero-day by researchers at Mandiant, is described as an elevation of privilege issue in the Windows Common Log File System driver. In an advisory documenting the CVE-2023-28252, ..
Software maker Adobe on Tuesday shipped patches for at least 56 security vulnerabilities in a wide range of products, some serious enough to expose Windows and macOS users to code execution attacks. Adobe called special attention to its APSB23-24 bulletin that covers critical-severity security flaws in the widely deployed Adobe Acrobat and Reader software. “Successful ..
Siemens and Schneider Electric’s Patch Tuesday advisories for April 2023 address a total of 38 vulnerabilities found in their products. The total number of vulnerabilities is significantly smaller than in February and March, when the industrial giants addressed roughly 100 security issues. Siemens Siemens has published 14 new advisories that cover a total of 26 ..
Apple on Monday released updates for older versions of its iOS and macOS operating systems to patch zero-day vulnerabilities whose existence came to light last week. The tech giant informed customers on Friday, April 7, that iOS and iPadOS 16.4.1 and macOS Ventura 13.3.1 patch CVE-2023-28206 and CVE-2023-28205, two zero-day vulnerabilities that can be exploited ..
Microsoft Exchange Server 2013 has reached end of support on April 11, 2023, and will no longer receive security patches. The product will continue to work even after this date, but Microsoft is no longer providing technical support, bug fixes for usability and stability issues, time zone updates, and, importantly, fixes for vulnerabilities that could ..
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch three Veritas Backup Exec vulnerabilities exploited in ransomware attacks. A data backup product, Veritas Backup Exec supports mixed environments, with support for desktop operating systems, virtual environments (such as VMware and Hyper-V), and cloud platforms (including Amazon S3, Microsoft Azure, and ..
Only 2% of attack paths lead to critical assets. Securing the choke points through which they pass dramatically reduces risk. Security posture management firm XM Cyber took tens of thousands of attack path assessments involving more than 60 million exposures affecting 20 million entities during 2022, anonymized the datasets and exported them to Cyentia Institute ..
Apple on Friday pushed out a major iOS security update to fix a pair of zero-day vulnerabilities already being exploited in the wild. The newest iOS 16.4.1 and iPadOS 16.4.1 updates cover code execution software flaws in IOSurfaceAccelerator and WebKit, suggesting a complex exploit chain was detected in the wild hitting the latest iPhone devices. ..
