A critical authorization rules bypass vulnerability exists in Spring Security versions 5.7.0 to 5.7.4 and versions 5.6.0 to 5.6.8. The vulnerability gives attackers a way to potentially bypass an API gateway and…
Category: Vulnerabilities
5 things to know about the bugs patched in OpenSSL version 3.0.7
The first: This isn’t Heartbleed redux [298 words]. What bugs were fixed: OpenSSL version 3.0.7 fixes two “high” severity vulnerabilities in OpenSSL versions 3.0.0 to 3.0.6. The vulnerabilities are CVE-2022-3786 an X.509…
Five useful lists and tools for identifying resources with vulnerable OpenSSL in them
The OpenSSL project team will release a new version of the OpenSSL library (version 3.0.7) on Tuesday to address a critical vulnerability in version 3.0 to 3.6 of the widely used open…
ConnectWise patches critical flaw in its Recover and R1Soft Server Backup Manager technology
Vulnerability gives attackers a way to target thousands of MSPs and their downstream customers. Company urges customers to treat issue as a top priority [298 words]. What: ConnectWise has patched a critical,…
Four quick things to know about the critical bug in OpenSSL that will be disclosed Nov.1
The OpenSSL project team will release a new version of the OpenSSL library (version 3.0.7) on Tuesday to address a critical vulnerability in version 3.0 to 3.6 of the widely used open…
CISA Adds Patched Apple iOS/iPadOS Zero-Day to Known Exploited Vulnerabilities Catalog
CVE-2022-42827 is the eighth kernel level flaw so far this year for which Apple has released a patch only after active exploitation was underway [277 words]. What: CISA has added a newly…
Text4Shell flaw undergoing reanalysis
NIST says CVE-2022-42889 in Apache Commons Text has been modified [300 words] What: NIST has updated its entry in the National Vulnerability Database pertaining to the Text4Shell vulnerability in Apache Commons Text…
Attackers actively exploiting VMware flaw that CISA deemed as posing “unacceptable risk” in May
Multiple campaigns are using CVE-2022-22954 to drop ransomware, coin miners and Mirai [299 words]. What: Multiple malicious campaigns are actively targeting a previously disclosed and now patched remote code execution vulnerability in…
Vuln in GitHub Enterprise server could enable RCE on SVNBridge
Vulnerability has not been assigned a severity rating yet [242 words]. What: A deserialization of untrusted data vulnerability (CVE-2022-23734 )exists in multiple GitHub Enterprise Server versions that could potentially let a remote attacker execute…
HelpSystems releases Cobalt Strike 4.7.2 to address new RCE vulnerability
Out-of-band update addresses an issue for which IBM X-Force researchers had wanted a new CVE, but which HelpSystems says is not specific to its software [300 words] What: HelpSystems on October 17…