Actively Exploited Zero-Day Bug in Cisco IOS XE Gives Attackers Total Admin Access to Affected Devices
Image source: Shutterstock Cisco recommends that customers immediately disable HTTPS Server feature on all Internet-facing devices running the operating system till a fix or other workaround becomes available. An unknown threat actor is actively exploiting a zero-day vulnerability in the web user interface of Cisco’s IOS XE operating system to drop an implant for arbitrary […]
Read More
These 5 Security Practices Can Help Protect Against 99% of Attacks: Do you Have Them?
Image source: Shutterstock Microsoft says telemetry from its Defender for Endpoint, Cloud Apps, Identity, Office 365 and other sources shows organizations can protect against almost all attacks with a few fundamental security practices. Organizations can protect against 99%–or nearly all—attacks by implementing a handful of basic security practices, a new Microsoft study has found. Microsoft’s […]
Read More
Dell Releases Update for Critical Flaw in SmartFabric Storage Software
Company wants customers to upgrade to patched version at “earliest opportunity”. Dell has released a security update to address a critical flaw in its SmartFabric Storage Software (SFSS). The vulnerability assigned as CVE-2023-32485 has a severity score of 9.8 on the CVSS scale. It affects version 1.3 and lower of the technology and allows an […]
Read More
Patch Now: Atlassian Discloses Zero-Day Bug in Confluence Data Center and Server
Image Source: Shutterstock Several customers have reported attackers exploiting the vulnerability to create unauthorized Confluence administrator accounts and to access Confluence instances, company says. Atlassian wants organizations using its on-premises Confluence Data Center and Server content collaboration software to immediately update to new versions that the company released today to address a critical privilege escalation […]
Read More
Here are 4 Vulnerabilities that CISA Added to the Known Exploited Vulnerabilities Catalog This Week.
Federal agencies need to apply vendor recommended mitigations for each flaw on or before October 25. The US Cybersecurity and Infrastructure Security Agency (CISA) has added a total of four security vulnerabilities to its Known Exploited Vulnerabilities (KEV) so far this week. Federal civilian executive branch agencies have until Oct. 25 to address the flaws. […]
Read More
CISA Adds Critical TeamCity Flaw to Known Exploited Vulnerabilities Catalog
Image source: Shutterstock Move follows reports this week of threat actors actively exploiting the flaw in ransomware attacks. The US Cybersecurity and Infrastructure Security Agency (CISA) has added a recently disclosed authentication bypass flaw in the JetBrains TeamCity CI/CD platform (CVE-2023-42793) to its catalog of known exploited vulnerabilities (KEV). The move follows recent reports about […]
Read More
Here’s What You Need to Know About the Severe “Looney TUNABLES” Vuln in Multiple Linux Distros
Image source: Shutterstock CVE-2023-4911 is a local privilege escalation flaw that gives attackers a way to gain root access on versions of Debian, Fedora, Ubuntu and other Linux distributions using the glibc library. Millions of Linux systems running default installations of certain versions of Debian, Fedora, Ubuntu—and likely other distributions using the GNU C Library […]
Read More
Researchers Report Attacks Targeting Max Severity Bug in Progress Software’s WS_FTP
Image source: Shutterstock The in-the-wild exploit activity could be a harbinger of things to come. As happened with a zero-day bug in Progress Software’s MOVEit file transfer software earlier this year, attackers have already started targeting a maximum severity vulnerability and other flaws the company disclosed last week in its WS_FTP Server file transfer technology. […]
Read More
What You Need to Know About the Critical New Bugs in Progress Software’s WS_FTP Server
Image source: Shutterstock Based on the extensive targeting of the previous bug in the company’s MOVEit product, it’s safe to bet attacks targeting the WS_FTP flaws are imminent. A maximum severity vulnerability is present in all versions of Progress Software’s widely used WS_FTP Server file transfer software that gives an unauthenticated attacker a way to […]
Read More
PoC Exploit Chain for Critical SharePoint Vulns Heightens Attack Risks
Orgs should immediately apply the patches that Microsoft issued for the flaws if they haven’t done so already. Researchers at Singapore-based StarLabs have released details of a chained remote code execution exploit they developed for two critical flaws in Microsoft SharePoint server that they previously discovered and disclosed to the company. Microsoft patched one of […]
Read More