Unitronics Vision Legacy series (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Unitronics Equipment : Vision Legacy series Vulnerability : Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker...

Exploit for Deserialization of Untrusted Data in Apache Activemq

Apache ActiveMQ CVE-2023-46604 CVE-2023-46604 is a widely exp...

Rockwell Automation ControlLogix and GuardLogix Improper Input Validation (CVE-2024-3493)

A specific malformed fragmented packet type fragmented packets may be generated automatically by devices that send large amounts of data can cause a major nonrecoverable fault MNRF. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS advisories on April 16, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-107-01 Measuresoft ScadaPro ICSA-24-107-02 Electrolink FM/DAB/TV Transmitter...

RoboDK RoboDK

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 3.3 ATTENTION: Low attack complexity Vendor: RoboDK Equipment: RoboDK Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker crashing the program through heap-based buffer...

Measuresoft ScadaPro

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION : Low attack complexity Vendor : Measuresoft Equipment : ScadaPro Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate their privileges from unprivileged to...

CVE-2024-24795

creationtimestamp| type| source ---|---|--- 2024-04-13 12:35:34+00:00| seen| https://t.me/arpsyndicate/4650 2024-07-17 12:45:46+00:00| seen| https://vulnerability.circl.lu/bundle/c47579eb-e740-4902-8769-3c3df45be090 2024-11-14 12:00:00+00:00| seen|...

Roku Breach Hits 567,000 Users

Plus: Apple warns iPhone users about spyware attacks, CISA issues an emergency directive about a Microsoft breach, and a ransomware hacker tangles with an unimpressed HR manager named Beth...

De-risk the Software Supply Chain by Expanding Unparalleled Detection Coverage With Qualys VMDR and Software Composition Analysis

QIDs/CVEs When it comes to cybersecurity, speed is key in getting an edge over attackers. But when you consider that vulnerabilities weaponize 24 days faster than then they are remediated on average, cybersecurity stakeholders have a lot of catching up to do. While there are many ways defenders c...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

Compromise of Sisense Customer Data

CISA is collaborating with private industry partners to respond to a recent compromise discovered by independent security researchers impacting Sisense, a company that provides data analytics services. CISA urges Sisense customers to: Reset credentials and secrets potentially exposed to, or used ...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on April 11, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-102-01 Siemens SIMATIC S7-1500 ICSA-24-102-02 Siemens SIMATIC WinCC ICSA-24-102-03...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-3272 D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability CVE-2024-3273 D-Link Multiple NAS Devices Command Injection Vulnerability These...

CISA Issues Emergency Directive 24-02: Mitigating the Significant Risk from Nation-State Compromise of Microsoft Corporate Email System

Today, CISA publicly issued Emergency Directive ED 24-02 to address the recent campaign by Russian state-sponsored cyber actor Midnight Blizzard to exfiltrate email correspondence of Federal Civilian Executive Branch FCEB agencies through a successful compromise of Microsoft corporate email...

CVE-2024-27983

creationtimestamp| type| source ---|---|--- 2024-04-10 11:35:37+00:00| seen| https://t.me/arpsyndicate/4433 2024-04-14 11:38:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7046 2024-10-19 10:57:50+00:00| published-proof-of-concept| https://t.me/Rootsec2/4770 2024-10-19...

CVE-2024-2004

creationtimestamp| type| source ---|---|--- 2024-04-09 19:36:14+00:00| seen| https://t.me/arpsyndicate/4405 2024-11-14 12:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-04...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS advisory on April 9, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-100-01 SUBNET PowerSYSTEM Server and Substation Server CISA encourages users and...

Fortinet Releases Security Updates for Multiple Products

Fortinet released security updates to address vulnerabilities in multiple products, including OS and FortiProxy. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and...

CVE-2024-27316

creationtimestamp| type| source ---|---|--- 2024-04-09 08:14:27+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6990 2024-04-09 15:41:27+00:00| published-proof-of-concept| https://t.me/proxybar/1998 2024-04-21 14:48:36+00:00| published-proof-of-concept| https://t.me/redfoxsec/27...

Siemens SINEC NMS

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...