OAuth Redirect Flaw in Airline Travel Integration Exposes Millions to Account Hijacking

Cybersecurity researchers have disclosed details of a now-patched account takeover vulnerability affecting a popular online travel service for hotel and car rentals. "By exploiting this flaw, attackers can gain unauthorized access to any user’s account within the system, effectively allowing them...

CISA Under Trump

Jen Easterly is out as the Director of CISA. Read her final interview: There's a lot of unfinished business. We have made an impact through our ransomware vulnerability warning pilot and our pre-ransomware notification initiative, and I'm really proud of that, because we work on preventing somebo...

AI SOC Analysts: Propelling SecOps into the future

Triaging and investigating alerts is central to security operations. As SOC teams strive to keep up with ever-increasing alert volumes and complexity, modernizing SOC automation strategies with AI has emerged as a critical solution. This blog explores how an AI SOC Analyst transforms alert...

Rockwell Automation FactoryTalk View Site Edition

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain unauthenticated access to system configuration files and execute DLLs with elevated privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

Rockwell Automation DataMosaix Private Cloud

RISK EVALUATION Successful exploitation of these vulnerabilities could overwrite reports, including user projects. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all...

Schneider Electric Power Logic

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to modify data or cause a denial-of-service condition on web interface functionality. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these...

A Tumultuous Week for Federal Cybersecurity Efforts

Image: Shutterstock. Greg Meland. President Trump last week issued a flurry of executive orders that upended a number of government initiatives focused on improving the nation's cybersecurity posture. The president fired all advisors from the Department of Homeland Security's Cyber Safety Review...

CVE-2024-57052

creationtimestamp| type| source ---|---|--- 2025-01-27 22:58:42+00:00| seen| https://infosec.exchange/users/cve/statuses/113902794945002521 2025-01-27 23:15:35+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgr32ixnrh2f 2025-01-28 02:04:12+00:00| seen|...

CVE-2025-24123

creationtimestamp| type| source ---|---|--- 2025-01-27 22:18:00+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqxtjwu6i2c 2025-01-28 18:48:57+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113907474999986960 2025-03-18 04:00:00+00:00| seen|...

CVE-2024-48841

creationtimestamp| type| source ---|---|--- 2025-01-27 20:16:06+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqqzjt74p27 2025-01-27 20:28:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/113902206110094531 2025-01-27 21:51:58+00:00| seen|...

Do We Really Need The OWASP NHI Top 10?

The Open Web Application Security Project has recently introduced a new Top 10 project - the Non-Human Identity NHI Top 10. For years, OWASP has provided security professionals and developers with essential guidance and actionable frameworks through its Top 10 projects, including the widely used...

INE Security Alert: Expediting CMMC 2.0 Compliance

Cary, North Carolina, 26th January 2025, CyberNewsWire...

American National Insurance Company (ANICO) Data Leaked in MOVEit Breach

Cybersecurity researchers discovered 270,000+ lines of American National Insurance customer data leaked online, potentially linked to the 2023…...

US Privacy Snags a Win as Judge Limits Warrantless FBI Searches

Plus: A hacker finds an issue with Cloudflare’s systems that could reveal app users’ rough locations, and the Trump administration puts a wrench in a key cybersecurity investigation...

CVE-2024-50697

creationtimestamp| type| source ---|---|--- 2025-01-24 23:04:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3037 2025-01-25 02:07:06+00:00| seen| https://t.me/cvedetector/16350 2025-01-27 18:48:14+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113901810078905700 2025-03-...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-23006link is external SonicWall SMA1000 Appliances Deserialization Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber...

Cyber security guidance for small fleet operators

Introduction Cyber threats aren’t just a problem for large shipping organizations, small maritime fleet operators are also at risk. Anything from phishing emails to ransomware attacks, these threats can disrupt operations and compromise critical systems. This post is a guide to help small fleet...

MAL-2025-559 Malicious code in eslint-config-scality (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 315c3576289454d26857298b5dd200578c8f7002ae98ec2a45a9d51ec1f8438d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Everything is connected to security

Welcome to this week's edition of the Threat Source newsletter. Hello friends! Joe here again! I have just returned from the frozen northern tundra of Fargo, North Dakota. This was my first real visit to the frigid climates of the Midwest, and I have to say, they take cold to a new level. I was...

Custom Backdoor Exploiting Magic Packet Vulnerability in Juniper Routers

Enterprise-grade Juniper Networks routers have become the target of a custom backdoor as part of a campaign dubbed J-magic. According to the Black Lotus Labs team at Lumen Technologies, the activity is so named for the fact that the backdoor continuously monitors for a "magic packet" sent by the...