Update now! Apple fixes three actively exploited vulnerabilities

Apple has released security updates for several products to address a set of flaws that it says are being actively exploited. Updates are available for these products: Safari 16.5.1 | macOS Big Sur and macOS Monterey ---|--- iOS 16.5.1 and iPadOS 16.5.1 | iPhone 8 and later, iPad Pro all models,...

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 AX1800 Wi-Fi routers to rope the devices into a distributed denial-of-service DDoS botnet. Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work ...

About the security content of Safari 16.5.1

About the security content of Safari 16.5.1 This document describes the security content of Safari 16.5.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

CVE-2023-2779

creationtimestamp| type| source ---|---|--- 2023-06-20 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/51534...

CVE-2023-32216

Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...

CVE-2023-35844

creationtimestamp| type| source ---|---|--- 2023-06-19 07:25:13+00:00| seen| https://t.me/cibsecurity/65328 2023-06-26 10:27:38+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/4628 2023-06-27 14:13:45+00:00| seen| https://t.me/proxybar/1596 2023-06-28 15:16:50+00:00|...

CVE-2023-33580

creationtimestamp| type| source ---|---|--- 2023-06-19 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/51528 2023-06-26 20:52:04+00:00| seen| https://t.me/cibsecurity/65519 2025-02-17 16:00:07+00:00| published-proof-of-concept| Telegram/Lk08SRcMS-SPvUQrC5iLhxWRyIgExecorO8K45SNl9E-Q...

Adobe Commerce Security Bypass Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company of a business and brand-oriented digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce, which can be exploited by an attacker to trigger a specially crafted script to bypass security features...

Adobe Commerce Security Bypass Vulnerability (CNVD-2023-50128)

Adobe Commerce is the United States of America Odobie Adobe company of a business and brand-oriented digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce, which can be exploited by an attacker to bypass security features...

Adobe Commerce Security Bypass Vulnerability (CNVD-2023-50129)

Adobe Commerce is the United States of America Odobie Adobe company of a business and brand-oriented digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce, which can be exploited by an attacker to bypass security features...

CVE-2023-35708

creationtimestamp| type| source ---|---|--- 2023-06-17 09:42:58+00:00| exploited| https://t.me/JerusalemElectronicArmy/401 2023-06-17 10:53:32+00:00| seen| Telegram/gubKb2Yanq1m7aRUYpFosJLMY1OTa0zqV9xfndvyMGC8wWQ 2023-06-19 07:24:22+00:00| seen| https://t.me/CyberSecurityIL/24237 2023-06-19...

Clop Hacking Rampage Hits US Agencies and Exposes Data of Millions

The ransomware gang Clop exploited a vulnerability in a file transfer service. The flaw is now patched, but the damage is still coming into focus...

Microsoft Excel Code Execution Vulnerability (CNVD-2023-80163)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2023-53462)

Microsoft SharePoint Server is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

SUMMARY From November 2022 through early January 2023, the Cybersecurity and Infrastructure Security Agency CISA and authoring organizations identified the presence of indicators of compromise IOCs at a federal civilian executive branch FCEB agency. Analysts determined that multiple cyber threat...

Debian DSA-5427-1 : webkit2gtk - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5427 advisory. - An out-of-bounds read was addressed with improved input validation. CVE-2023-28204 - A use-after-free issue was addressed with improved memory management...

CVE-2018-14839

creationtimestamp| type| source ---|---|--- 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:29:10+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971427 2024-12-27 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-12-2...

GHSA-WM5G-P99Q-66G4 elFinder vulnerable to path traversal in LocalVolumeDriver connector

Impact Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in...

ASUS RT-N10LX Cross-Site Scripting Vulnerability

The ASUS RT-N10LX is a router from the Chinese company ASUS. A cross-site scripting vulnerability exists in ASUS RT-N10LX Router version v2.0.0.39. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker ...

Siemens Teamcenter Visualization and JT2Go Null Pointer Dereference Vulnerability

JT2Go is a 3D JT viewing tool that allows users to view JT, PDF, Solid Edge, PLM XML with available JT, VFZ, CGM and TIF data.Teamcenter Visualization software is able to enhance its Product Lifecycle Management PLM environments with a comprehensive range of visualization solutions. PLM environme...