Researchers Uncover 4-Month Cyberattack on U.S. Firm Linked to Chinese Hackers

A suspected Chinese threat actor targeted a large U.S. organization earlier this year as part of a four-month-long intrusion. According to Broadcom-owned Symantec, the first evidence of the malicious activity was detected on April 11, 2024 and continued until August. However, the company doesn't...

Russia-Linked Turla Exploits Pakistani Hackers' Servers to Target Afghan and Indian Entities

The Russia-linked advanced persistent threat APT group known as Turla has been linked to a previously undocumented campaign that involved infiltrating the command-and-control C2 servers of a Pakistan-based hacking group named Storm-0156 to conduct its own operations since 2022. The activity, firs...

The Road to Agentic AI: Exposed Foundations

Our research into Retrieval Augmented Generation RAG systems uncovered at least 80 unprotected servers. We highlight this problem, which can lead to potential data loss and unauthorized access...

PT-2024-35463

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.120.1 Description Synapse is an open-source Matrix homeserver. The issue arises from the failure to properly validate invites received over federation, allowing a malicious server to send a specially crafted invite...

Gafgyt Malware Targeting Docker Remote API Servers

Our researchers identified threat actors exploiting misconfigured Docker servers to spread the Gafgyt malware. This threat traditionally targets IoT devices; this new tactic signals a change in its behavior...

The vulnerability of the application software interface of the Cisco Unified Computing System’s servers—Cisco UCS B-Series, Managed C-Series, and X-Series—is related to the failure to implement measures to neutralize specific elements. This allows attackers to execute arbitrary code and elevate their privileges to the root level.

The vulnerability of the application software interface of the Cisco Unified Computing System’s servers—Cisco UCS B-Series, Managed C-Series, and X-Series—is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute...

Gafgyt Malware Broadens Its Scope in Recent Attacks

Our researchers identified threat actors exploiting misconfigured Docker servers to spread the Gafgyt malware. This threat traditionally targets IoT devices; this new tactic signals a change in its behavior...

The vulnerability of the BIOS and Firmware Update software on Intel Server Board S2600ST Family servers allows attackers to increase their privileges.

The vulnerability of the BIOS and Firmware Update software on Intel Server Board S2600ST Family microprogramming systems is related to an uncontrolled search path element. Exploiting this vulnerability can allow attackers to enhance their privileges...

Axis Communications Network Cameras and Video Servers Arbitrary OS Commands Execution (CVE-2004-2425)

Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent and possibly other shell metacharacters in the query string to virtualinput.cgi. This plugin only works with Tenable.ot. Please visit...

CVE-2024-5921

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

The vulnerabilities of web servers OZW672 and OZW772, related to the protection of user accounts, allow attackers to carry out attacks using cross-site scripting (XSS).

The vulnerabilities of web servers OZW672 and OZW772 are related to the lack of measures taken to protect the structure of web pages. Exploiting these vulnerabilities allows attackers who operate remotely to carry out attacks using cross-site scripting XSS with arbitrary JavaScript code...

RHEL 8 : haproxy (RHSA-2024:10271)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:10271 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy:...

Advanced threat predictions for 2025

We at Kaspersky's Global Research and Analysis Team monitor over 900 APT advanced persistent threat groups and operations. At the end of each year, we take a step back to assess the most complex and sophisticated attacks that have shaped the threat landscape. These insights enable us to anticipat...

h2: Loading of custom classes from remote servers through JNDI

A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...

K000148693: libssh2 vulnerability CVE-2015-1782

Security Advisory Description The kexagreemethods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service crash or have other unspecified impact via crafted length values in an SSHMSGKEXINIT packet. CVE-2015-1782 Impact There is no impact; F5 products are not affected ...

Hackers Exploit Misconfigured Jupyter Servers for Illegal Sports Streaming

Aqua Nautilus’ research reveals hackers are leveraging vulnerable and misconfigured Jupyter Notebook servers to steal live sports streams.…...

Linux Variant of Helldown Ransomware Targets VMware ESX Servers

Cybersecurity firm Sekoia has discovered a new variant of Helldown ransomware. The article details their tactics and how…...

aiohttp 3.10.6 < 3.10.11 Memory Leak Vulnerability - Windows

aiohttp is prone to a memory leak vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...