Zero Day in Ubiquitous Apache Log4j Tool Under Active Attack

An excruciating, easily exploited flaw in the ubiquitous Java logging library Apache Log4j could allow unauthenticated remote code execution RCE and complete server takeover — and it’s being exploited in the wild. The flaw first turned up on sites that cater to users of the world’s favorite game,...

CVE-2021-3935

CVE-2021-3935 affects PgBouncer when configured to use certificate authentication. A man-in-the-middle can inject arbitrary SQL queries at the first connection, even with TLS verification, in versions prior to 1.16.1. The root cause is not detailed in the initial document, but multiple connected ...

North Korean Hackers Target Cybersecurity Researchers with Trojanized IDA Pro

Lazarus, the North Korea-affiliated state-sponsored group, is attempting to once again target security researchers with backdoors and remote access trojans using a trojanized pirated version of the popular IDA Pro reverse engineering software. The findings were reported by ESET security researche...

CVE-2021-43618

creationtimestamp| type| source ---|---|--- 2021-11-15 07:11:51+00:00| seen| https://t.me/cibsecurity/32395 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

Man-in-the-Middle (MitM)

postgresql is vulnerable to man-in-the-middle attacks. A man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first created when the server is configured to use trust authentication with a 'clientcert' requirement or to utilize 'cert' authentication...

Ubuntu 18.04 LTS / 20.04 LTS : PostgreSQL vulnerabilities (USN-5145-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5145-1 advisory. Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly u...

CVE-2021-3572

creationtimestamp| type| source ---|---|--- 2021-11-10 20:36:33+00:00| seen| https://t.me/cibsecurity/32184 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

CVE-2021-42771

creationtimestamp| type| source ---|---|--- 2021-10-21 00:35:41+00:00| seen| https://t.me/cibsecurity/30924 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

OpenJDK: Certificates with end dates too far in the future can corrupt keystore (Keytool, 8266137)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Keytool. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated...

Fix of CVE: CVE-2021-22924

fix connection reuse checks for issuer cert and case sensitivity CVE-2021-22924...

ManageEngine ADSelfService Plus has been abused in the wild due to a zero-day vulnerability

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. An APT actor is attempting to exploit a zero-day vulnerability in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution that poses a high risk to critical infrastructure companies,...

Medium: curl

Issue Overview: A flaw was found in curl in the way curl handles a file hash mismatch after downloading content using the Metalink feature. This flaw allows malicious actors controlling a hosting server to trick users into downloading malicious content. The highest threat from this vulnerability ...

CERT NZ Releases Ransomware Protection Guide for Businesses

The New Zealand Computer Emergency Response Team CERT NZ has released a guide on ransomware protection for businesses. The guide includes a pair of helpful diagrams that outline different ransomware attack pathways and illustrate where relevant security controls can work to protect or stop an...

CVE-2021-33930

creationtimestamp| type| source ---|---|--- 2021-09-02 18:36:21+00:00| seen| https://t.me/cibsecurity/28219 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

CVE-2021-33929

creationtimestamp| type| source ---|---|--- 2021-09-02 18:36:16+00:00| seen| https://t.me/cibsecurity/28218 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

CVE-2021-33928

creationtimestamp| type| source ---|---|--- 2021-09-02 18:36:04+00:00| seen| https://t.me/cibsecurity/28216 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0395/...

Arcadyan Directory Traversal Vulnerability (Apr 2021) - Active Check

Arcadyan devices are prone to a directory traversal vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2021-22924

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead ...

CVE-2021-22924

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead ...

Code injection

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths case insensitively,which could lead ...