7017 matches found
New Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution
A new zero-day pre-authentication remote code execution vulnerability has been disclosed in the Apache OFBiz open-source enterprise resource planning ERP system that could allow threat actors to achieve remote code execution on affected instances. Tracked as CVE-2024-38856, the flaw has a CVSS...
CVE-2024-7539
creationtimestamp| type| source ---|---|--- 2024-08-06 03:17:34+00:00| seen| https://t.me/cvedetector/2503 2025-12-10 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1069/...
(0Day) (Pwn2Own) ChargePoint Home Flex wlanchnllst Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanchnllst function. The issue results from the...
Qualys Announces TruRisk Eliminate to Augment Patching
About 5 years ago, we launched Qualys Patch Management to empower our customers to not just detect and prioritize vulnerabilities but also effectively remediate them. Since then, we have assisted our customers in addressing hundreds of millions of vulnerabilities, significantly enhancing the...
CVE-2024-42070
creationtimestamp| type| source ---|---|--- 2024-07-29 18:48:41+00:00| seen| https://t.me/cvedetector/1885 2024-12-03 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1642/...
Telegram Android Vulnerability “EvilVideo” Sends Malware as Videos
EvilVideo exploit in Telegram for Android lets attackers send malware disguised as videos. ESET discovered this zero-day vulnerability,…...
China-linked APT17 Targets Italian Companies with 9002 RAT Malware
A China-linked threat actor called APT17 has been observed targeting Italian companies and government entities using a variant of a known malware referred to as 9002 RAT. The two targeted attacks took place on June 24 and July 2, 2024, Italian cybersecurity company TG Soft said in an analysis...
Void Banshee APT Exploits Microsoft MHTML Flaw to Spread Atlantida Stealer
An advanced persistent threat APT group called Void Banshee has been observed exploiting a recently disclosed security flaw in the Microsoft MHTML browser engine as a zero-day to deliver an information stealer called Atlantida. Cybersecurity firm Trend Micro, which observed the activity in mid-Ma...
CVE-2024-38112: Void Banshee Targets Windows Users Through Zombie Internet Explorer in Zero-Day Attacks
Our threat hunters discovered CVE-2024-38112, which was used as a zero-day by APT group Void Banshee, to access and execute files through the disabled Internet Explorer using MSHTML. We promptly identified and reported this zero-day vulnerability to Microsoft, and it has been patched...
iPhone users in 98 countries warned about spyware by Apple
In April 2024, we reported how Apple was warning people of mercenary attacks via its threat notification system. At the time it warned users in 92 countries. In a new round, Apple is now warning users in 98 countries of potential mercenary spyware attacks. The message sent to the affected users...
Smash-and-Grab Extortion
The Problem The "2024 Attack Intelligence Report" from the staff at Rapid7 1 is a well-researched, well-written report that is worthy of careful study. Some key takeaways are: 1. 53% of the over 30 new vulnerabilities that were widely exploited in 2023 and at the start of 2024 were zero-days. 2...
Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs
Given the recent slate of massive ransomware attacks that have disrupted everything from hospitals to car dealerships, Cisco Talos wanted to take a renewed look at the top ransomware players to see where the current landscape stands. Based on a comprehensive review of more than a dozen prominent...
Patch Tuesday - July 2024
Microsoft is addressing 139 vulnerabilities this July 2024 Patch Tuesday, which is on the high side in terms of typical CVE counts. They’ve also republished details for 4 CVEs issued by other vendors that affect Microsoft products. Microsoft has evidence of in-the-wild exploitation for 2 of the...
Microsoft Patch Tuesday, July 2024 Edition
Microsoft Corp. today issued software updates to plug at least 139 security holes in various flavors of Windows and other Microsoft products. Redmond says attackers are already exploiting at least two of the vulnerabilities in active attacks against Windows users. The first Microsoft zero-day thi...
CVE-2024-5652
creationtimestamp| type| source ---|---|--- 2024-07-09 19:48:19+00:00| seen| https://t.me/cvedetector/386 2025-03-19 16:18:17+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8092 2025-05-21 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-306/...
Microsoft and Adobe Patch Tuesday, July 2024 Security Update Review
Julys Patch Tuesday brings a midsummer wave of updates, addressing critical vulnerabilities and enhancing security across the Microsoft ecosystem. Lets discover the highlights from Microsofts Patch Tuesday updates for July 2024. Microsoft Patch Tuesday for July 2024 Microsoft Patch Tuesdays July...
boncoo.com Cross Site Scripting vulnerability OBB-3942439
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Sharp Multi-Function Printer 18 Vulnerabilities
Hello, Please find a text-only version below sent to security mailing lists. The complete version on "17 vulnerabilities in Sharp Multi-Function Printers" is posted here: https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html The text version is also posted here:...
