Apple Rushes to Patch 3 New Zero-Day Flaws: iOS, macOS, Safari, and More Vulnerable

Apple has released yet another round of security patches to address three actively exploited zero-day flaws impacting iOS, iPadOS, macOS, watchOS, and Safari, taking the total tally of zero-day bugs discovered in its software this year to 16. The list of security vulnerabilities is as follows -...

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent lies in its authentication procedures’ flaws, which allow attackers to access confidential information.

The vulnerability of backup and data recovery software on computers and servers related to Acronis Agent lies in the flaws in the authentication process. Exploiting this vulnerability can allow attackers to access confidential information...

Critical Security Flaws Exposed in Nagios XI Network Monitoring Software

Multiple security flaws have been disclosed in the Nagios XI network monitoring software that could result in privilege escalation and information disclosure. The four security vulnerabilities, tracked from CVE-2023-40931 through CVE-2023-40934, impact Nagios XI versions 5.11.1 and lower. Followi...

Earth Lusca's New SprySOCKS Linux Backdoor Targets Government Entities

The China-linked threat actor known as Earth Lusca has been observed targeting government entities using a never-before-seen Linux backdoor called SprySOCKS. Earth Lusca was first documented by Trend Micro in January 2022, detailing the adversary's attacks against public and private sector entiti...

The mystery of the CVEs that are not vulnerabilities

A researcher specializing in Software Supply Chain security named Dan Lorenc recently raised an interesting topic on LinkedIn. 138 new vulnerabilities in open-source projects were all entered the same day to the CVE database. To understand what the problem is there are a few things youll need to...

The vulnerability of the software interface for Fortinet FortiManager, a centralized device management system, and FortiAnalyzer, a security event monitoring and analysis tool, allows a malicious individual to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the software interface for centralized device management in Fortinet FortiManager, as well as the event monitoring and analysis tool FortiAnalyzer, is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

SUSE-SU-2023:3647-1 Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002460 fixes several issues. The following security issues were fixed: - CVE-2023-32233: Fixed a use-after-free in Netfilter nftables when processing batch requests bsc1211187. - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handli...

SUSE-SU-2023:3629-1 Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122147 fixes several issues. The following security issues were fixed: - CVE-2023-3567: Fixed a use-after-free in vcsread in drivers/tty/vt/vcscreen.c bsc1213244. - CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nftbyteorder that could allow ...

ROS-20230915-14

Vulnerability in the AES-SIV encryption algorithm of the OpenSSL library is related to flaws in the procedure of authentication procedure. Exploitation of the vulnerability could allow a remote attacker to bypass the authentication process. the authentication process...

The vulnerability of the 3D viewer, which involves insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the 3D viewer software relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

SUSE-SU-2023:3612-1 Security update for the Linux Kernel (Live Patch 29 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024126 fixes several issues. The following security issues were fixed: - CVE-2023-32233: Fixed a use-after-free in Netfilter nftables when processing batch requests bsc1211187. - CVE-2023-3567: Fixed a use-after-free in vcsread in...

Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has released a new version which addresses the vulnerabilities. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable ...

Microsoft’s September 2023 Patch Tuesday Addresses Two Zero-day Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary In the September Patch Tuesday release, Microsoft addressed a total of 59 CVEs, encompassing five critical vulnerabilities. Within this range of vulnerabilities, the security update covered the...

The vulnerability of the Windows GDI component in Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows GDI component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Researchers Detail 8 Vulnerabilities in Azure HDInsight Analytics Service

More details have emerged about a set of now-patched cross-site scripting XSS flaws in the Microsoft Azure HDInsight open-source analytics service that could be weaponized by a threat actor to carry out malicious activities. "The identified vulnerabilities consisted of six stored XSS and two...

SUSE-SU-2023:3594-1 Security update for the Linux Kernel (Live Patch 24 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005993 fixes several issues. The following security issues were fixed: - CVE-2023-32233: Fixed a use-after-free in Netfilter nftables when processing batch requests bsc1211187. - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handlin...

Microsoft Releases Patch for Two New Actively Exploited Zero-Days Flaws

Microsoft has released software fixes to remediate 59 bugs spanning its product portfolio, including two zero-day flaws that have been actively exploited by malicious cyber actors. Of the 59 vulnerabilities, five are rated Critical, 55 are rated Important, and one is rated Moderate in severity. T...

McAfee Skyhigh Secure Web Gateway Security Vulnerability

McAfee Skyhigh Secure Web Gateway McAfee Skyhigh SWG is a family of secure gateways from McAfee, Inc. A security vulnerability exists in McAfee Skyhigh Secure Web Gateway that stems from a password management vulnerability that allows passwords to be stored in plain text...

The vulnerability of the Linux system integration tool in Microsoft Identity Linux Broker’s identity management environment allows a attacker to execute arbitrary code using a specially created malicious file.

The vulnerability of the Linux system integration tool in the Microsoft Identity Linux Broker environment is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.

The vulnerability of Windows operating system kernels is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...