Zeljka Zorz

Unnamed APT eyes vulnerabilities in Rockwell Automation industrial contollers (CVE-2023-3595 CVE-2023-3596)

July 13, 2023

Rockwell Automation has fixed two vulnerabilities (CVE-2023-3595, CVE-2023-3596) in the communication modules of its ControlLogix industrial programmable logic controllers …

Chinese hackers forged authentication tokens to breach government emails

July 12, 2023

Sophisticated hackers have accessed email accounts of organizations and government agencies via authentication tokens they forged by using an acquired Microsoft account (MSA) …

Microsoft patches four exploited zero-days, but lags with fixes for a fifth (CVE-2023-36884)

July 11, 2023

For July 2023 Patch Tuesday, Microsoft has delivered 130 patches; among them are four for vulnerabilites actively exploited by attackers, but no patch for CVE-2023-36884, an …

Apple pushes out emergency fix for actively exploited zero-day (CVE-2023-37450)

July 11, 2023

Apple has patched an actively exploited zero-day vulnerability (CVE-2023-37450) by releasing Rapid Security Response updates for iPhones, iPads and Macs running the latest …

Flaw in Revolut payment systems exploited to steal $20 million

July 10, 2023

Organized criminal groups exploited a flaw in Revolut’s payment systems and made off with $20+ million of the company’s money, the Financial Times reported on Sunday, …

Malware delivery to Microsoft Teams users made easy

July 10, 2023

A tool that automates the delivery of malware from external attackers to target employees’ Microsoft Teams inbox has been released. TeamsPhisher (Source: Alex Reid) About the …

PoC for Arcserve UDP authentication bypass flaw published (CVE-2023-26258)

June 29, 2023

An authentication bypass vulnerability (CVE-2023-26258) in the Arcserve Unified Data Protection (UDP) enterprise data protection solution can be exploited to compromise admin …

Microsoft Teams vulnerability allows attackers to deliver malware to employees

June 23, 2023

Security researchers have uncovered a bug that could allow attackers to deliver malware directly into employees’ Microsoft Teams inbox. “Organisations that use …

Apple fixes zero-day vulnerabilities used to covertly deliver spyware (CVE-2023-32435)

June 22, 2023

Apple has released patches for three zero-day vulnerabilities (CVE-2023-32434, CVE-2023-32435, CVE-2023-32439) exploited in the wild. The first two have been reported by …

VMware Aria Operations for Networks vulnerability exploited in the wild (CVE-2023-20887)

June 21, 2023

CVE-2023-20887, a pre-authentication command injection vulnerability in VMware Aria Operations for Networks (formerly vRealize Network Insight), has been spotted being …

Zyxel patches critical vulnerability in NAS devices (CVE-2023-27992)

June 20, 2023

Zyxel has released firmware patches for a critical vulnerability (CVE-2023-27992) in some of its consumer network attached storage (NAS) devices. About CVE-2023-27992 …

A third MOVEit vulnerability fixed, Cl0p lists victim organizations (CVE-2023-35708)

June 19, 2023

Progress Software has asked customers to update their MOVEit Transfer installations again, to fix a third SQL injection vulnerability (CVE-2023-35708) discovered in the web …