Zeljka Zorz

ENISA gives out toolbox for creating security awareness programs

January 23, 2023

The European Union Agency for Cybersecurity (ENISA) has made available Awareness Raising in a Box (AR-in-a-BOX), a “do it yourself” toolbox to help organizations …

Critical RCE vulnerabilities found in git (CVE-2022-41903, CVE-2022-23251)

January 19, 2023

A source code audit has revealed two critical vulnerabilities affecting git, the popular distributed version control system for collaborative software development. The latest …

Vulnerable NetComm routers and a public PoC exploit (CVE-2022-4873, CVE-2022-4874)

January 18, 2023

Two vulnerabilities (CVE-2022-4873, CVE-2022-4874) found in three NetComm router models could be exploited to achieve remote code execution on vulnerable devices, and …

Google ads increasingly pointing to malware

January 18, 2023

The FBI has recently warned the public about search engine ads pushing malware diguised as legitimate software – an old tactic that has lately resulted in too many …

PoC for critical ManageEngine bug to be released, so get patching! (CVE-2022-47966)

January 17, 2023

If your enterprise is running ManageEngine products that were affected by CVE-2022-47966, check now whether they’ve been updated to a non-vulnerable version because …

CircleCI breach post-mortem: Attackers got in by stealing engineer’s session cookie

January 16, 2023

The attackers who pulled off the recent breach of continuous integration and continuous delivery (CI/CD) platform maker CircleCI got in by compromising an engineer’s …

Cacti servers under attack by attackers exploiting CVE-2022-46169

January 16, 2023

If you’re running the Cacti network monitoring solution and you haven’t updated it since early December, now is the time to do it to foil attackers exploiting a …

Vulnerabilities in cryptographic libraries found through modern fuzzing

January 13, 2023

Recently patched vulnerabilities in MatrixSSL and wolfSSL, two open-source TLS/SSL implementations / libraries for embedded environments, have emphasized the great potential …

FortiOS flaw was exploited to compromise governmental targets (CVE-2022-42475)

January 13, 2023

A critical vulnerability in FortiOS SSL-VPN (CVE-2022-42475) that Fortinet has issued patches for in November 2022 has been exploited by attackers to compromise governmental …

Cisco won’t fix router flaws even though PoC exploit is available (CVE-2023-20025, CVE-2023-20026)

January 12, 2023

Cisco has acknowledged one critical (CVE-2023-20025) and two medium-severity (CVE-2023-20026, CVE-2023-20045) vulnerabilities affecting some of its Small Business series of …

ChatGPT: The infosec assistant that is jack of all trades, master of none

January 12, 2023

ChatGPT from OpenAI is a conversational chatbot that was recently released in preview mode for research purposes. It takes natural language as an input and aims to solve …

Crypto audit of Threema revealed many vulnerabilities

January 11, 2023

Researchers have discovered cryptographic vulnerabilities in Swiss-based secure messaging application Threema that may have allowed attackers to do things like break …