Horizon3.ai

PoC exploit for exploited Ivanti Cloud Services Appliance flaw released (CVE-2024-8190)

September 17, 2024

CVE-2024-8190, an OS command injection vulnerability in Ivanti Cloud Services Appliance (CSA) v4.6, is under active exploitation. Details about the attacks are still unknown, …

PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)

May 29, 2024

Horizon3.ai researches have released proof-of-concept (PoC) exploits for CVE-2024-23108 and CVE-2023-34992, vulnerabilities that allow remote, unauthenticated command …

HHS pledges $50M for autonomous vulnerability management solution for hospitals

May 23, 2024

As organizations in the healthcare sector continue to be a prime target for ransomware gangs and CISA warns about a vulnerability (CVE-2023-43208) in a healthcare-specific …

Critical FortiClient EMS vulnerability fixed, (fake?) PoC for sale (CVE-2023-48788)

March 14, 2024

A recently fixed SQL injection vulnerability (CVE-2023-48788) in Fortinet’s FortiClient Endpoint Management Server (EMS) solution has apparently piqued the interest of …

White House: Use memory-safe programming languages to protect the nation

February 27, 2024

The White House is asking the technical community to switch to using memory-safe programming languages – such as Rust, Python, Swift, C#, Java, and Go – to prevent …

PoC for easily exploitable Fortra GoAnywhere MFT vulnerability released (CVE-2024-0204)

January 24, 2024

Proof-of-concept (PoC) exploit code for a critical vulnerability (CVE-2024-0204) in Fortra’s GoAnywhere MFT solution has been made public, sparking fears that attackers …

Ivanti Sentry zero-day vulnerability exploited, patch ASAP! (CVE-2023-38035)

August 22, 2023

Ivanti is urging administrators of Ivanti Sentry (formerly MobileIron Sentry) gateways to patch a newly discovered vulnerability (CVE-2023-38035) that could be exploited to …

PaperCut fixes bug that can lead to RCE, patch quickly! (CVE-2023-39143)

August 7, 2023

Horizon3.ai researchers have published some details (but no PoC for now, thankfully!) about CVE-2023-39143, two vulnerabilities in PaperCut application servers that could be …

PoC exploit for exploited MOVEit vulnerability released (CVE-2023-34362)

June 13, 2023

As more victim organizations of Cl0p gang’s MOVEit rampage continue popping up, security researchers have released a PoC exploit for CVE-2023-34362, the RCE …

Common insecure configuration opens Apache Superset servers to compromise

April 26, 2023

An insecure default configuration issue (CVE-2023-27524) makes most internet-facing Apache Superset servers vulnerable to attackers, Horizon3.ai researchers have discovered. …

PoC exploit for abused PaperCut flaw is now public (CVE-2023-27350)

April 25, 2023

An unauthenticated RCE flaw (CVE-2023-27350) in widely-used PaperCut MF and NG print management software is being exploited by attackers to take over vulnerable application …

PoC exploit, IoCs for Fortinet FortiNAC RCE released (CVE-2022-39952)

February 21, 2023

Horizon3.ai’s Attack Team has released a PoC exploit for CVE-2022-39952, a critical vulnerability affecting FortiNAC, Fortinet’s network access control solution. …