security update

Ivanti zero-day exploited to target Norwegian government (CVE-2023-35078)

July 25, 2023

A zero-day vulnerability (CVE-2023-35078) affecting Ivanti Endpoint Manager Mobile (EPMM) has been exploited to carry out an attack that affected 12 Norwegian ministries, the …

Apple fixes exploited zero-day in all of its OSes (CVE-2023-38606)

July 25, 2023

Apple has patched an exploited zero-day kernel vulnerability (CVE-2023-38606) in iOS, iPadOS, macOS, watchOS and tvOS. CVE-2023-38606 fix has been backported In early July, …

Citrix NetScaler zero-day exploited in the wild, patch is available (CVE-2023-3519)

July 19, 2023

Citrix has patched three vulnerabilities (CVE-2023-3519, CVE-2023-3466, CVE-2023-3467) in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), …

Adobe ColdFusion vulnerabilities exploited to deliver web shells (CVE-2023-29298, CVE-2023-38203)

July 18, 2023

Attackers are exploiting two Adobe ColdFusion vulnerabilities (CVE-2023-29298, CVE-2023-38203) to breach servers and install web shells to enable persistent access and allow …

Critical XSS vulnerability in Zimbra exploited in the wild (CVE-2023-34192)

July 17, 2023

A critical cross site scripting (XSS) vulnerability (CVE-2023-34192) in popular open source email collaboration suite Zimbra is being exploited by attackers. About the …

Unnamed APT eyes vulnerabilities in Rockwell Automation industrial contollers (CVE-2023-3595 CVE-2023-3596)

July 13, 2023

Rockwell Automation has fixed two vulnerabilities (CVE-2023-3595, CVE-2023-3596) in the communication modules of its ControlLogix industrial programmable logic controllers …

Microsoft patches four exploited zero-days, but lags with fixes for a fifth (CVE-2023-36884)

July 11, 2023

For July 2023 Patch Tuesday, Microsoft has delivered 130 patches; among them are four for vulnerabilites actively exploited by attackers, but no patch for CVE-2023-36884, an …

Apple pushes out emergency fix for actively exploited zero-day (CVE-2023-37450)

July 11, 2023

Apple has patched an actively exploited zero-day vulnerability (CVE-2023-37450) by releasing Rapid Security Response updates for iPhones, iPads and Macs running the latest …

PoC exploit released for Cisco AnyConnect, Secure Client vulnerability (CVE-2023-20178)

June 23, 2023

Proof-of-concept (PoC) exploit code for the high-severity vulnerability (CVE-2023-20178) in Cisco Secure Client Software for Windows and Cisco AnyConnect Secure Mobility …

Apple fixes zero-day vulnerabilities used to covertly deliver spyware (CVE-2023-32435)

June 22, 2023

Apple has released patches for three zero-day vulnerabilities (CVE-2023-32434, CVE-2023-32435, CVE-2023-32439) exploited in the wild. The first two have been reported by …

Zyxel patches critical vulnerability in NAS devices (CVE-2023-27992)

June 20, 2023

Zyxel has released firmware patches for a critical vulnerability (CVE-2023-27992) in some of its consumer network attached storage (NAS) devices. About CVE-2023-27992 …

VMware fixes critical flaws in Aria Operations for Networks (CVE-2023-20887)

June 15, 2023

VMware has fixed two critical (CVE-2023-20887, CVE-2023-20888) and one important vulnerability (CVE-2023-20889) in Aria Operations for Networks (formerly vRealize Network …