security update

PaperCut fixes bug that can lead to RCE, patch quickly! (CVE-2023-39143)

August 7, 2023

Horizon3.ai researchers have published some details (but no PoC for now, thankfully!) about CVE-2023-39143, two vulnerabilities in PaperCut application servers that could be …

Ivanti discloses another vulnerability in MobileIron Core (CVE-2023-35082)

August 3, 2023

Ivanti has disclosed a critical vulnerability (CVE-2023-35082) affecting old, out-of-support versions of MobileIron Core, an enterprise device solution that has since been …

Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081)

July 31, 2023

Another actively exploited zero-day vulnerability (CVE-2023-35081) affecting Ivanti Endpoint Manager Mobile (EPMM) has been identified and fixed. The first zero-day spotted …

Ivanti zero-day exploited to target Norwegian government (CVE-2023-35078)

July 25, 2023

A zero-day vulnerability (CVE-2023-35078) affecting Ivanti Endpoint Manager Mobile (EPMM) has been exploited to carry out an attack that affected 12 Norwegian ministries, the …

Apple fixes exploited zero-day in all of its OSes (CVE-2023-38606)

July 25, 2023

Apple has patched an exploited zero-day kernel vulnerability (CVE-2023-38606) in iOS, iPadOS, macOS, watchOS and tvOS. CVE-2023-38606 fix has been backported In early July, …

Citrix NetScaler zero-day exploited in the wild, patch is available (CVE-2023-3519)

July 19, 2023

Citrix has patched three vulnerabilities (CVE-2023-3519, CVE-2023-3466, CVE-2023-3467) in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), …

Adobe ColdFusion vulnerabilities exploited to deliver web shells (CVE-2023-29298, CVE-2023-38203)

July 18, 2023

Attackers are exploiting two Adobe ColdFusion vulnerabilities (CVE-2023-29298, CVE-2023-38203) to breach servers and install web shells to enable persistent access and allow …

Critical XSS vulnerability in Zimbra exploited in the wild (CVE-2023-34192)

July 17, 2023

A critical cross site scripting (XSS) vulnerability (CVE-2023-34192) in popular open source email collaboration suite Zimbra is being exploited by attackers. About the …

Unnamed APT eyes vulnerabilities in Rockwell Automation industrial contollers (CVE-2023-3595 CVE-2023-3596)

July 13, 2023

Rockwell Automation has fixed two vulnerabilities (CVE-2023-3595, CVE-2023-3596) in the communication modules of its ControlLogix industrial programmable logic controllers …

Microsoft patches four exploited zero-days, but lags with fixes for a fifth (CVE-2023-36884)

July 11, 2023

For July 2023 Patch Tuesday, Microsoft has delivered 130 patches; among them are four for vulnerabilites actively exploited by attackers, but no patch for CVE-2023-36884, an …

Apple pushes out emergency fix for actively exploited zero-day (CVE-2023-37450)

July 11, 2023

Apple has patched an actively exploited zero-day vulnerability (CVE-2023-37450) by releasing Rapid Security Response updates for iPhones, iPads and Macs running the latest …

PoC exploit released for Cisco AnyConnect, Secure Client vulnerability (CVE-2023-20178)

June 23, 2023

Proof-of-concept (PoC) exploit code for the high-severity vulnerability (CVE-2023-20178) in Cisco Secure Client Software for Windows and Cisco AnyConnect Secure Mobility …