security update

Self-managed GitLab installations should be patched again (CVE-2024-0402)

January 30, 2024

Less than two weeks after having plugged a security hole that allows account takeover without user interaction, GitLab Inc. has patched a critical vulnerability …

Critical Jenkins RCE flaw exploited in the wild. Patch now! (CVE-2024-23897)

January 29, 2024

Several proof-of-concept (PoC) exploits for a recently patched critical vulnerability (CVE-2024-23897) in Jenkins have been made public and there’s evidence of …

Apple fixes actively exploited WebKit zero-day (CVE-2024-23222)

January 23, 2024

Apple has fixed an actively exploited zero-day vulnerability (CVE-2024-23222) that affects Macs, iPhones, iPads and AppleTVs. About CVE-2024-23222 CVE-2024-23222 is a type …

VMware: Plug critical Aria Automation hole immediately! (CVE-2023-34063)

January 18, 2024

A critical vulnerability (CVE-2023-34063) affecting VMware Aria Automation and VMware Cloud Foundation can be exploited by attackers to gain access to remote organizations and …

Google fixes actively exploited Chrome zero-day (CVE-2024-0519)

January 17, 2024

In the new stable release of the Chrome browser, Google has fixed three security vulnerabilities affecting the V8 engine, including one zero-day (CVE-2024-0519) with an …

Atlassian reveals critical Confluence RCE flaw, urges “immediate action” (CVE-2023-22527)

January 16, 2024

Atlassian has patched a critical vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution. The good news is that …

Juniper fixes critical RCE in its SRX firewalls and EX switches (CVE-2024-21591)

January 15, 2024

Juniper Networks has fixed a critical pre-authentication remote code execution (RCE) vulnerability (CVE-2024-21591) in Junos OS on SRX firewalls and EX switches. About …

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

January 12, 2024

A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have …

Critical Cisco Unity Connection flaw gives attackers root privileges. Patch now! (CVE-2024-20272)

January 11, 2024

Cisco has fixed a critical vulnerability (CVE-2024-20272) in Cisco Unity Connection that could allow an unauthenticated attacker to upload arbitrary files and gain root …

Microsoft fixes critical flaws in Windows Kerberos, Hyper-V (CVE-2024-20674, CVE-2024-20700)

January 9, 2024

For January 2024 Patch Tuesday, Microsoft has released fixes for 49 CVE-numbered vulnerabilities, two of which are critical: CVE-2024-20674 and CVE-2024-20700. None of the …

SQLi vulnerability in Cacti could lead to RCE (CVE-2023-51448)

January 9, 2024

A blind SQL injection vulnerability (CVE-2023-51448) in Cacti, a widely-used network monitoring, performance and fault management framework, could lead to information …

December 2023 Patch Tuesday: 33 fixes to wind the year down

December 12, 2023

Microsoft’s December 2023 Patch Tuesday is a light one: 33 patches, only four of which are deemed critical. “This month, Microsoft did not patch any zero-day …