vulnerability disclosure

Be prepared to patch high-severity vulnerability in curl and libcurl

October 10, 2023

UPDATE (October 11, 2023, 07:15 a.m. ET): Curl v8.4.0 is out and fixes both CVE-2023-38545, a SOCKS5 heap buffer overflow vulnerability and CVE-2023-38546, a cookie injection …

Critical zero-days in Exim revealed, only 3 have been fixed

October 2, 2023

Six zero-days in Exim, the most widely used mail transfer agent (MTA), have been revealed by Trend Micro’s Zero Day Initiative (ZDI) last Wednesday. Due to what seems to …

How EU lawmakers can make mandatory vulnerability disclosure responsible

August 21, 2023

There is a standard playbook and best practice for when an organization discovers or is notified about a software vulnerability: The organization works quickly to fix the …

CyFox disclose Stremio vulnerability, developers don’t agree on findings

August 1, 2023

UPDATE: August 2, 10:21 AM PT The Stremio team published a blog post saying that they’ve received a report from CyFox, but that they did not consider it valid, so they …

Owncast, EaseProbe security vulnerabilities revealed

July 11, 2023

Oxeye has uncovered two critical security vulnerabilities and recommends immediate action to mitigate risk. The vulnerabilities were discovered in Owncast (CVE-2023-3188) and …

GitHub introduces private vulnerability reporting for open source repositories

April 27, 2023

GitHub has announced that its private vulnerability reporting feature for open source repositories is now available to all project owners. General availability The private …

Samsung, Vivo, Google phones open to remote compromise without user interaction

March 17, 2023

Several vulnerabilities in Samsung’s Exynos chipsets may allow attackers to remotely compromise specific Samsung Galaxy, Vivo and Google Pixel mobile phones with no user …

ICS vulnerabilities: Insights from advisories, how CVEs are reported

January 30, 2023

SynSaber recently released its second Industrial Control Systems (ICS) Vulnerabilities & CVEs Report. In this Help Net Security video, Ronnie Fabela, CTO at SynSaber, …

FortiOS flaw was exploited to compromise governmental targets (CVE-2022-42475)

January 13, 2023

A critical vulnerability in FortiOS SSL-VPN (CVE-2022-42475) that Fortinet has issued patches for in November 2022 has been exploited by attackers to compromise governmental …

Critical vulnerabilities in Siemens PLC devices could allow bypass of protected boot features (CVE-2022-38773)

January 12, 2023

Red Balloon Security disclosed multiple, critical architectural vulnerabilities in the Siemens SIMATIC and SIPLUS S7-1500 Series PLC that allow for bypass of all protected …

The most frequently reported vulnerability types and severities

November 4, 2022

Bishop Fox collected and analyzed publicly disclosed reports from January to July 2022 to better understand the most frequently reported vulnerability types, the …

ConnectWise backup solutions open to RCE, patch ASAP!

October 31, 2022

ConnectWise has fixed a critical vulnerability in ConnectWise Recover and R1Soft Server Backup Manager that could allow attackers to achieve remote code exection (RCE) or …